←back to thread

A webshell and a normal file that have the same MD5

(github.com)
98 points shlomo_z | 2 comments | 21 Sep 25 05:52 UTC | HN request time: 0.001s | source
Show context
dsab ◴[24 Sep 25 05:23 UTC] No.45356607[source]▶
It's a pity that there is no description of what it is supposed to be used for.
replies(5): >>45356899 #>>45356950 #>>45357043 #>>45357572 #>>45358129 #
h4ck_th3_pl4n3t ◴[24 Sep 25 06:25 UTC] No.45356950[source]▶
The answer is likely wordpress, because its default wp_hash algorithm is still MD5.
replies(1): >>45357120 #
0points ◴[24 Sep 25 06:50 UTC] No.45357120[source]▶
> The answer is likely wordpress, because its default wp_hash algorithm is still MD5.

That's only true if you ignore all the details.

As usual, you cannot make a coherent understanding on just about any subject by reading headlines alone. Life would have taught you by now that the devil is in the details.

WP uses salt and multiple rounds of hashing, fully mitigating the md5 collisions being topic of discussion here.

So no, wp doesn't "use md5" in the sense that they would be vulnerable to this type of attack.

Source: https://developer.wordpress.org/reference/functions/wp_hash_...

replies(4): >>45357200 #>>45357282 #>>45357344 #>>45379061 #
1. eptcyka ◴[24 Sep 25 07:27 UTC] No.45357344[source]▶
> As usual, you cannot make a coherent understanding on just about any subject by reading headlines alone.

The amount of sweet, sweet irony displayed here will make me diabetic. Did you read the article at all? Salting? What are you on about?

Honestly, it feels that some HN commenters are LLMs instructed to defend a given entity.

replies(1): >>45379023 #
2. ◴[25 Sep 25 21:01 UTC] No.45379023[source]▶