136 reputation
bio website
visits member for 3 years, 5 months
seen Mar 18 '12 at 10:12

comment Does prepending a salt to the password instead of inserting it in the middle decrease security?
@MainMa: Basically, you are right and there are certainly cases where you can't extract the hashing algorithm from the website. However, if a website is prone to SQL injection, in reality it often also has other flaws. Furthermore, you could use the SQL injection to extract parts of the file system via SELECT LOAD_FILE(), which on the other hand might require additional information about the file structure of the website. Or, you use the bruteforce approach I suggested. But thanks for clarification :)