vb.org Archive

vb.org Archive (https://vborg.vbsupport.ru/index.php)
-   Modification Requests/Questions (Unpaid) (https://vborg.vbsupport.ru/forumdisplay.php?f=112)
-   -   Decrypt passwords (https://vborg.vbsupport.ru/showthread.php?t=61663)

doctiar 02-17-2004 03:37 PM

Decrypt passwords
 
I want to send the logged in username and password information to another application. If I use $bbuserinfo[username] its fine, but the $bbuserinfo[password] is encrypted. Does anyone know how to decrypt the password?

THanks

assassingod 02-17-2004 03:39 PM

It's impossible to decrypt the password. It uses MD5 hash and then salt to add ultimate random encryption.

Zachery 02-17-2004 04:44 PM

Quote:

Originally Posted by doctiar
I want to send the logged in username and password information to another application. If I use $bbuserinfo[username] its fine, but the $bbuserinfo[password] is encrypted. Does anyone know how to decrypt the password?

THanks

Your best off trying to make your other software work with vBulletin.

CdaKnight 02-17-2004 04:55 PM

Yeah. When you check the password, couldn't you run it through the same scenario as the vB password, and then check the hash that comes out vs the hash that the bbuser[password] brings up?

assassingod 02-17-2004 05:15 PM

No because vB3 uses salt which makes each hash completely random, so passwords are like snowflakes, 2 are never the same

filburt1 02-17-2004 05:25 PM

Quote:

Originally Posted by doctiar
I want to send the logged in username and password information to another application. If I use $bbuserinfo[username] its fine, but the $bbuserinfo[password] is encrypted. Does anyone know how to decrypt the password?

THanks

It's a hash and is not possible to revert to its original unhashed value. If you want to integrate other software into vB, use a consolidated login form. There is absolutely no reason why you would need to get a user's actual password.

KuraFire 02-17-2004 06:38 PM

Quote:

Originally Posted by filburt1
It's a hash and is not possible to revert to its original unhashed value. If you want to integrate other software into vB, use a consolidated login form. There is absolutely no reason why you would need to get a user's actual password.

There are plenty of situations where you wouldn't want to encrypt passwords, actually, but vBulletin goes for security above such needs.

Quote:

Originally Posted by assy
It uses MD5 hash and then salt to add ultimate random encryption.

"ultimate", rather. vB's encryption (which is md5(md5(md5(pass) + salt) + license number) and therefore not entirely flawless at all) is still only moderate compared to the real ultimate encryptions :)

assassingod 02-17-2004 06:40 PM

I don't appreciate being called 'assy'

TheComputerGuy 02-18-2004 11:58 AM

I found that in vB2 I was able to take the MD5 data and use in to get a password. There is a program that will use all of your CPU power and try to figure out the MD5 encryption.

I will not post it for obvious reasons, but in vB2 there is ways to get the password from the hash as well.

Good to see vB3 did a better job with this.

RixiuS 02-18-2004 09:25 PM

Quote:

Originally Posted by assassingod
It's impossible to decrypt the password. It uses MD5 hash and then salt to add ultimate random encryption.

MD5 is not breakable though. ;o

Project Rainbowcrack is/are NT/MD5/SHA1 password cracking tables, capable of cracking any of these encryptions in (possibly) a matter of seconds. It has a table generator for every possible password. However there isn't anything as dynamic as you want right now. But probably sometime in the future.

http://www.antsight.com/zsl/rainbowcrack/

Really interesting stuff it is. :o

Zero Tolerance 02-19-2004 03:59 AM

Suppose your best method is adding a field to the user table, called 'actualpassword' or something, edit the login page, if login is successfull, update this field to be the data they inputted from the form and not the password stored in the db, seems most sensible way to me :)

But doing this is breaking privacy policy and in some countries it may be illegal

KuraFire 02-25-2004 08:25 AM

Quote:

Originally Posted by RixiuS
MD5 is not breakable though. ;o

Project Rainbowcrack is/are NT/MD5/SHA1 password cracking tables, capable of cracking any of these encryptions in (possibly) a matter of seconds. It has a table generator for every possible password. However there isn't anything as dynamic as you want right now. But probably sometime in the future.

http://www.antsight.com/zsl/rainbowcrack/

Really interesting stuff it is. :o

"every possible password" - only conventional ones would fit in that, a password like "xigH9d[3Cu89" would probably not be in those tables ;)


All times are GMT. The time now is 05:02 AM.

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.

X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.01035 seconds
  • Memory Usage 1,738KB
  • Queries Executed 10 (?)
More Information
Template Usage:
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (6)bbcode_quote_printable
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)post_thanks_navbar_search
  • (1)printthread
  • (12)printthreadbit
  • (1)spacer_close
  • (1)spacer_open 

Phrase Groups Available:
  • global
  • postbit
  • showthread
Included Files:
  • ./printthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/class_bbcode_alt.php
  • ./includes/class_bbcode.php
  • ./includes/functions_bigthree.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • printthread_start
  • bbcode_fetch_tags
  • bbcode_create
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • printthread_post
  • printthread_complete