bbpassword Query

[TigerC10]

The cookie password is:

PHP Code:

md5(md5(md5($password) . $salt) . $license) 


The password hash in the user table is:

PHP Code:

md5(md5($password) . $salt) 


It is not possible to "undo" a hash. You cannot search for passwords in the database like this. In order to do what you want, you'll have to select password from the database - and then run a while loop that hashes the values out and then compares with the cookie data.

PHP Code:

$passes = $db->query_read("SELECT password FROM ". TABLE_PREFIX ."user");
while( $user = $db->fetch_array($passes) )
{
     if( md5( $user[password] . $license ) == $_COOKIE['bbpassword'] )
     {
          //Do something that you want to do when the password matches
          break;
     }
} 


This is terribly inefficient, I wouldn't do it if I were you.