Something on dupeip.php
 

Since this doesnt have anything to do with hacking....

on the dupeip.php where it shows the users password all encoded-like

is there any way to decipher that? I had a guy who lost his password and he wanted me to just get it for him and i couldn't i didn't know if there was a way to do so...

No. All he has to do is get his pass reset and emailed to him, or you can change his password from the AdminCP and tell him his new password. md5 technology is used to hash passwords in vBulletin, and it will take months and lots of CPU power to crack just one hash...

hash algorithms are not reversable, it's mathmatically impossible

Yes, for you, for maths geniuses like me, it's not a problem.

"1 plus 1 equals... 2!!!"

;)

LoL Erwin...funny :D

*ggg* Erwin i doubt anyone would use +1 as a hash algorithm ;)

But you're right, i wasn't exactly enough:
good hash algorithms are not reversable :)

I thought anything done in math is reversable if you know how to do it....

yeah but if something insane like a super computer has generated it then god help a home pc...

i think it takes like 2weeks high cpu usage ona 2ghz p4 to decifer a 5 letter md5 password, or so scott was saying..

and vBulletin uses, what, 16 bit strings for md5?

@Oricon:

this will output 4, but if you just hav the 4 you cant say what x and y have been, 1+3 is also 4 :)

/me shuts up and walks away quitely

Actually, it only takes <1 minute to decode the 5-letter md5 password on my supercomputer.

However, it took you 1.5 months to reply to this post :)

LMAO:p

AFAIK md5 hashes are impossible to decrypt, and also now that vB3 is here, one md5 hash won't work on another site;)

Satan

Modulus division (the remainder of a division) is irreversible. :)

Unfortunately, I have a life and I don't hang out on forums everyday unlike some people :)

Every encryption & hashing algorithm has a weak point which can be exploited. I work for a security company that deals with encryption/decryption/krytology related technology and I know for a fact that MD5 hashing isn't as secure as people are taught to believe. If you still think MD5 is secure, then give me an MD5 hash and I'll give you the password in plain text. It's easy to reverse the process md5 hashing process and get the real password or a collision (different pass but same md5 hash).

That's impossible and if you are working on a sec company you should know it.

Now here you are right, as it's a hashing algorithm you can find collisions which have the same md5 hash, but it's absolutely impossible to say if it was the original pw or not