1. Advertising
    y u no do it?

    Advertising (learn more)

    Advertise virtually anything here, with CPM banner ads, CPM email ads and CPC contextual links. You can target relevant areas of the site and show ads based on geographical location of the user if you wish.

    Starts at just $1 per CPM or $0.10 per CPC.

MD5 Can be Decrypted. Unbelievable!

Discussion in 'PHP' started by cancer10, Apr 11, 2009.

0
  1. #1
    Hi Guys!

    Until yesterday I was under an impression that MD5 hashes cannot be reversed and is thus secured but then I found this site http://www.md5decryption.com/ which actually reverses your MD5 hash value, I was like WTF.

    I am sure there are other sites that can decrypt other hash functions like sha1, tiger160, sha256 etc.

    Please share your views about it?


    Thanks
     
    cancer10, Apr 11, 2009 IP
  2. SmallPotatoes

    SmallPotatoes Peon

    Messages:
    1,321
    Likes Received:
    41
    Best Answers:
    0
    Trophy Points:
    0
    #2
    These sites just have large databases of the md5 hashes of common strings. They're not really decoding it (that's not possible since there are multiple possible inputs for every md5 hash), just providing a tool for dictionary attacks.
     
    SmallPotatoes, Apr 12, 2009 IP
    harrisunderwork likes this.
  3. cancer10

    cancer10 Guest

    Messages:
    364
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #3
    ok

    I have a question in my mind


    what if its an 10 character alphanumeric password and the attack is a brute force attack?

    Then how much time will it take to recover the password using a modern PC?
     
    cancer10, Apr 12, 2009 IP
  4. oarcadescript

    oarcadescript Peon

    Messages:
    34
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    0
    #4
    since its a quadratic function, simply increasing the length by a few characters will take a while.

    quite a while, there's a hell of a lot of combinations its 36^10 (3,600,000,000,000,000) combinations.

    If you're worried about decryption bear in mind they might have the MD5 for 'rabbit' but not n7sns}{383_rabbit, so just salt all your passwords.
     
    oarcadescript, Apr 12, 2009 IP
  5. cancer10

    cancer10 Guest

    Messages:
    364
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #5
    Whats the best way of salting?
     
    cancer10, Apr 12, 2009 IP
  6. ghprod

    ghprod Active Member

    Messages:
    1,010
    Likes Received:
    11
    Best Answers:
    0
    Trophy Points:
    78
    #6
    they're not really do that job ... just matching with available database of MD5 ....

    regards
     
    ghprod, Apr 12, 2009 IP
  7. oarcadescript

    oarcadescript Peon

    Messages:
    34
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    0
    #7
    generate a random string when the user signs up, store it as the salt

    then when the user logs in check to see if the salt combined with the password enters matches the password!

    so password is '6436d1797416c4ad0a479dfc584ee999' which is jd84napples md5 encrypted
    store the salt as jd84

    then when the user logs in see if the salt and the text entered is the password!

    so i enter pears

    it sees if my password is md5(jd84pears) and no its not. if i enter apples md5(jd84apples) and yes it is!
     
    oarcadescript, Apr 12, 2009 IP
    Claudek likes this.
  8. harrisunderwork

    harrisunderwork Well-Known Member

    Messages:
    1,005
    Likes Received:
    21
    Best Answers:
    0
    Trophy Points:
    135
    #8
    Get user's password, generate a fixed length salt . Combine md5 hash of password with salt, then rehash it.

    Store the new hash and the salt in db.

    User enter the password, instead of sending password, send the md5, so it is safe from hacker. Second combine with salt found in username, rehash it and compare with stored hased :)

    If match, login else invalid user !
     
    harrisunderwork, Apr 13, 2009 IP
  9. zendowind

    zendowind Banned

    Messages:
    30
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #9
    md5 can't be decrypted ;)
     
    zendowind, Apr 13, 2009 IP
  10. LiMoO

    LiMoO Well-Known Member

    Messages:
    161
    Likes Received:
    0
    Best Answers:
    1
    Trophy Points:
    133
    #10
    Not all inputs

    A decryption for this hash wasn't found in our database
     
    LiMoO, Apr 13, 2009 IP
  11. jazzcho

    jazzcho Peon

    Messages:
    326
    Likes Received:
    4
    Best Answers:
    0
    Trophy Points:
    0
    #11
    MD5 is considered insecure since there have been various papers (and code) that have demonstrated collisions.
     
    jazzcho, Apr 16, 2009 IP
  12. sliver

    sliver Peon

    Messages:
    29
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #12
    md5 can't be decrypted, anyway you should find usefull lectures about rainbow tables ;)
     
    sliver, Apr 16, 2009 IP
  13. arunn

    arunn Active Member

    Messages:
    347
    Likes Received:
    7
    Best Answers:
    0
    Trophy Points:
    60
    #13
    they have two websites.. one to encrypt and one to decrypt.. so watever people encrypt using their website they store in a databse and use them to decrypt strings. :)
     
    arunn, Apr 21, 2009 IP