156 reputation
15
bio website
location San Jose, CA
age
visits member for 2 years
seen May 27 at 9:09

Sep
21
awarded  Notable Question
May
26
awarded  Nice Question
Sep
20
awarded  Popular Question
Dec
29
awarded  Supporter
Dec
27
asked Who should I use for auditing/cerifying server software or specific deployment
Nov
26
comment HQL injection example
@ChrisAndrèDale IMHO, I'm not misunderstanding it. for either hash=f(pt) or hash=f(pt,salt), the only component that's not stored by db is pt. If the db is stolen, salt makes it harder to find the pt from hash in pre-computed databases. I don't believe that brute-forcing with salt, or without salt is any different (unless you somehow make salt application REALLY slow). For a pre-computed database, how hard it is to traverse it, with a given salt value?
Nov
25
comment HQL injection example
@Clockwork-Muse I agree to all that. But it's outside the scope of the original question, and is a separate discussion all together. For the record, I do acknowledge the weakness of MD5 (there are better hashes), but I don't so much believe in usefulness of salts (because salts are stored alongside hashes, if I got my hands on a hash, I got my hands on the salt)
Nov
23
comment HQL injection example
@SteveS I've updated the question to include the details.
Nov
23
revised HQL injection example
added explanation for how UNION will work.
Nov
23
comment HQL injection example
The code I put together was just to show general algorithm of how the password is checked. The logic to hash and compare is all inside checkPassword(). Yes, we are not using salts, but it's an MD5 hash.
Nov
20
comment HQL injection example
nice! Still would only enumerate hashes for us, and there is no interface to use hash as a password directly.
Nov
20
awarded  Editor
Nov
20
revised HQL injection example
added 7 characters in body
Nov
20
comment HQL injection example
@SteveS you would create your own record with the union, that would match the superuser record, but with your own password. The password check then would succeed.
Nov
20
awarded  Student
Nov
20
asked HQL injection example