iBebe Posted January 19, 2012 Report Share Posted January 19, 2012 Dupa cum stiti MD5 este un hash unidrectional. (vezi wikipedia)123456 - e10adc3949ba59abbe56e057f20f883eAcum ca avem asta din e10adc3949ba59abbe56e057f20f883e nu putem sa ajungem la 123456 decat prin brute, adica un program va genera cuvinte random acestea vor fi duse in stadiul de hash si fiecare rezultat va fi comparat cu e10adc3949ba59abbe56e057f20f883e pana se gaseste hashul si va avea un rezultat adevarat. Acum eu pun problema invers si se poate pune in practica de cineva care are cunostinte in domeniu si timpul necesar. Sa se faca un wordlist cu 70-80% din combinatiile de cuvinte de 6-8 caractere, apoi sa fie duse toate in stadiul de hash. Stiind ca se poate cuvant --> hash md5 si ca nu se poate hash md5 --> cuvant avem solutia asta. In acest stadiu stiind ca x are hashul y cu un simplu search in baza de date vom sti ca y are valoarea x.No more brute, just brain and search. Quote Link to comment Share on other sites More sharing options...
em Posted January 19, 2012 Report Share Posted January 19, 2012 A?a func?ioneaz? orice site de md5 decrypt. Quote Link to comment Share on other sites More sharing options...
begood Posted January 19, 2012 Report Share Posted January 19, 2012 two words : rainbow tables.ai descris in mare metoda de functionare a tabelelor rainbow, ele stocand o cantitate teoretica (in general de 99.9 % [pierzi o parola din 1000]) pentru mai multe wikipedia si freerainbowtables.com Quote Link to comment Share on other sites More sharing options...
iBebe Posted January 19, 2012 Author Report Share Posted January 19, 2012 Nu a?a func?ioneaz? toate site-urile gen md5decrypter.co.uk ?Nu, documenteaza-te. Quote Link to comment Share on other sites More sharing options...
begood Posted January 19, 2012 Report Share Posted January 19, 2012 ideea ta nu e rea dar pica pentru ca nu ai zeci de terabytes pentru a stoca 70% din parolele de lungime 6-8 formate din caraterele a-z.trebuie compresie. trebuie trade-off intre timpul de preprocesare si storage.asta rezolva tabelele rainbow. Quote Link to comment Share on other sites More sharing options...
aelius Posted January 19, 2012 Report Share Posted January 19, 2012 (edited) Varianta asta am testat-o cu mult timp in urma. Stocasem parolele in cleartext impreuna cu hash-urile in mysql si am ajuns la concluzia ca merge mai rapid ighashgpu decat un simplu select din db.Uite:F:\gpu>ighashgpu.exe /h:f76d728f098f9a7af8ffa64907ecc16e /t:md5 /c:sd /max:7******************************************************************* MD4/MD5/SHA1 GPU Password Recovery v0.90.17.1 ****** For ATI RV 7X0 cards and nVidia 'CUDA' ones (G80+) ****** (c) 2009-2010 Ivan Golubev, http://golubev.com ****** see "readme.htm" for more details ********************************************************************** Any commercial use of this program is strictly forbidden *******************************************************************Found 1 CUDA device(s)Starting brute-force attack, Charset Len = 36, Min passlen = 4, Max passlen = 7Charset (unicode -> 0) [abcdefghijklmnopqrstuvwxyz0123456789]Charset in HEX: 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a 30 31 32 33 34 35 36 37 38 39Starting from [aaaa]Hash type: MD5, Hash: f76d728f098f9a7af8ffa64907ecc16eDevice #0: [GeForce GTX 550 Ti] 1800.00 Mhz 192 SPHardware monitoring enabled, threshold temperature is 90°C.CURPWD: p2ry5p DONE: 89.12% ETA: 0s CURSPD: 780.6MFound password: [2a8c3f], HEX: 32 61 38 63 33 66Processed 2 000 683 008 passwords in 3s.Thus, 777 266 125 password(s) per second in average.F:\gpu>Daca mai pun inca o placa "GTX 550 Ti" merge super ok. Cu o singura placa ia maxim 5 secunde pentru orice md5 de la parole de 6 caractere. Edited January 19, 2012 by aelius Quote Link to comment Share on other sites More sharing options...
Nytro Posted January 19, 2012 Report Share Posted January 19, 2012 MD5 = 32 caractere in hex, are 16 bytesCaractere alfa-numerice: 62 (a-z, A-Z, 0-9)Dimensiune parola: 6 caractereCombinatii posibile: 62 ^ 6Bytes necesari: 62 ^ 6 * 16 = 908803769344 bytes = 846 TBSper ca nu am gresit la calculate. Nu te poti baza doar pe cuvinte de dictionar. Practic cred ca 80% dintre parole NU sunt cuvinte de dictionar. Bine, 10% dintre ele sunt: "123456", "qwerty"... Ganditi-va si voi la toate parolele pe care le aveti. Cate sunt cuvinte de dictionar? Quote Link to comment Share on other sites More sharing options...
iBebe Posted January 19, 2012 Author Report Share Posted January 19, 2012 MD5 = 32 caractere in hex, are 16 bytesCaractere alfa-numerice: 62 (a-z, A-Z, 0-9)Dimensiune parola: 6 caractereCombinatii posibile: 62 ^ 6Bytes necesari: 62 ^ 6 * 16 = 908803769344 bytes = 846 TBSper ca nu am gresit la calculate. Nu te poti baza doar pe cuvinte de dictionar. Practic cred ca 80% dintre parole NU sunt cuvinte de dictionar. Bine, 10% dintre ele sunt: "123456", "qwerty"... Ganditi-va si voi la toate parolele pe care le aveti. Cate sunt cuvinte de dictionar?Majoritatea sunt cuvinde de dictionar doar ca mai au cuvat1, cuvant123, 1cuvant, 123cuvant.. daca ma intelegi ce vreau sa zic. Quote Link to comment Share on other sites More sharing options...
