Kuna watu bado wanatumia SHA-1 ku encrypt passwords?

Kuna watu bado wanatumia SHA-1 ku encrypt passwords?

Cybergates said:
Leo nilikua napitia baadhi ya website za taasisi zetu hapa nchini

moja ya taasisi kubwa tu ya IT juzi juzi hapa walifanya update ya system yao wakaongeza baadhi ya features na function mbalimbali

Kabla ya hayo maboresho, system yao ilikua moja ya website ngumu kupata loophole

Leo nimetest moja ya feature yao mpya walio add yani ni toooo easy to hack mtoto wa form 3 akipewa terminal ana hack, yani mtu una download database yote, kila kiku hadi taarifa confidential

Moja ya table ilikua ya users hii ndo imenishikitisha ya password zao zipo hashed na sha-1??, ya nii hi SHA-1 tool kama john au Johnny zina crack hizo password dk3 na baadhi ya password zipo kwenye worldlist.txt, Nimekuta root/admin username zinatumia uki decrypt hizo hash unapata password kama pass2020

Inabidi watu wa advance aise lest ukitumia sha1 add tena na md5 inakua afadhali kidogo kuliko kutimia sha 1 pekeyake
Click to expand...
Toa link ya website tuka-prove
 
Cybergates said:
Inabidi watu wa advance aise lest ukitumia sha1 add tena na md5 inakua afadhali kidogo kuliko kutimia sha 1 pekeyake
Click to expand...
Nahofia kama una uelewa na unachoongelea, md 5 ni yale yale tu. Bcrypt ndo iko recommended na ndio default kwenye php password_verify.
 
Cybergates said:
Ha haha, tuwasamehe tu mkuu. ku ujumla hii loophole nimeikuta kwenye QR code

Nilikua namaanisha hivi sha1(md5($pass))

Mbona bongo kuta IT wazuri sana

Sema mkuu saivi tunaangalia possibility ya kupenya hadi kwenye servers

Nimesoma hizo hashing zipo vizuri personal hashing zangu output zake zipo hivi
Ruby: 
dZSPIEGoYv4D2BPc3CbRiA$8$1$cA2yxRHOj7rDPV81tnmrVjRO1BQf2af4X8tg3YGOEyJQSMIZPgiOosVQHapvNrm0/UvtUxfugtlxaxWJYDaP6A==
msNpsGVZveMR2Ku75k4oDc$8$1$/8SBRH7b/XrQItDDnXwdQA/ICiyvG1JLRKHFMQ05H8H6Lmh/SbzgDl0jK9ZDt3ss2dVEB5DXEmZsGR28s0FLJw==
HexZH5I8pOuMFvkkxIBWtH$8$1$3gm+ghrlVWpARqFuy6PZX1oV1vBC70+NEQkWf67DTmxq0cQRUFd73tpeJZIA4wWh/Tfl2h+5d3zilzAoYLe53A==



website za chuo ndo haman kitu kabisa
Click to expand...
Ina maana mtu anaweza kuzivamia akabadilisha matokeo? Mfano kapata C akajiwekea A

Sent from my TECNO LC6a using JamiiForums mobile app
 
Cybergates said:
Mbona bongo kuta IT wazuri sana
Click to expand...
Ishakuwa ruled na kangaroo court of JF members kuwa IT wa Bongo ni ziro. Wewe ni nani hata kupingana na hukumu hii 😉

Wataalamu wa IT wa Tanzania ni 'zero' kabisa

Naandika kwa uchungu sana. Nilipewa instructions ya kutafuta kampuni ya IT hapa Tz kudisign app na web kwa ajili ya masuala fulani fulani. Nikawacheck jamaa fulani ni IT wazuri tu (kwa mjibu wao na ka kampuni kao uchwara) na mmoja kasoma US mwingine China. Nikawapa 15,000,000/= waanze kazi. Hii...
www.jamiiforums.com www.jamiiforums.com
 
Cybergates said:
Leo nilikua napitia baadhi ya website za taasisi zetu hapa nchini

moja ya taasisi kubwa tu ya IT juzi juzi hapa walifanya update ya system yao wakaongeza baadhi ya features na function mbalimbali

Kabla ya hayo maboresho, system yao ilikua moja ya website ngumu kupata loophole

Leo nimetest moja ya feature yao mpya walio add yani ni toooo easy to hack mtoto wa form 3 akipewa terminal ana hack, yani mtu una download database yote, kila kiku hadi taarifa confidential

Moja ya table ilikua ya users hii ndo imenishikitisha ya password zao zipo hashed na sha-1??, ya nii hi SHA-1 tool kama john au Johnny zina crack hizo password dk3 na baadhi ya password zipo kwenye worldlist.txt, Nimekuta root/admin username zinatumia uki decrypt hizo hash unapata password kama pass2020

Inabidi watu wa advance aise lest ukitumia sha1 add tena na md5 inakua afadhali kidogo kuliko kutimia sha 1 pekeyake
Click to expand...
Hamna kitu sipendi kama uzembe kazini. Ningekua wewe wangesoma namba za kirumi mpaka wakome.

NB: Kwanini usi hack uweke data zao hapa JF ili waje kuona?
 
Cybergates said:
Leo nilikua napitia baadhi ya website za taasisi zetu hapa nchini

moja ya taasisi kubwa tu ya IT juzi juzi hapa walifanya update ya system yao wakaongeza baadhi ya features na function mbalimbali

Kabla ya hayo maboresho, system yao ilikua moja ya website ngumu kupata loophole

Leo nimetest moja ya feature yao mpya walio add yani ni toooo easy to hack mtoto wa form 3 akipewa terminal ana hack, yani mtu una download database yote, kila kiku hadi taarifa confidential

Moja ya table ilikua ya users hii ndo imenishikitisha ya password zao zipo hashed na sha-1??, ya nii hi SHA-1 tool kama john au Johnny zina crack hizo password dk3 na baadhi ya password zipo kwenye worldlist.txt, Nimekuta root/admin username zinatumia uki decrypt hizo hash unapata password kama pass2020

Inabidi watu wa advance aise lest ukitumia sha1 add tena na md5 inakua afadhali kidogo kuliko kutimia sha 1 pekeyake
Click to expand...
Ni sawa , ila md5 nazo ni rahisi sana kuzicrack na kuna online tool nyingi sana ambaxo zinacalculate hizo md5 , labda uniambia md5 hard salted one . Hapo sawa ingawa nazo zinaweza kuwa cracked ila inatake time.


Best option ni kutumia Bcrypt hash , yani hixi ndio funga kazi kwasabb huwezi kuzireverse kwnenye normal state mpaka key . So utakachofanikiwa ni ku bruteforc key then ndo uitumie kureverse kwenye plaintxt .


Na hizi bcrypt niliwahi zikuta sehemu , even banks chache hapa tz wanatumia , niliwahi kukutana nazo kwenye databases zao . Miaka ya nyuma wakat nafanya pentesting.

Anyways , for more mtu anaweza soma Bcrypt Step by Step - Qvault
 
Cybergates said:
Ha haha, tuwasamehe tu mkuu. ku ujumla hii loophole nimeikuta kwenye QR code

Nilikua namaanisha hivi sha1(md5($pass))

Mbona bongo kuta IT wazuri sana

Sema mkuu saivi tunaangalia possibility ya kupenya hadi kwenye servers

Nimesoma hizo hashing zipo vizuri personal hashing zangu output zake zipo hivi
Ruby: 
dZSPIEGoYv4D2BPc3CbRiA$8$1$cA2yxRHOj7rDPV81tnmrVjRO1BQf2af4X8tg3YGOEyJQSMIZPgiOosVQHapvNrm0/UvtUxfugtlxaxWJYDaP6A==
msNpsGVZveMR2Ku75k4oDc$8$1$/8SBRH7b/XrQItDDnXwdQA/ICiyvG1JLRKHFMQ05H8H6Lmh/SbzgDl0jK9ZDt3ss2dVEB5DXEmZsGR28s0FLJw==
HexZH5I8pOuMFvkkxIBWtH$8$1$3gm+ghrlVWpARqFuy6PZX1oV1vBC70+NEQkWf67DTmxq0cQRUFd73tpeJZIA4wWh/Tfl2h+5d3zilzAoYLe53A==



website za chuo ndo haman kitu kabisa
Click to expand...
Huwa zinafanana zote kasoro content tu.
[emoji23][emoji23][emoji23][emoji23][emoji23][emoji23][emoji23]
 
Thefreedom said:
Md5 , 21centry? Hapana aseeeeeee
Click to expand...
Inategemeana.
Mfano naweza tumia MD5 na usijue hata kama ni MD5 unless uwe na code zangu.

Mfano ukicheza na hii function unapata ridiculously tough to crack hash. But yeah it is not practical when you have better ways

Code: 
function generateHash($password, $padder = '0', $divider = 2)
{
    $paddedPassword = str_pad($password, 50, $padder, STR_PAD_BOTH);
    $hashes = [];
    $divPass = str_split($paddedPassword, 2);
    foreach($divPass as $pass){
        $hashes[] = md5($pass);
    }
    return implode('', $hashes);
}

Resultant hash for the password below is 800 chars long

Code: 
$result = generateHash('123456', '#@33#');
echo strlen($result)."\n";
echo "$result\n";

800

b520a786a67833709e1c6e77dbf39dae182be0c5cdcd5072bb1864cdee4d3d6e05ab88fb98453f3a811b7851456621311378d7d8767899287b0407055215aa4e804c9b2d3a0bed2e1405c7b695c42e42b520a786a67833709e1c6e77dbf39dae182be0c5cdcd5072bb1864cdee4d3d6e05ab88fb98453f3a811b7851456621311378d7d8767899287b0407055215aa4e804c9b2d3a0bed2e1405c7b695c42e42b520a786a67833709e1c6e77dbf39daec20ad4d76fe97759aa27a0c99bff6710e369853df766fa44e1ed0ff613f563bd9f61408e3afb633e50cdf1b20de6f466b520a786a67833709e1c6e77dbf39dae182be0c5cdcd5072bb1864cdee4d3d6e05ab88fb98453f3a811b7851456621311378d7d8767899287b0407055215aa4e804c9b2d3a0bed2e1405c7b695c42e42b520a786a67833709e1c6e77dbf39dae182be0c5cdcd5072bb1864cdee4d3d6e05ab88fb98453f3a811b7851456621311378d7d8767899287b0407055215aa4e804c9b2d3a0bed2e1405c7b695c42e42b520a786a67833709e1c6e77dbf39dae
 
Stefano Mtangoo said:
Inategemeana.
Mfano naweza tumia MD5 na usijue hata kama ni MD5 unless uwe na code zangu.

Mfano ukicheza na hii function unapata ridiculously tough to crack hash. But yeah it is not practical when you have better ways

Code: 
function generateHash($password, $padder = '0', $divider = 2)
{
$paddedPassword = str_pad($password, 50, $padder, STR_PAD_BOTH);
$hashes = [];
$divPass = str_split($paddedPassword, 2);
foreach($divPass as $pass){
$hashes[] = md5($pass);
}
return implode('', $hashes);
}
Click to expand...
Okay
 
KISIWAGA said:
Haya majamaa yanayadevelop website za serikali sijui yalisomea vyuo gani
Click to expand...
Shida ni kwamba developer wengi hawajari step ya security by design yaani wenyewe Wana copy templates then Wana paste yaani wanachukua tu code GitHub then wanapest basi
 
You must log in or register to reply here.

Our Community

Regional Communities

Back
Top Bottom
Menu
Forums
New posts
Log in
Register