2 Hack Requests

[PaulBearer2k]

These are probably just simple little hacks, but I'm slow so well I'll let you guys give it a crack.

For the moderator's cp, I have many only about 6 mods, and I trust them since I'm the only admin at my place. So I was wondering on the mod cp, can you make it so that the moderator's can view the passwords?

Is there anyway to add a hole new function called Junior Moderator's. These would be like moderator's with less functions and without a cp. They'd get to open/close/move threads and that's about it. There name wouldn't be special on the who's online, nor would there name be under moderators. Just a small hack I'd like. But more importantly, the mods cp view pass hack. Thanks in advanced.

[SaintDog]

1. Passwords are MD5'ed for security, you can set a new password but admins nor mods can view the passwords by default (it is best this way as well).

2. Add a new user group and set their priviledges according to what you want them to have access to, you can do this buy going to:

Admin Cp -> User Groups -> Add

Regards,

- SaintDog

[PaulBearer2k]

Alright, well is there anyway that I can view passwords in the admin cp? I know this hack is available for ubb's, phpbb's but not sure about vbulletin.

[filburt1]

Originally posted by PaulBearer2k
Alright, well is there anyway that I can view passwords in the admin cp? I know this hack is available for ubb's, phpbb's but not sure about vbulletin.

After 2.0.3, you can't. Even if you hacked it, users would have to re-enter the passwords since they're stored as MD5 hashes which can't be decrypted back to their original values.

[scsa20]

Originally posted by filburt1


After 2.0.3, you can't. Even if you hacked it, users would have to re-enter the passwords since they're stored as MD5 hashes which can't be decrypted back to their original values.

nicely said ;)

unlike uBB and phpBB, vbulletin used the MD5 hashes (like filburt and SaintDog said ;)) meaning you can not decrypt them...basicly you first asked if mods can view passwords in the mod cp and SaintDog said that you can't, so that basicly answered your second question about viewing it in the admin cp ;)

Reason for this?? it's because any normal hacker that likes to hack into peoples sites won't be able to crack a MD5 hashe encryption (unless they are on the run for doing so)...and so that any of your admins/mods won't be able to go into someones account and start posting sh*t under there name ;)

[Logician]

Originally posted by scsa20
Reason for this?? it's because any normal hacker that likes to hack into peoples sites won't be able to crack a MD5 hashe encryption (unless they are on the run for doing so)...and so that any of your admins/mods won't be able to go into someones account and start posting sh*t under there name ;)
Are you sure?

If you manage to access MD5 hash password of someone all you have to do is to change your vb cookie in your browser and replace userid and password sections with these info of the user. So you will be able to login as HIM unless he disabled "remember me" setting in his User CP and you dont need to decrypt his password.

Besides if a hacker managed to login your site and access your database, user password security and his spamming in your site as you will be your last concern.. ;)

@PaulBearer2k: whatever the reason to save password in MD5 format is, it's true that you and your mods cant read them inside your cp. No way unless you alter your database and save the unencrypted version of the password in a new field whenever it's updated..

Logician