HomeCalendarCertificationsColumnsFeaturesForumResourcesVitals
 
Image
 
Latest Additions
 
EH-Net Login
Welcome Guest.
Lost Password?
No account yet? Register
Who's Online
We have 21 guests and 2 members online
EH-Net Donations

Enter Amount:
$
Google Ads
EH-Net News Feeds
Latest Additions
Book Recommendations



 
Advertisement

You are here: Home arrow Forum arrow Resourcesarrow Tutorialsarrow MD5 with salt encryption
Ethical Hacker Community Forums
November 23, 2008, 08:05:19 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: ChicagoCon 2-Day Ethical Hacking Conference with MS Blue Hats Oct 31 - Nov 1. Tickets Only $100! www.chicagocon.com/content/view/103/51/
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
« previous next »
  Print  
Author Topic: MD5 with salt encryption  (Read 3153 times)
0 Members and 1 Guest are viewing this topic.
xorf
Newbie
*
Offline Offline

Posts: 4


View Profile
« on: October 13, 2007, 05:22:05 AM »
I currently run a VBulletin community forum.

I only started to use cain, but it will not decrypt any of the MD5 hashes, even a very simple 5 dictionary character that i purposely added as a test.

is it because vbulletin uses salt along with the MD5?
Logged
Manu Zacharia (-M-)
Full Member
***
Offline Offline

Posts: 193



View Profile WWW
« Reply #1 on: October 13, 2007, 08:25:32 AM »
Hi Xorf,

I think that is the reason why you are unable to decrypt any of the MD5 hashes. vBulletin passwords are stored in the following format:

Code:
$password_hash = md5(md5($password_text) . $user_salt);

Note - $user_salt is a random three character string stored in the user table as 'salt'.

 
Logged
Manu Zacharia
Certified ISO 27001:2005 (Information Security Management System) Lead Auditor
Promote the Information Security Day
Visit - http://www.informationsecurityday.com
xorf
Newbie
*
Offline Offline

Posts: 4


View Profile
« Reply #2 on: October 13, 2007, 08:39:48 AM »
Hey Morpheus,

Ya i noticed the string within the table. a combination of a-z A-Z 0-9 and a symbol

is there a way to decrypt the MD5 hash even if it is further encrypted with slat?
Logged
Craig
EH-Net Columnist
Jr. Member
*****
Offline Offline

Posts: 62


View Profile WWW
« Reply #3 on: October 13, 2007, 07:17:51 PM »
Yahoo mail used to use the exact same method to hash their passwords. Google for a program called Ycrack (dictionary attack tool), it should work for your situation - just substitute your $user_salt string for the challenge string that Yahoo used.

P.S. - If you want to speed up Ycrack, delete the line
Code:
printf("Trying:%s\n",string);
before compiling it.
Logged
http://www.sourcesec.com
Pages: [1]   Go Up
  Print  
« previous next »
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.7 | SMF © 2006-2008, Simple Machines LLC
Joomla Bridge by JoomlaHacks.com 		Valid XHTML 1.0! Valid CSS!
Page created in 0.034 seconds with 23 queries.
 
Sponsors

cwnp_moto__120x90.gif

Polls
During the most recent election, I:
 
Support EH-Net

Support EH-Net by
Buying all of your
Amazon items using
the search bar above.
cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!
Recent Forum Topics
Vote For EH-Net

progenic.com
Click here to Vote!

Sadikhov.com
Top IT Cert Sites

binarica.com
Binarica Logo

Add to Technorati Favorites
technorati fave

 
         
Advertisement

© 2008 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.