MD5 Hash

[wildboy211]

Okay, im trying to figure out if theres a vulnerability on my website. My website encrypts passwords via MD5, is there any PHP or SQL vulnerablity to get a password from my site, here some code that my site uses to encrypt a password:

Code: Select all

$row['pass'] == md5($row['secret'] . $password . $row['secret'])


$row['secret'] is a random md5 hash generated when the user registered stored in the database. Is there a way to hack into the database and find the password? I also know that after a user logs in, it stores a cookie with the username and MD5 hash value.

[BhaaL]

Knowing 'secret', one could attempt to brute-force the password. But considering you store it in a cookie, also add stuff like the Users IP for example and check that. Else one could forge a cookie with the Username/Hash (think of someone dumping your database, having obtained the whole user table, but no passwords cracked yet) and be logged in without ever knowing the password.

[dotdotslash]

Can some one tell me how to recognize a md5,md4 hash ? whats the diffrence between these hashes (SHA,md5 )and all .Just by looking and if not is there any other means ..

[nathandelane]

Can some one tell me how to recognize a md5,md4 hash ? whats the diffrence between these hashes (SHA,md5 )and all .Just by looking and if not is there any other means ..

MD4 Sums are 128 bits in length, for example b86e130ce7028da59e672d56ad0113df. MD5 Sums are also 128 bits in length, for example 9e107d9d372bb6826bd81d3542a419d6 (both hashes are from the phrase "The quick brown fox jumps over the lazy dog"). So I can see that it would be somewhat difficult to tell them apart. I don't believe that there is a way to know the difference just by looking at them. But you can probably guess in most cases, especially if you know when the hash (date-wise) was created. Most people will opt for a higher quality hash as the quality of hashes is found to be fragile. In the case of MD4, "Weaknesses in MD4 were demonstrated by Den Boer and Bosselaers in a paper published in 1991," (From Wikipedia) so I suspect that most programs written after 1991 utilize SHA-like or MD5 hashing.

Knowing your history really counts when it comes to hacking.