TLDR: i'm a hacking noob trying to learn and i'm unable to crack this simple md5 hash. If you want to skip the novel, the hash is in the second to last paragraph.

Well hello citizens of itoopie! i'm a recent convert to this awesome network, and from the last couple of months of playing around with it, i'm really digging it, man. I've spent (like im sure we all have) years on TOR and playing around with all their fun projects and technologies, so its still near and dear to my heart, but having I2Pd installed on a whonix-WS qube on my Qubes machine has won me over.

Okay, enough of the asskissing. I need some help.
There is a hackers forum on the TOR network (i'll keep the name quiet but i'm sure you all have heard of it) that is meant specifically for pretty advanced mofos. Anyone can join the forum, but you only have limited access to the topics and threads. In order to gain full access, you must complete a couple of hacking challenges to prove you know your shit before you submit your application to become a "fully fledged neckbeard" or whatever. Now, I've personally been on the blue-team side of cybersecurity as a hobby for a hot minute, but i've recently started dipping my toes into the red side of things, and I'm really liking it.

It's just pretty fuckin hard, though. It is much easier keeping strong opsec to stay hidden than it is to do some of the searching yourself, I've learned.

SO. I've been trying to take on these hacking challenges simply for fun and practice, kind of like a free vulnhub VM or a one-off CTF challenge. But so far the challenge is defeating me. All it says is to "find the hash on this page and crack it, then type your password in". Finding the hash was easy (all it took was like 15 minutes poking around at the source code and inspecting the pages elements). But for some reason I am having the hardest time cracking the hash.

It's a md5 hash, which i've read while researching what exactly to do is supposed to be a fairly easy hash to crack. I've tried hashcat and john the ripper on Kali, i've tried using a tool called "Cyber Chef" (on I2P actually), and just to help trouble shoot, i tried a couple of those shitty "online md5 generators/crackers" websites. And i've just kinda come to a dead end, the tools either fail to crack the hash (kali tools) or the answers i get are all different from one another (the rest of the tools/sites).

Here is the md5 hash that was hidden in the header: 7db57006a3529c518b7773f3fb6a8f35.
I am not asking anyone to do the work for me, I really want to solve this mother fucker, but some wisdom from hackers who know better than me would be really helpful. Does anyone have any tips/tricks/advice for what to do next? Maybe an article or a really helpful writeup of a similar situation so i can learn? I figure i'm just using the kali tools incorrectly, but i've read the man pages for both hashcat and john and there are several examples online that i followed with no luck. I've tried brute-force attacks and dictionary attacks with both tools.

If someone could help teach me the correct way to solve this, or atleast set me in the right direction, that would be pretty groovy. Sorry for this too-long first post, some other accounts I have I am pretty short and sweet on, so i guess i decided to make this account break the pattern. Take THAT steganography (;

--
Posted on RetroBBS

check out these links:

https://cryptography.hyperlink.cz/MD5_collisions.html
https://resources.bishopfox.com/resources/tools/other-free-tools/md4md5-collision-code/

not sure if using these tools qualify as "solving it yourself"....

what is the pages address ? i would like to take a peek as well...

--
Posted on RetroBBS

and only grandmothers pull out their pad and pen to try to crunch numbers and break encryption lol..

unless its literally a OTP.

--
Posted on RetroBBS

Hey there, thank you for the extra reading material! I need all the info I can get my hands on.

I actually, like an hour ago, finally cracked the hash. I had apparently been using the "rules" tack incorrectly...which means I wasted a loooooooot of time unnecessarily..lol. Oh well.

I didn't originally plan on mentioning the forum by name because they also function as a market for the hackers and programmers to sell their services, and i wasn't sure the rules this forum had about mentioning potentially illicit wares or services. But fuck it, they'll take it down if they want too lol. Its cryptbb, their official onion link is http://cryptbbtg65gibadeeo2awe3j7s6evg7eklserehqr4w4e2bis5tebid.onion/ (but always verify the link is legit first).

--
Posted on RetroBBS

thanks for the link, I lost that a while ago....

when you say "cracking the hash" you mean you could generate a value that results in the given hash, right ?

concerning links to hackers boards, I'm not the owner of RetroBBS, but I think Retro Guy has no objections (at least did not have in the past...).

--
Posted on RetroBBS

no problem, i get my legit onion links from tor.taxi since i don't trust dark.fail or darknetlive.

And, yeah, pretty much. I didn't double check (although i will now) that the result i got also encrypts into the same hash i found. i used a specific wordlist with a specific set of rules on the hash and the output cat'd to a text file. it said "md5hashxxxxxxxx: passwordxxxxxx" so I presume it is correct.

is "cracking the hash" not the correct term for what i did?

--
Posted on RetroBBS

>is "cracking the hash" not the correct term for what i did?

I would use "cracking" more in connection with encryption, encryption being a two way function where you can find one solution for the encrypted data, which is the unencrypted data. A hash is a one way function, where you can find an infinite number of matches for any given hash.
But tomaaaatoes, tomatoes....

--
Posted on RetroBBS