meta user
network profile
| bio | website | |
|---|---|---|
| location | San Jose, CA | |
| age | ||
| visits | member for | 6 months |
| seen | Dec 29 '12 at 1:10 | |
| stats | profile views | 8 |
|
Dec 29 |
awarded | Supporter |
|
Dec 27 |
asked | Who should I use for auditing/cerifying server software or specific deployment |
|
Nov 26 |
comment |
HQL injection example @ChrisAndrèDale IMHO, I'm not misunderstanding it. for either hash=f(pt) or hash=f(pt,salt), the only component that's not stored by db is pt. If the db is stolen, salt makes it harder to find the pt from hash in pre-computed databases. I don't believe that brute-forcing with salt, or without salt is any different (unless you somehow make salt application REALLY slow). For a pre-computed database, how hard it is to traverse it, with a given salt value? |
|
Nov 25 |
comment |
HQL injection example @Clockwork-Muse I agree to all that. But it's outside the scope of the original question, and is a separate discussion all together. For the record, I do acknowledge the weakness of MD5 (there are better hashes), but I don't so much believe in usefulness of salts (because salts are stored alongside hashes, if I got my hands on a hash, I got my hands on the salt) |
|
Nov 23 |
comment |
HQL injection example @SteveS I've updated the question to include the details. |
|
Nov 23 |
revised |
HQL injection example added explanation for how UNION will work. |
|
Nov 23 |
comment |
HQL injection example The code I put together was just to show general algorithm of how the password is checked. The logic to hash and compare is all inside checkPassword(). Yes, we are not using salts, but it's an MD5 hash. |
|
Nov 20 |
comment |
HQL injection example nice! Still would only enumerate hashes for us, and there is no interface to use hash as a password directly. |
|
Nov 20 |
awarded | Editor |
|
Nov 20 |
revised |
HQL injection example added 7 characters in body |
|
Nov 20 |
comment |
HQL injection example @SteveS you would create your own record with the union, that would match the superuser record, but with your own password. The password check then would succeed. |
|
Nov 20 |
awarded | Student |
|
Nov 20 |
asked | HQL injection example |
