Burp Suite: alphanumeric payload decoded to base64 exposes password, but as an encoded string

Question

I'm learning Web Pentesting using Juice Shop and I successfully used Burp Suite to generate an SQL injection payload in the repeater that exposed the plain text email and encoded password of the admin.

By using Burp Suite Decoder, I decoded the user password that gives me the username, email in plain text, but the decoded password is still an alphanumeric string "0192023a7bbd73250516f069df18XXXX" that cannot be successfuly used as a request in the Repeater to login as admin.

What kind of encoding does "0192023a7bbd73250516f069df18XXXX" have? Is it possible to convert it to a plain text password? I thought about hashcat, but I am unsure about what kind of encoding the string has.

I tried with base64, ''.encode('utf-8') in Python without success.

Thanks in advance.

Answer 1

You should notice that the string is in hexadecimal (using characters from 0-9 and A-F.) Each byte is represented by 2 characters (01 92 20 23 ....)

It is also a 16-byte strings, or 128-bit data. That and the fact that Hex to ASCII converter will give you no meaningful result should make you understand that this is not the literal password. In information security, password should never be stored in plaintext after all.

I am not going to give you any more information as it is not purpose of the exercise. You should read about how passwords should be stored, and deduce what your next step should be.