Reversing MD5

Sharif

If I used md5() to hash a password before entering it into a database field, how would I convert it back into the original text?

LordShryku

You can't decrypt md5()....

drawmack

select * from users where password = md5("PASSWORD")

you don't have to decrypt what you've put into the database simply encrypt what you're matching it against. Be warned through there are differences between the mysql and the php md5 functions so whichever one does the work in the first place must do the work all the time.

Weedpacket

Originally posted by drawmack
Be warned through there are differences between the mysql and the php md5 functions so whichever one does the work in the first place must do the work all the time.

That's mildly concerning; is it a difference in representation (a string of thirty-two hex digits vs. four 32-bit ints, say)? (If I had MySQL here I'd find out for myself.)

drawmack

Originally posted by Weedpacket
That's mildly concerning; is it a difference in representation (a string of thirty-two hex digits vs. four 32-bit ints, say)? (If I had MySQL here I'd find out for myself.)

never had the gumption to look into it myself just know that if you do something like this

<?php
$sql = "INSERT INTO users (username,password) VALUES ('$username',md5('$password'))";
mysql_query($sql);

//in another script or another part of this script.
$password = md5($password);
$sql = "SELECT * FROM users WHERE username = '$username' AND password = '$password'";
?>

it will never return any results.

Weedpacket

Getting beyond mildly concerning; both PHP and MySQL claim to return a string of 32 hex digits, with lowercase digits, so they should match, MD5 being deterministic and all....

drawmack

yeah one of them must have a bug in their md5 algorithm.

Weedpacket

Originally posted by drawmack
yeah one of them must have a bug in their md5 algorithm.

Like I say, I don't have MySQL here; all the implementations I have on hand for MD5() (including PHP's) agree with each other, though.

LordShryku

So Weedpacket, have you written a decrypt script for md5 yet?