Kuna watu bado wanatumia SHA-1 ku encrypt passwords?

Cybergates · Feb 19, 2022

Leo nilikua napitia baadhi ya website za taasisi zetu hapa nchini

moja ya taasisi kubwa tu ya IT juzi juzi hapa walifanya update ya system yao wakaongeza baadhi ya features na function mbalimbali

Kabla ya hayo maboresho, system yao ilikua moja ya website ngumu kupata loophole

Leo nimetest moja ya feature yao mpya walio add yani ni toooo easy to hack mtoto wa form 3 akipewa terminal ana hack, yani mtu una download database yote, kila kiku hadi taarifa confidential

Moja ya table ilikua ya users hii ndo imenishikitisha ya password zao zipo hashed na sha-1??, ya nii hi SHA-1 tool kama john au Johnny zina crack hizo password dk3 na baadhi ya password zipo kwenye worldlist.txt, Nimekuta root/admin username zinatumia uki decrypt hizo hash unapata password kama pass2020

Inabidi watu wa advance aise lest ukitumia sha1 add tena na md5 inakua afadhali kidogo kuliko kutimia sha 1 pekeyake

Freyzem · Feb 19, 2022

Hebu weka link ya hiyo site hapa tuwabalaguze…

Mbomozo · Feb 19, 2022

Cybergates said:
Leo nilikua napitia baadhi ya website za taasisi zetu hapa nchini

moja ya taasisi kubwa tu ya IT juzi juzi hapa walifanya update ya system yao wakaongeza baadhi ya features na function mbalimbali

Kabla ya hayo maboresho, system yao ilikua moja ya website ngumu kupata loophole

Leo nimetest moja ya feature yao mpya walio add yani ni toooo easy to hack mtoto wa form 3 akipewa terminal ana hack, yani mtu una download database yote, kila kiku havi taarifa confidential

Moja ya table ilikua ya users hii ndo imenishikitisha ya password zao zipo hashed na sha-1??, ya nii hi SHA-1 tool kama john au Johnny zina crack hizo password dk3 na baadhi ya password zipo kwenye worldlist.txt, Nimekuta root/admin username zinatumia uki decrypt hizo hash unapata password kama pass2020

Inabidi watu wa advance aise lest ukitumia sha1 add tena na md5 inakua afadhali kidogo kuliko kutimia sha 1 pekeyake

Mzee baba ni nouma 😎

KISIWAGA · Feb 19, 2022

Haya majamaa yanayadevelop website za serikali sijui yalisomea vyuo gani

Smart911 · Feb 19, 2022

Inasikitisha sana...

Jorge WIP · Feb 19, 2022

Freyzem said:
Hebu weka link ya hiyo site hapa tuwabalaguze…

[emoji102]

Gushleviv · Feb 19, 2022

KISIWAGA said:
Haya majamaa yanayadevelop website za serikali sijui yalisomea vyuo gani

Hakuna IT Profesional na anaejitambua ataweza kufanya kazi Serikalini hadi Serikari itakapotambua umuhimu wa hiyo sekta na kuipa maslahi.

love life live life · Feb 19, 2022

Cybergates said:
Leo nilikua napitia baadhi ya website za taasisi zetu hapa nchini

moja ya taasisi kubwa tu ya IT juzi juzi hapa walifanya update ya system yao wakaongeza baadhi ya features na function mbalimbali

Kabla ya hayo maboresho, system yao ilikua moja ya website ngumu kupata loophole

Leo nimetest moja ya feature yao mpya walio add yani ni toooo easy to hack mtoto wa form 3 akipewa terminal ana hack, yani mtu una download database yote, kila kiku hadi taarifa confidential

Moja ya table ilikua ya users hii ndo imenishikitisha ya password zao zipo hashed na sha-1??, ya nii hi SHA-1 tool kama john au Johnny zina crack hizo password dk3 na baadhi ya password zipo kwenye worldlist.txt, Nimekuta root/admin username zinatumia uki decrypt hizo hash unapata password kama pass2020

Inabidi watu wa advance aise lest ukitumia sha1 add tena na md5 inakua afadhali kidogo kuliko kutimia sha 1 pekeyake

Uliposema md5 nikaona na wewe ni walewale.

mathsjery · Feb 19, 2022

Cybergates said:
Leo nilikua napitia baadhi ya website za taasisi zetu hapa nchini

moja ya taasisi kubwa tu ya IT juzi juzi hapa walifanya update ya system yao wakaongeza baadhi ya features na function mbalimbali

Kabla ya hayo maboresho, system yao ilikua moja ya website ngumu kupata loophole

Leo nimetest moja ya feature yao mpya walio add yani ni toooo easy to hack mtoto wa form 3 akipewa terminal ana hack, yani mtu una download database yote, kila kiku hadi taarifa confidential

Moja ya table ilikua ya users hii ndo imenishikitisha ya password zao zipo hashed na sha-1??, ya nii hi SHA-1 tool kama john au Johnny zina crack hizo password dk3 na baadhi ya password zipo kwenye worldlist.txt, Nimekuta root/admin username zinatumia uki decrypt hizo hash unapata password kama pass2020

Inabidi watu wa advance aise lest ukitumia sha1 add tena na md5 inakua afadhali kidogo kuliko kutimia sha 1 pekeyake

IT wa bongo kakamata mpini Stefano Mtangoo

Underwood · Feb 19, 2022

Mtangoo · Feb 19, 2022

love life live life said:
Uliposema md5 nikaona na wewe ni walewale.

Labda alimaanisha concatenation ya SHA1 na MD5. But why using hashes in 21st century?

Better hata wangetumia php password function

Mtangoo · Feb 19, 2022

mathsjery said:
IT wa bongo kakamata mpini Stefano Mtangoo

IT wa Bongo hawana uwezo wa kupenya. Kama kapenya mpaka kwenye database hafai kuwa IT wa Bongo. IT wa bongo ni zero kabisa!

Mtangoo · Feb 19, 2022

PHP: password_hash - Manual

Creates a password hash

www.php.net

KISIWAGA · Feb 20, 2022

Gushleviv said:
Hakuna IT Profesional na anaejitambua ataweza kufanya kazi Serikalini hadi Serikari itakapotambua umuhimu wa hiyo sekta na kuipa maslahi.

Kwahiyo kumbe wanaokota watu huko maporini na kuwapatia kazi nyeti kiasi hiki

Kuchwizzy · Feb 21, 2022

Majuzi nimetoka ku rewrite from the ground up, administrative dashboard ya chuo fulani cha serikali...

Wao hawakujisumbua na hashing, passwords zote walizi store kama plain text, na admin alikua na uwezo wa ku edit passwords za users wote.

Chuo cha serikali.

byeyombo · Feb 21, 2022

Kuchwizzy said:
Majuzi nimetoka ku rewrite from the ground up, administrative dashboard ya chuo fulani cha serikali...

Wao hawakujisumbua na hashing, passwords zote walizi store kama plain text, na admin alikua na uwezo wa ku edit passwords za users wote.

Chuo cha serikali.

seriously???

Kikapuu · Feb 21, 2022

Duuh !

ISO M.CodD · Feb 21, 2022

You get what you pay for....

Ila kutokuhash passwords ni uzembe uliopitiliza

Kiteka · Feb 21, 2022

Gushleviv said:
Hakuna IT Profesional na anaejitambua ataweza kufanya kazi Serikalini hadi Serikari itakapotambua umuhimu wa hiyo sekta na kuipa maslahi.

Ndio Umeongea Ukweli huko hatuakiwi Wanataka vilaza

Cybergates · Feb 21, 2022

Freyzem said:
Hebu weka link ya hiyo site hapa tuwabalaguze…

Ha haha, tuwasamehe tu mkuu. ku ujumla hii loophole nimeikuta kwenye QR code

love life live life said:
Uliposema md5 nikaona na wewe ni walewale.

Nilikua namaanisha hivi sha1(md5($pass))

mathsjery said:
IT wa bongo kakamata mpini Stefano Mtangoo

Mbona bongo kuta IT wazuri sana

Stefano Mtangoo said:
IT wa Bongo hawana uwezo wa kupenya. Kama kapenya mpaka kwenye database hafai kuwa IT wa Bongo. IT wa bongo ni zero kabisa!

Sema mkuu saivi tunaangalia possibility ya kupenya hadi kwenye servers

Stefano Mtangoo said:
PHP: password_hash - Manual

Creates a password hash

www.php.net

Nimesoma hizo hashing zipo vizuri personal hashing zangu output zake zipo hivi

Ruby:

dZSPIEGoYv4D2BPc3CbRiA$8$1$cA2yxRHOj7rDPV81tnmrVjRO1BQf2af4X8tg3YGOEyJQSMIZPgiOosVQHapvNrm0/UvtUxfugtlxaxWJYDaP6A==
msNpsGVZveMR2Ku75k4oDc$8$1$/8SBRH7b/XrQItDDnXwdQA/ICiyvG1JLRKHFMQ05H8H6Lmh/SbzgDl0jK9ZDt3ss2dVEB5DXEmZsGR28s0FLJw==
HexZH5I8pOuMFvkkxIBWtH$8$1$3gm+ghrlVWpARqFuy6PZX1oV1vBC70+NEQkWf67DTmxq0cQRUFd73tpeJZIA4wWh/Tfl2h+5d3zilzAoYLe53A==

Kuchwizzy said:
Majuzi nimetoka ku rewrite from the ground up, administrative dashboard ya chuo fulani cha serikali...

Wao hawakujisumbua na hashing, passwords zote walizi store kama plain text, na admin alikua na uwezo wa ku edit passwords za users wote.

Chuo cha serikali.

website za chuo ndo haman kitu kabisa

Kuna watu bado wanatumia SHA-1 ku encrypt passwords?

JF-Expert Member

JF-Expert Member

JF-Expert Member

JF-Expert Member

Platinum Member

JF-Expert Member

JF-Expert Member

JF-Expert Member

JF-Expert Member

JF-Expert Member

JF-Expert Member

JF-Expert Member

JF-Expert Member

JF-Expert Member

JF-Expert Member

JF-Expert Member

JF-Expert Member

JF-Expert Member

JF-Expert Member

JF-Expert Member

Similar Discussions