MD5 Hash Cracker

ghost

0 0

18 years ago

I wrote an MD5 Hash cracker. But it needs some explination so I'll just post it in the forums, also because nobody ever checks code bank :P. First of all, it's written in PHP so you'll need an Apache server to run it. I'll up it to my website aswell, i'll post the link later. The script is using the common passwords wordlist from theargon. http://www.theargon.com/achilles/wordlists/common-passwords.txt

Remember: be patient, cracking a hash takes a while

Expliantion:

set_time_limit(0); (line 7) this is the timeout limit for your script, in seconds. If it's not executed within this time, it'll stop. 0 means no timeout.

$test_hash=file("http://www.theargon.com/achilles/wordlists/common-passwords.txt"); (line 32) this is the wordlist that is used to check all the hashes. If you want to use a big one, I suggest that you run the script from your PC and are PATIENT! change http://www.theargon.com/achilles/wordlists/common-passwords.txt to the name of your dictionary, if it's in the same folder it would give something like this: $test_hash=file("wordlist.txt"); The wordlist you're using preferably in .txt format, I don't know about others, they should work.

thats it :) I think the rest is all logic, but if you need more expliantion, let me know.

PLEASE don't come saying it doesnt work, I've tested it like a million times :)

Enjoy!

&lt;title&gt;MD5 Hash Cracker&lt;/title&gt;
&lt;font face=&#39;georgia&#39; size=&#39;3&#39;&gt;
&lt;h1&gt;&lt;u&gt;MD5 Hash Cracker&lt;/u&gt;&lt;/h1&gt;
&lt;blockquote&gt;
&lt;?php
//Coded by superpimp, for hellboundhackers.org
set_time_limit(0);
function display_form(){
	echo &lt;&lt;&lt;DISPLAY_FORM
		&lt;p&gt; &lt;p&gt;
		&lt;i&gt;You can check if your hash is in the MD5 database &lt;a href=&#39;http://gdataonline.com/seekhash.php&#39; target=&#39;new&#39;&gt;here&lt;/a&gt;&lt;/i&gt;
		&lt;body&gt;
		&lt;p&gt; &lt;p&gt;&lt;u&gt;Enter your hash below:&lt;/u&gt;
		&lt;p&gt;
		&lt;table&gt;&lt;form action=&#39;index.php&#39; method=&#39;post&#39;&gt;
		&lt;tr&gt;&lt;td&gt;&lt;p&gt;
		  &lt;INPUT class=&#39;field&#39; type=&#39;text&#39; name=&#39;md5&#39; size=&#39;40&#39;&gt;
		&lt;/p&gt;
		    &lt;p&gt;  &lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/p&gt;
		&lt;p&gt;&lt;tr&gt;&lt;td&gt;&lt;p&gt;Test password: 
	      &lt;INPUT class=&#39;field&#39; type=&#39;text&#39; name=&#39;test&#39; size=&#39;15&#39;&gt;
		&lt;/p&gt;
		    &lt;p&gt;  &lt;/p&gt;&lt;/td&gt;&lt;/tr&gt;
		&lt;input type=&quot;hidden&quot; name=&quot;hash&quot; value=&quot;1&quot;&gt;
		&lt;tr&gt;&lt;td&gt;&lt;INPUT class=button type=submit value=&#39;Crack!&#39;&gt;&lt;/form&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;
		&lt;/body&gt;
		&lt;/html&gt;
DISPLAY_FORM;
}
function crack_hash(){
	echo &quot;Using the &lt;a href=&#39;http://www.theargon.com/achilles/wordlists/common-passwords.txt&#39;&gt;common-passwords.txt&lt;/a&gt; wordlist from theargon.&#92;r&#92;n&quot;;
	$test_hash=file(&quot;http://www.theargon.com/achilles/wordlists/common-passwords.txt&quot;);
	$md5=$_POST[&#39;md5&#39;];
	$test=$_POST[&#39;test&#39;];
	if ($test!=NULL){
		echo &quot;&lt;p&gt;Your hash: &quot;.$md5.&quot;&lt;p&gt;&#92;r&#92;n&quot;;
		echo &quot;Password to test: &quot;.$test.&quot;&lt;p&gt;&#92;r&#92;n&quot;;
		if ($md5==md5($test)){
			echo &quot;The tested password is &lt;font color=&#39;green&#39;&gt;correct!&lt;/font&gt;&#92;r&#92;n&quot;;
			exit;
		}
		else{
			echo &quot;The tested password is &lt;font color=&#39;red&#39;&gt;not correct!&lt;/font&gt;&#92;r&#92;n&quot;;			
		}
	}else{echo &quot;&lt;p&gt;Your hash: &quot;.$md5.&quot;&lt;p&gt;&#92;r&#92;n&quot;;}
	if ($md5==NULL){
		echo &quot;Please enter a hash.&#92;r&#92;n&quot;;
	}
	else{
		echo &quot;&lt;p&gt; &lt;p&gt;&#92;r&#92;n&quot;;
		echo &quot;&lt;u&gt;Checked Hashes:&lt;/u&gt;&#92;r&#92;n&quot;;
		echo &quot;&lt;p&gt;&lt;i&gt;Scroll down to see the cracked hash.&lt;/i&gt;&#92;r&#92;n&quot;;
		echo &quot;&lt;blockquote&gt;&#92;r&#92;n&quot;;
		foreach($test_hash as $test_hash){
			$hash=trim($test_hash);
			if(md5($hash)==$md5){
				echo &quot;&lt;p&gt;hash cracked!&#92;r&#92;n&quot;;
				echo &quot;&lt;br&gt;&lt;font color=&#39;green&#39;&gt;Plaintext: &quot;.$test_hash.&quot;&lt;/font&gt;&lt;br&gt;&#92;r&#92;n&quot;;
				echo &quot;&lt;p&gt;&lt;p&gt;Coded by Superpimp&#92;r&#92;n&quot;;
				exit;
			}
			else{
				echo &quot;&lt;font color=&#39;red&#39;&gt;Bad: &quot;.$test_hash.&quot;&lt;/font&gt;&lt;br&gt;&#92;r&#92;n&quot;;
			}
		}
		echo &quot;&lt;/blockquote&gt;&#92;r&#92;n&quot;;
	}
}
$check=$_POST[&#39;hash&#39;];
if(isset($check)){
	crack_hash();
}
else{
	display_form();
}

?&gt;
&lt;p&gt;&lt;p&gt;Coded by Superpimp
&lt;/blockquote&gt;

-Superpimp

PS: I'm working on a website bruteforcer ;) :D

ghost

0 0

18 years ago

Nicely done, I've almost finished my md5 cracker in C++.

Just remember, you don't need an Apache webserver. You could just take out all the html, and replace everything that is entered through a form with command line arguments.

Anyway, good job.

Uh oh. Looks like your using an ad blocker.

ghost

ghost