Practical attack on md5 hashing algorithm? I have the following conditions:

String which consist of "STRING+key+ID+key" is hashed with md5. I have a knowledge of STRING (10 chars), ID is probabilistic (int 15), key is 15 chars long (a-z A-Z 0-9) and it's same on both occurrences. I can produce multiple hashes but without knowledge of key. 

I guess collision is not going to work in this case as STRING is appended at the beginning and ID between keys. Is there actually any other option then brute force.

Produced hash is used as some kind of integrity check so you cannot alter the parameters. Key is hardcoded on the both sides (frontend and backend)

POST:
{"STRING":"ASDFGHJKLM","ID":"123456789012345","hash":"md5hash"}
Passwords, $p$, when only secured with a hash function $H$ on the database as $H(p)$ for login systems, is vulnerable to finding pre-image or secondary pre-image attacks. 

Secondary pre-image : given $ H(p)$ find $p' \neq p$ s.t  $H(p)=H(p')$.

The famous rainbow tables are generated to more effectively find the pre-image or secondary pre-images. To countermeasure the rainbow tables, salt is one of the solutions.

As I can see from your problem there is a salt and these prevent the rainbow attacks. 


As a result, you cannot benefit from the salts.


The only choice is the brute force.

And as you noted;


AWS p3.x16 has the power of 450GH/s.