admins see passwords

[Keyser S?ze]

u wouldnt think this was needed, but i swear it is, for some reason in 2.0.3 i could see the users password, but now in 2.2.5 i cant, and i use to have this user that kept re-registering, just to bug ppl, and he ALWAYS used the same password, wutang,

also has been helpful in other cases, but not used for anything bad

does a hack like this exsist where admins can see users passwords in the admin cp?

thanks

[Xenon]

passwords are md5 encrypted, you cannot decrypt it anymore, its not possible to decrypt md5.

as i know there was a hack wich saves the passwords unencrypted for 2.x.x, but not sure

try the search function.

also it's not so hard to write a hack, wich will save pw's after login in uncryptet version into the DB, but i don't think its a good thing to do so

[scsa20]

Originally posted by IceMalee
u wouldnt think this was needed, but i swear it is, for some reason in 2.0.3 i could see the users password, but now in 2.2.5 i cant, and i use to have this user that kept re-registering, just to bug ppl, and he ALWAYS used the same password, wutang,

also has been helpful in other cases, but not used for anything bad

does a hack like this exsist where admins can see users passwords in the admin cp?

thanks

hmmm....since he uses the same password over and over again and you know what the password is, find out what his e-mail address is (if he uses Hotmail, put in his username (the first part of the adde (if you didn't know )) and use it againes your advages )

anyways, why would you what to know someone's password for?? just ban the guy

[Logician]

it's not what you asked, but is what you need:
https://vborg.vbsupport.ru/showthrea...threadid=38909

[Scott MacVicar]

I would not really recommend storing the passwords un-encrypted, if your on a shared server you'll find that anyone with shell will have access to your mysql tables, and you don't really want them having your passwords.

Such as a competitor might buy a $9.95 account on your server just to get access to your admin passwords and thats you in trouble. This is all hypothetical btw :P

If he used the same password, the hashed password will be the same so this query will find it.

SELECT * FROM user WHERE password=MD5("password")

[Tigga]

Couldn't you just simply search for the password "wutang" in the admin pages under users / find?

[Xenon]

no, you can't search for passwords in the admin cp since vb2

[RDX1]

i know how to find out users passwords via ACP... and its pretty easy... but would this be invasion of privacy if i told you how and you used it for other reasons?

[Chris M]

Not really...

It is something that could be useful...

Perhaps only to the site owner - i.e. Userid=1?

Satan

[Scott MacVicar]

You cant decrypt a MD5 hash, the only way to find it out is to store it seperately when they login / register.

To find a user using a password would be easy though, type in the password click find and it should come up. If you want i'll post the code