Tutorial - How to create your own MD5 Hash Cracker

[skytower]

Hello, going to show how to create your own MD5 hash cracker, now I choose MD5 because it's a bit easier to work with and show the functionality of a hash cracker. Please keep in mind that if you are cracking a hash of a long string, it could take days, weeks, months, or years to crack it. For short strings, it's not going to take more than a few seconds - such as with a, abc, or other very short strings. Even at 5-6 characters in length, the cracker takes a lot longer to run, and obviously for a 10+ string that can have letters, numbers, or symbols, it can take ages.
 

The Basics

Understanding the principles of cracking is important.

String: any form of text, using letters, symbols, numbers, etc.
Examples: Password, a sentence, your username, your email - all strings.

Hash: a value (in our case a normal string) that has been encrypted.
Example: the MD5 hash of "abc" is "900150983cd24fb0d6963f7d28e17f72"

It's not secure to store a user's password in "plaintext" (unencrypted format), so we encrypt it with an algorithm (such as MD5) so the encrypted version is stored instead. What if you forget your own password and only have the hash? That's when you can use a hash cracker to try to retrieve your old password.

 

PHP:

I am including the PHP example because of how many people use PHP and because MD5 is commonly used in PHP systems more than it's used by other languages (in my experience). Please note that PHP cracking is not going to be nearly as fast as Python or lower level languages.

How to get an MD5 hash
Getting an MD5 in PHP is super easy because it's a default function:

[ Hidden Content! ]

You must register or login to view this content.

 


This will return our hash of: 900150983cd24fb0d6963f7d28e17f72


If we only knew the hash and not "abc" then we could test strings until we find a match.
For example, here is essentially what a cracker does... it tests strings until it finds the hash:

Spoiler:

md5("a")
md5("b")
md5("c")
md5("ab")
md5("ac")
md5("abc") [/spoiler

So I can do a comparison:
[spoiler]if(md5("abc") === "900150983cd24fb0d6963f7d28e17f72"){
 echo "We found the matching hash!";
} 

Let's make it automatic! For this next part, you only need to copy over the md5crack function and then use the $result code in same file to start cracking! Just give it a hash $target and let it run!

First, here is our main structure for our PHP script which will start our functionality:

Spoiler:

$target = '900150983cd24fb0d6963f7d28e17f72'; // MD5 hash of 'abc'

$result = md5Crack($target, 1, 4);
if ($result) {
    echo "Password found: $result\n";
} else {
    echo "Password not found within the specified range and character set.\n";
} 

The function md5crack is not a default PHP function, it's made by me. It takes a char set (ex: A-Z uppercase, a-z lowercase, 0-9 numbers, and common symbols) and a min & max length for our string we're trying to find (ex: 1 char to 16 chars in length).

Spoiler:

function md5Crack($targetHash, $minLength, $maxLength) {
    $charset = array_merge(range('a', 'z'), range('A', 'Z'), range('0', '9'), str_split('!@#$%^&*()_-+=[]{}|;:,.<>?'));
    $maxCharsetIndex = count($charset) - 1;
    $stack = array_fill(0, $maxLength, 0);

    while (true) {
        for ($length = $minLength; $length <= $maxLength; $length++) {
            $attempt = '';
            for ($i = 0; $i < $length; $i++) {
                $attempt .= $charset[$stack[$i]];
            }

            if (md5($attempt) == $targetHash) {
                return $attempt;
            }
        }

        // Increment stack
        $stack[0]++;
        for ($i = 0; $i < $maxLength - 1; $i++) {
            if ($stack[$i] > $maxCharsetIndex) {
                $stack[$i] = 0;
                $stack[$i + 1]++;
            }
        }

        // Check if all combinations are tested
        if ($stack[$maxLength - 1] > $maxCharsetIndex) {
            return null;
        }
    }
} 

 

Python:

I am including Python because it's faster than PHP at a lot of things, and it's also a very commonly used language pastebin  link.
 

Enjoy, the article is intended for educational purposes or authorized use only


Likes 💓 And +Reps are always appreciated and will motivate me to do more of these

 

Not ratedThis leak has not been rated yet, be careful when downloading.