Category Archives: Posts

Code, Posts

Creating an md5sum hash dictionary file

Leave a comment

If you’re ever put in a situation where you need to assess the strength of passwords that may be stored in an md5sum, there are a few options you have:

There are numerous websites for cracking md5sums such as:

http://passcracking.com

The simple way I assess how these websites is by searching for a very simple md5sum that can be generated via:

echo password | md5sum -;

Also, you could just merely, google the md5sum and see if you can find the unciphered text. That being said, the point of this post though, is to generate an md5sum hash dictionary. Let’s look at a simple word list.

cat wordlist.txt | head 
aaaaa
aaaab
aaaac
aaaad
aaaae
aaaaf
aaaag
aaaah
aaaai
aaaaj

We will then, use a for loop and append the output of each iteration, to a file simply by doing:

for i in `cat wordlist.txt`; do echo ${i} >> hashdict.txt; echo ${i} | md5sum - >> hashdict.txt; done

Now in our hashdict.txt file, we have our unciphered text and then on the next line, it’s md5sum equivalent. Ergo, if we want to look up a hash some and find the unciphered text, we could do as follows:

egrep --before-context=1 '4ab36a961cd2198e4a49915f820db5c0' hashdict.txt
aaaae

We have now found out that ‘4ab36a961cd2198e4a49915f820db5c0’ is equivalent to ‘aaaae’.

Similarly, if we wanted to find md5sum equivalent of ‘aaaae’ , we could use the list, or just simply do:

echo aaaae | md5sum -

I’ll have more to come. In the next few days, I’m going to work on my ‘ettersploit’, idea.

Posts

Blippy FAIL rant

3 Comments

mashable.com/2010/04/23/blippy-credit-card-numbers/

Alright, sharing information is nothing new, along with sharing information online. We as a society aggregate massive amounts of data for companies to use for targeted marketing and the like.

With that being said, you must ask yourself, “Our we willingly sharing too much information?” Is there such a thing as a too much information? Some would argue no and for the most part I would have to agree with them. Despite this being true, I still strongly believe that reasonable forms of denial are a useful tool for coping with everyday life.

Twitter, facebook, myspace.. and even the faded out xanga, are all websites that are used for basically spying on our social lives. With this being said, Blippy steps up the ante by spying on our buying habits and having a space for us to publicly share this information.

Was I a little surprised to find out about the latest ‘Blippy fail’ ? A little, but the more I took into consideration and remembered how Google can be used in such a way, it wasn’t very hard for me to fathom.

Is there an easy mend for this issue? You have to ask yourself, especially if you’re a Blippy user, “Do I really need to share this information, with this company and the realm of the internet?”.

My mantra on disclosing information is, ‘share information as felt necessary’. I hope more people start taking this into consideration, but it seems that people tend to like to live in the view of the public to an extent via social networking mediums. I believe for some individuals, it gives them a sense of identity and self importance.

Do I really care about who broke up with such and so? Is it necessary for me to learn about unnecessary information about yourself? I don’t think so, but social networking websites seem to think it’s necessary, but it’s also part of their business model.

Consider this simple logic: The more websites that I share personal information with, the more likely a privacy breach of information that I did not intend to disclose will occur.

More to come..