I talked to a guy and he was like a beginner of makeing ot and website he had a friend he made for him website and he uses xampp and how it's is possible he can see all password without have Sha1 In config he had plain i looked at teamwiver and i tried that but it did not work. And i forgot my pw on my server and and the code was adba9427352a9bda7r375t2 like that and i changed my code to test it did not work and i forgot the pw so how do i make to see all accs to belive its their accounts i repp++ if you help me sry for my bad english
About Sha1 and plain. Read V
- Thread starter kuk124
- Start date
- Joined
- Jul 25, 2007
- Messages
- 382
- Reaction score
- 38
The point of using encryption/hash is to prevent user passwords from being stolen. First off use md5. Anyway, what happens is, when a player enters their password in the client, that plain password sent from the client is hashed out by whatever method you have in config.lua and then checked against the database. So when a query for the password of a new account is sent to your database it needs to be the same hash as the one in config.lua. md5("password") does not equal sha1("password"). I had a little bit of trouble understanding your post but what I think you said is you had sha1 set to begin with and then changed config to plain. The problem there is the password of the user is already hashed and stored in your database, and then your server is sending the plain password to be checked against that one. To recover hashed passwords you need to have a recovery system for players. For example, secruity questions, email, etc. What you should do is when a player makes an account write that password to a file, then when a player goes to recover his password the file retrieves his plain password. Do not keep this file in the websites folder, that way it can't be accessed if somone hacks your site. That's the correct and safe way to protect passwords. But if you want to use plain, you can't hash passwords to begin with. And if you don't have the knowledge to set up that system, you probably should because I don't beleive any ot acc does that right now.
md5 is not secure, its easily reversable.
You can reset a password in sha1 by typing a word, converting it to sha1 and paste the sha1 crypted password in the database.
This site will convert plaintext to sha1:
SHA1 - Online generator sha1 hash
You can reset a password in sha1 by typing a word, converting it to sha1 and paste the sha1 crypted password in the database.
This site will convert plaintext to sha1:
SHA1 - Online generator sha1 hash
- Joined
- Jul 25, 2007
- Messages
- 382
- Reaction score
- 38
First off, you cannot "reverse" a hash. Secondly easily cracked? Rainbow tables & super computer inc. md5 is prefectly safe. Also, if he knew his password of course he could hash it out, the problem is he dosent know his password and it's hashed. Like I said, you can't reverse a hash, a hash is not the same as encrpytion.
- Joined
- Jul 7, 2007
- Messages
- 4,049
- Reaction score
- 240
That website isn't working
I just wrote "Scarlet" (without "" ) and generated MD5: 489c169dbe33a17c4f544872b7b80023
Then I pasted that hash in the box and pressed the Crack button and it didnt worked: Sorry! Guess we couldn't find it.
From an MD5, you may be able to find some texts that generate that MD5, but its impossible to find the specific word because multiple words can have the same MD5
I just wrote "Scarlet" (without "" ) and generated MD5: 489c169dbe33a17c4f544872b7b80023
Then I pasted that hash in the box and pressed the Crack button and it didnt worked: Sorry! Guess we couldn't find it.
From an MD5, you may be able to find some texts that generate that MD5, but its impossible to find the specific word because multiple words can have the same MD5
Last edited:
The MD5 Message-Digest Algorithm is a widely used cryptographic hash function that produces a 128-bit (16-byte) hash value. Specified in RFC 1321, MD5 has been employed in a wide variety of security applications, and is also commonly used to check data integrity. MD5 was designed by Ron Rivest in 1991 to replace an earlier hash function, MD4. An MD5 hash is typically expressed as a 32-digit hexadecimal number.
However, it has since been shown that MD5 is not collision resistant;[3] as such, MD5 is not suitable for applications like SSL certificates or digital signatures that rely on this property. In 1996, a flaw was found with the design of MD5, and while it was not a clearly fatal weakness, cryptographers began recommending the use of other algorithms, such as SHA-1—which has since been found also to be vulnerable. In 2004, more serious flaws were discovered in MD5, making further use of the algorithm for security purposes questionable—specifically, a group of researchers described how to create a pair of files that share the same MD5 checksum.[4][5] Further advances were made in breaking MD5 in 2005, 2006, and 2007.[6] In December 2008, a group of researchers used this technique to fake SSL certificate validity,[7][8] and US-CERT now says that MD5 "should be considered cryptographically broken and unsuitable for further use."[9] and most U.S. government applications now require the SHA-2 family of hash functions.[10]
However, it has since been shown that MD5 is not collision resistant;[3] as such, MD5 is not suitable for applications like SSL certificates or digital signatures that rely on this property. In 1996, a flaw was found with the design of MD5, and while it was not a clearly fatal weakness, cryptographers began recommending the use of other algorithms, such as SHA-1—which has since been found also to be vulnerable. In 2004, more serious flaws were discovered in MD5, making further use of the algorithm for security purposes questionable—specifically, a group of researchers described how to create a pair of files that share the same MD5 checksum.[4][5] Further advances were made in breaking MD5 in 2005, 2006, and 2007.[6] In December 2008, a group of researchers used this technique to fake SSL certificate validity,[7][8] and US-CERT now says that MD5 "should be considered cryptographically broken and unsuitable for further use."[9] and most U.S. government applications now require the SHA-2 family of hash functions.[10]