Reset All User Passwords?

[Dark Navi]

So our database was recently dumped and I'm trying to mass reset all passwords on the forum, so that users have to recover their passwords.

How would I go about doing this?

Is there a an SQL query I can execute to change all passwords to usernames? and then use the vulnerable passwords tool?

[kh99]

Here's a thread where someone posted a script to change all passwords for a usergroup to the usernames: www.vbulletin.org/forum/showthread.php?t=243919 then I believe they will be required to change because a password the same as the name isn't allowed.


I think another possibility (which lets users log in one more time with their current password) would be to set a password expiration date for the usergroup, then do a query to set the password date to some time in the past. But that will tell users that they "haven't changed their password for X days" which could be confusing.

[Dark Navi]

Originally Posted by kh99

Here's a thread where someone posted a script to change all passwords for a usergroup to the usernames: www.vbulletin.org/forum/showthread.php?t=243919 then I believe they will be required to change because a password the same as the name isn't allowed.


I think another possibility (which lets users log in one more time with their current password) would be to set a password expiration date for the usergroup, then do a query to set the password date to some time in the past. But that will tell users that they "haven't changed their password for X days" which could be confusing.

And it defeats the object, as the database was leaked, malicious people will just login to the accounts, and change the passwords

[kh99]

Originally Posted by Dark Navi

And it defeats the object, as the database was leaked, malicious people will just login to the accounts, and change the passwords

Ah, right, I see. Then the script in that thread is probably what you want. (It involves running the vulnerable password tool like you were saying).

[Dark Navi]

But yeah, I've gone ahead and used that script, just mailing out the passwords now, and I've put a htaccess on the site in the meantime just in case.