While pointing out a SQL injection flaw on another question, I was able to show that an arbitrary sha1 hash could be inserted into a query such that it would be taken for a real hash, and was therefore able to login assuming the dummy hash was used. I could inject an
ORDER BY but then wanted to make sure the hash I was using as an example was likely to come out at the top.
From my understanding,
0000000...0 should be a valid possible output from the hash function but, of course, finding the associated input is non-trivial.
In any case, it got me wondering. Is there any way - except brute force or downloading a rainbow table - to find a hash that would sort before an arbitrary point (say before 99% of passwords =~ in the first 1.46150x10^46)
I suspect the answer is no but would like confirmation.