Last few weeks I found a malicious script installed on my hosting server. This is due to unupdated WordPress, that allow remote attacker to upload some malicious code into the server. The server have been clean up, no more problem. 🙂

The malicious file found is a PHP script, with alot of hacking tools embedded. One interesting part is, it have a md5 decoder. I’m not really good in data structure, I cannot construct my own bruteforce code. So, I took those bruteforce code to a single file, just to decode a md5 hash string.

This is just a prove of concept that, a strong password should be long, and have some extra character, other than normal alphabets. This give a higher probability of character to choose in bruteforce attack.

Download the code here, md5decode.txt. Please rename it to *.php.
You have to put in what character options to test against the hash string, and also the hash string you want to decode.

This code might not applicable in real life nowadays, as there are other ways users password been exploited, for example, using default password, and common password. Thats why most bruteforce attacked were dictionary based. So, make sure your password is strong enough. One other method, is Rainbow Table. I’m still reading it 🙂

Rainbow Table (Wikipedia) – http://en.wikipedia.org/wiki/Rainbow_table
Md5decode.txt – http://www.farhanfaisal.com/?download=md5decode.txt