Given a database with usernames and the first six bytes of their hashed passwords. A standard hashing function has been used for hashing.

user c3981fa8d26e

operator 5f4dcc3b5aa7

guest 084e0343a048

How can I solve this problem? Any tips?

## closed as off-topic by Yuval Filmus, David Richerby, fade2black, Kyle Jones, Tom van der ZandenNov 14 '17 at 13:06

This question appears to be off-topic. The users who voted to close gave this specific reason:

• "This question does not appear to be about computer science, within the scope defined in the help center." – Yuval Filmus, fade2black, Kyle Jones
If this question can be reworded to fit the rules in the help center, please edit the question.

• They probably want you to try all "standard hashing functions" to see which matches, and assume that no salts are being used. If it's like that, I find this a distasteful exercise because it suggests bad practice. In a properly secured system this task would be impossible. – Raphael Oct 8 '17 at 13:11
• How does the username matter in this problem? And why do I need the three other users? – student28 Oct 8 '17 at 13:12
• This seems better suited to Cryptography. – Yuval Filmus Oct 8 '17 at 15:48

The problem asks to be creative about breaking hash attempt, well it is a big stretch even for simplistic example, but let's try.

1. You are given a password 12345 from user admin with 827ccb0eea8a hash, that is first 6-bytes of the hash.
2. A standard hashing function has been used - it means MD5. Why?
1. The construction of the task asks for preimage attack, it must be homemade breakable and possibly already hashed and shown online, otherwise it would not be possible to crack without substantial resources.
2. It cannot be salted, because the salt was not given in the task, but using salt is a wise thing to do - it prevents the rainbow tables attacks and in the case like here, you have a collection of hashes would be harder to recover in batches.
3. The MD5 is built-in into PHP and easily accessible in the most programming languages (MD5 implementations)
3. Try them until the match is found and then take the steps to hash your password.

Make the test of standard functions (like MD5, SHA256) of any combination of admin and 12345, it may be concatenated or xored, in fact it is not. First try out of lazy guess,
MD5(12345) =$\color{maroon}{\text{827ccb0eea8a}}\color{gray}{\text{706c4c34a16891f84e7b}}$
It tells that no salt or username was used, just plain password hashed with deprecated function. The other hashes are irrelevant at this point, but seeing the pattern, find simple MD5 of potential passwords until the first 6 bytes are like in the list.

After the scheme is known, the task is to produce the output from qwerty123, so MD5(qwerty123) =$\color{maroon}{\text{3fc0a7acf087}}\color{gray}{\text{f549ac2b266baf94b8b1}}$

• This is a good demonstration of why such a method of keeping passwords is useless. As such it is pretty educational. – Jonathan Rosenne Oct 8 '17 at 18:16
• @JonathanRosenne well, I agree to the point. It is a start, with given context, but later someone is left with such task only, sees the excersise online and gets bad ideas. – Evil Oct 8 '17 at 18:34