How to recover your password forgotten if password hash by MD5

Question

i made 2 program client and server and enter secure number if user forgotten password recover it by enter secure number it work correctly but if hash password by MD5 can not able to recover password by secure number i enter it and below is code about it

 ' query database, check if username and password are correct
    Dim mysqlDB As New mysql
    Dim userDB As String = mysqlDB.prepareQuery(arr(0).ToString)
    Dim passDB As String = mysqlDB.prepareQuery(arr(1).ToString)
    Dim query As String = "select * from users where userName='" + userDB + "' and password = '" + passDB + "'"
    mysqlDB.QueryDB(query)
    Dim found As Boolean = False

    ' read results
    While mysqlDB.reader.Read()
        username = mysqlDB.reader.GetString(1)
        password = mysqlDB.reader.GetString(2)
        clientPublicKey = mysqlDB.reader.GetString(3)
        found = True
    End While
    mysqlDB.CloseDB()

    If found = False Then   ' if not found check SecID

        query = "select password from users where userName='" + userDB + "' and SecID = '" + passDB + "'"
        mysqlDB.QueryDB(query)
        found = False
        ' read results
        While mysqlDB.reader.Read()
            password = "Your Password: " & mysqlDB.reader.GetString(0)
            Sbytes = Encoding.ASCII.GetBytes(password)
            found = True
        End While
        mysqlDB.CloseDB()
        If found = False Then   ' if not found send error message
            Sbytes = Encoding.ASCII.GetBytes("Wrong username or password")
        End If

        stream.Write(Sbytes, 0, Sbytes.Length)
        stream.Close()
        tcpClient.Close()
        Exit Sub

    End If
    ' close DB connection
    mysqlDB.CloseDB()

The *whole point* of storing hashed passwords is that it makes recovery prohibitively difficult. — jonrsharpe, Dec 16 '16 at 09:05
Execute a method with all possible password variations, which generate MD5 hash and compare with saved one until you find match - this approach called "Brute force" :) — Fabio, Dec 16 '16 at 09:07
@Fabio i not want to use brute force .. i wand to recovery password depended on secure id number — Fatima IE, Dec 16 '16 at 10:25
Possible duplicate of [How come MD5 hash values are not reversible?](http://stackoverflow.com/questions/330207/how-come-md5-hash-values-are-not-reversible) — Fabio, Dec 16 '16 at 10:28
What would be the point of hashing if it could be easily undone? — Ňɏssa Pøngjǣrdenlarp, Dec 16 '16 at 14:42
@Plutonix , no i want to ensure the user recovery password if forggotten becasuse i bult system of email and hash password to prevent attack from obtain password — Fatima IE, Dec 17 '16 at 06:57

score 1 · Answer 1 · answered Dec 16 '16 at 08:56

1

If you're asking if you could revert MD5 hash back to original password the answer is: "No, you cannot do that".

answered Dec 16 '16 at 08:56

Niklaus

991
8
13

why cannot able to do that – Fatima IE Dec 16 '16 at 10:23
Here's a pretty good answer for that: http://stackoverflow.com/a/330210 – Niklaus Dec 17 '16 at 13:10
@FatimaIE, please, mark my answer as accepted answer as it is the only answer and correct answer. Thanks! :) – Niklaus Mar 10 '17 at 11:16

How to recover your password forgotten if password hash by MD5

1 Answers1