0
$\begingroup$

if you know the result of a hash, for this example the resulting hash is: ec664d1d65fd8a58c59b337b11c37a4d

And you also know the hash has been made like this:

const salt = "asdjbsdhal"
const password = unknown; // only thing we don't know
const hash = md5(salt + password);

So we know that md5(salt + password) == "ec664d1d65fd8a58c59b337b11c37a4d".

Is there a more efficient way to break this password than brute-force? The brute-force I'm trying right now is this:

const md5 = require("md5");

const expectedHash = "ec664d1d65fd8a58c59b337b11c37a4d";
const salt = "asdjbsdhal";
let nonce = 0;
let result = "";

while (result != expectedHash) {
  nonce++;
  result = md5(salt + nonce);
}

console.log("Password: ", nonce);
$\endgroup$
  • $\begingroup$ Why don't you start by looking at password crackers like hashcat? $\endgroup$ – MechMK1 Oct 10 at 13:52
  • $\begingroup$ A random MD5 input will have a 2^-128 chance of matching expectedHash. Technically, you do have a non-zero chance of some nonce not equal to the original password coincidentally producing the desired output. If it only took you one nanosecond to calculate each MD5 hash, then it would take on the order of 10 sextillion years of computing time to have a good chance of succeeding. $\endgroup$ – Future Security Oct 10 at 15:04
  • 1
    $\begingroup$ (Even if pure brute force was reasonable, your code still has a bug. nonce++ will eventually stop doing anything for a floating point number. It would need to be a big int.) $\endgroup$ – Future Security Oct 10 at 15:23
3
$\begingroup$

Searching for the hash on Google sometimes instantly gives the plaintext. However, that only works for some common hash values.

Other than that, there is no more efficient way than brute force. Even so, you can optimize the brute force algorithm to make it faster. Hashcat can run the attack on GPU's, making it possible to perform many hash calculations in parallel.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.