Waraxe Forums - A couple of beginner questions relating to phpbb & MD5

raoul_duke · Beginner

I've successfully captured some MD5 hashes from a phpbb 2.0.6 forum & submitted the hashes to plain-text.info, two of the three hashes were succesfully cracked but the one I really needed decypted came back with the result "not found"

My questions are roughly as follows:

I've read that "salt" is sometmes added to the hashes to make them more secure is it possible that the hash I was unable to decrypt may have had salt added to it somehow? (hash was from a standard phpbb 2.0.6 forum running on linux/apache)

Is it more likely now seeing as plain-text.info couldent decrypt the hash that it has weird characters in it? (i'm 99% sure the original password would've been in an english char set if that helps?)

Is it worthwhile creating or obtaining my own rainbow tables & using the script linked from plain-text.info to attmpt to crack my hash? Or, is this a bit out of my league as a newcomer to md5 cracking?

This is the hash I cant decrypt, i'd appreciate it if you have the facilities to decrypt it to gice it a shot for me plz:

54723778e6667ca722233bc79572f808

timmenton · Regular user

raoul_duke · Beginner

Thanks for taking the time to reply timmenton. It's not a session id (they come after url starting with sid?" A friend of mine had admin access to the forum i'm targeting & sent me the sql dump from the phpbb backup utility. Sadly he no longer has (admin) access to the forum.

I've looked through the sql file again & it's definitely an md5 hash from a phpbb forum (other hashes laid out in the same place for other users decrypted fine when entered into plain-text.info) . I'm not 100% sure of the phpbb version, I looked for the docs/changelog.html file but as far as I can tell it's not on the server (I tried lots of different spellings try & find directory.) My best guess is that it's either a 2.0.18 or a 2.0.19 if thats of any importance to how the hash was created in phpbb?

It's a heavily modded forum too, so I suspect there may be other ways to compromise it, but i'm not that clever yet!