I wrote BozoCrack to show why plain MD5 is a horrible way to hash passwords.

Re:I wrote BozoCrack to show why plain MD5 is a horrible way... by teflonhook on Monday November 07, 2011 @08:50PM (#3209112)

There's a bunch of MD5 search engines with rainbow tables etc. plugged in, it could tap into that easily as well.

[ Parent | on HN ]

Re:I wrote BozoCrack to show why plain MD5 is a horrible way... by bluehex on Monday November 07, 2011 @11:07PM (#3209468)

I think this is exactly why this method is so effective. Google's index all of those sites.

The first result when I searched the hash for superman (84d961568a65073a3bcf0eb216b2a576) was a link to a page titled literally "Google Hash: md5(superman) = 84d961568a65073a3bcf0eb216b2a576", the page is hosted at(http://www.nth-dimension.org.uk/utils/ghash.php), basically someone's gone through the trouble of making a rainbow table that's easily crawlable that makes this method of lookup via Google even easier.

The page has a description:

  > Google Hash is a PoC implementation of an hash search engine using Google.  
  > Unlike other implementations, the aim here is to get Google to store the  
  > word and associated hash. We do this by putting them into the title where it  
  > will always be stored by Google's spider....

The next top hit is md5rainbow.com etc. etc. I would guess that most of the positive results from BozoCrack.rb are thanks these sites.

[ Parent | on HN ]