Cracking the MD5 passwords?

[Jorrit787]

Originally Posted by Snake

So I will be getting into trouble and not them since they are the ones who go around forums and hack them up? That's pathetic!

At the most you will BOTH be getting into trouble.

[Snake]

Well, as long as their site goes six feet down with the fishes, then I'm fine with that.

[Artificial_Alex]

It is very possible. I know a vB forum owner that uses vB that exploited vB by some how decrypting the md5 hash's to login to their members accounts on sites like theirs [Cheating sites] to stuff it up..:/

I would snitch on them, But Idon't have anything againest them. ;p

[Adrian Schneider]

Alter the JS login code that hashes the password to also send the password in plaintext to the webserver (would require them to login again).

My suggestion is to just ban the users and tighten up security on your end. Stooping to their level is a bad idea.

[Artificial_Alex]

Don't take me wrong, he's a godly programmer, you wouldn't wanna mess with him, and just now, Here, I got his program:
I first madea encrypted password, to put in the program, thus why I left the background site open that shows me getting the code [like since I didn't wanna exploit members passwords on Gaminggutter :P ]



SirAdrian, you sir, have been pwned.

[Adrian Schneider]

lol... how have I been "pwned"? Go ahead and crack a vBulletin password with that. You know the format. Three "a"s hardly count. Remember that the "salt" does not only contain alpha-numerical characters either, and your password length will have to be ~ 35 chars.

[Artificial_Alex]

Ok, give me a hash with a decent ammount of letters and numbers and other chars.

[Adrian Schneider]

Use your own forum...

You could also increase the salt size to 12 characters, which would greatly strengthen the password.

This is irrelevant. I don't see what this has to do with his problem? If the hacker already has access to his DB, why does he need password?

Edit: "f2a92998aecb1b0ad28b6d6a4a6df1e1"

Go nuts

[Snake]

Originally Posted by Artificial_Alex

It is very possible. I know a vB forum owner that uses vB that exploited vB by some how decrypting the md5 hash's to login to their members accounts on sites like theirs [Cheating sites] to stuff it up..:/


I would snitch on them, But Idon't have anything againest them. ;p

Do you have any further information on that forum please? I'd like to know more about them or how can I get in contact with the owner.

Originally Posted by SirAdrian

Alter the JS login code that hashes the password to also send the password in plaintext to the webserver (would require them to login again).

My suggestion is to just ban the users and tighten up security on your end. Stooping to their level is a bad idea.

I don't think that would be enough.

[Brandon Sheley]

I'm surprised the staff here is letting a thread go with a user asking how to exploit vBulletin :O