[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20060310160628.GA2721@openwall.com>
Date: Fri, 10 Mar 2006 19:06:28 +0300
From: Solar Designer <solar@...nwall.com>
To: john-users@...ts.openwall.com
Subject: Re: checking only first 5 characters of a md5 hash
On Fri, Mar 10, 2006 at 02:59:30PM +0100, Turko wrote:
> > > My problem is this: I have only the first 5 characters of a md5 hash.
[...]
> They are taken from a php generated hash that I m using for locale tests
> on my webserver :
>
> $code = substr(base64_encode(md5($mykey)),0, 5);
Well, those are the first 5 characters of a base64 encoding of a hex
encoding of an MD5 hash. That's something between 12 and 16 bits.
> > That would require a source code patch.
>
> is it hard to write? Maybe I can try...but how ?
I'm afraid, it'd be a little too hard for you. You'd have to implement
base64 encoding or decoding. You also don't need to do it:
> > If you only need this done once, it might be quicker for you to write a
> > Perl script that would use Digest::MD5 and accept a stream of candidate
> > passwords on the standard input. Then use "john ... --stdout" to feed
> > candidate passwords to this Perl script.
>
>
> Mhhmmm, I m not an expert programmer as you can imagine...So the steps are:
>
> 1- Writing a script that receives ascii passwords from John,
> 2- encrypt them,
> 3- and then check the first 5 characters of the hash (right ?)
Almost - except that it's called "hashing" and not "encryption", and all
of these steps are to be performed in your script.
Now that you've finally described what type of hash you have - and now
that you've also mentioned that you're already dealing with PHP code -
my suggestion would be that you write your cracker program in PHP.
You don't really need the power of John to crack something as trivial as
what you have there. There can only be a little over 20 thousand
different values of $code, so you can expect to find a suitable password
if you search about this many candidates. This can be done in under a
second with pure PHP code:
<?php
$mycode = "ZTNlM";
$mykey = "a";
while (1) {
$code = substr(base64_encode(md5($mykey)), 0, 5);
if ($code == $mycode) break;
$mykey++;
}
print "$mykey\n";
?>
Please note that this loop may run forever in case $mycode is set to a
string not produced by the $code = ... line from your message.
--
Alexander Peslyak <solar at openwall.com>
GPG key ID: B35D3598 fp: 6429 0D7E F130 C13E C929 6447 73C3 A290 B35D 3598
http://www.openwall.com - bringing security into open computing environments
Was I helpful? Please give your feedback here: http://rate.affero.net/solar
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
