VB4 Password Hashing Encryption

[dog199200]

Hello,

Does anyone know the hashing system for VB4's passwords??? I asked because i've been developing my own codes to sync the forum with my site and and accidently removed my password from my account... I found some hashing info in regards to VB3, and even got a password generated but it doesn't work. Here is the code I am currently using to 'hack/restore' my own password.


<?
$conn = mysql_connect($DBhost, $DBuser, $DBpass) or die(mysql_error());
mysql_select_db($DBname) or die(mysql_error());

if (isset($_POST[submit_modify])) {


$salt = ' *My Salt* ';
$password = $_POST[pass];

$hash=MD5(MD5($password)+$salt);

$update_profile = "UPDATE user
SET password='".$hash."'
WHERE userid=' *My User ID* '";



$retval = mysql_query( $update_profile, $conn );
if(! $retval ) {
die('Could not update data: ' . mysql_error());
}

echo "<center><b>Your Profile information has been updated!</b> <br />You will be redirected momentarily.</center><br />
<script language=javascript>
setTimeout(\"location.href='http://www.divineshadowsonline.com/index.php?area=profile'\", 2000);
</script>";


} else { ?>

<form method="post" action="<? echo $PHP_SELF;?>">
<input name="pass" type="password" size="15" />
<input type="submit" value="Update" name="submit_modify" />
</form>

<? }

mysql_close($conn);
?>


it almost works, its just not creating the right hashing. I've been meaning to ask this question for a few days now cause I am also building my own verification system and want to have a user input a password to verify their account, then will check it against the already hashed password to match them up, etc. Any help is greatly appreciated

[woodscooter]

Hello dog,

You are nearly there, but not quite.

$salt = 'xyz'; You are showing leading and trailing spaces. Can't do that.
I assume you have found the correct salt from looking at the database.

$hash=MD5(MD5($password) . $salt); Concatenate the strings with a dot, not a +

$update_profile = "UPDATE user
SET password='$hash'
WHERE userid=99";

your '".$hash."' has way too many quotes and dots

your ' *My User ID* ' has spaces and does not need quotes if it's a plain number.

I have tried that query myself and I can assure you it works.

[Alfa1]

Why would you need to recreate your password if you can just request a new password from vbulletin?