Best way to know the algorithm used for a password encryption

Question

I have the following password captured using sqlmap-

 $2a$08$9eaKUtKdFV8fuOAx0sfr4emrG1aHzGeNsn/rVdW243nw6Ktt.Uc0O

Now, I don't know how to decrypt this password because I don't know which algorithm was used for its encryption.

I have tried online free decryption tools, but none of them find the way to discover which algorithm was used.

Answer 1

How are passwords stored?

Passwords are not (or at least should not be) stored using encryption. They should be stored using a hashing algorithm. So if you are trying to decrypt it to recover the original password, then that isn't going to work.

Here are some links to read about how password storage works:

• https://crackstation.net/hashing-security.htm#normalhashing
• https://en.wikipedia.org/wiki/Cryptographic_hash_function#Password_verification
• and a much, much longer one here: https://security.blogoverflow.com/2013/09/about-secure-password-hashing/

How to figure out which hash algorithm was used?

Let's break down your sample password:

(This section is completely quoted from A. Hersean answer below. Please scroll down and give them an upvote)

According to wikipedia and the passlib documentation we can deduce :

• "$" is a separator
• "2a" means that the algorithm used is bcrypt with the blowfish hashing function;
• "08" is the cost parameter, i.e. 2^8 rounds;
• "9eaKUtKdFV8fuOAx0sfr4e" is the 128 bit salt encoded in Radix64;
• "mrG1aHzGeNsn/rVdW243nw6Ktt.Uc0O" is the hash encoded in Radix64.

Even knowing that it's a hash and not encryption, it's still hard to reverse-engineer which hash algorithm was used (this is by design).

Tools to identify hash type

If you google for "hash identifier tools", you'll find plenty of free websites. Personally, I like the linux command-line tool hash-identifier (in Kali, or hashid in Ubuntu):

~ hashid 
$2a$08$9eaKUtKdFV8fuOAx0sfr4emrG1aHzGeNsn/rVdW243nw6Ktt.Uc0O
Analyzing '$2a$08$9eaKUtKdFV8fuOAx0sfr4emrG1aHzGeNsn/rVdW243nw6Ktt.Uc0O'
[+] Blowfish(OpenBSD) 
[+] Woltlab Burning Board 4.x 
[+] bcrypt 

I hope this has been helpful!

Answer 2

To complement the answer of Mike Ounsworth, according to wikipedia and the passlib documentation we can deduce :

• "$" is a separator
• "2a" means that the algorithm used is bcrypt with the blowfish hashing function;
• "08" is the cost parameter, i.e. 2^8 rounds;
• "9eaKUtKdFV8fuOAx0sfr4e" is the 128 bit salt encoded in Radix64;
• "mrG1aHzGeNsn/rVdW243nw6Ktt.Uc0O" is the hash encoded in Radix64.