I'm a developer and suddenly I fall in a stupid situation like I need to crack a hash Joomla password which is (5aa154999c111bf7f33a1a3cadba5847) and I don't know the salt. is there any way to crack this hash password?


Just as Swashbuckler said - "decrypt" or "dehash" or "reverse" are almost always the wrong words for attacking password hashes.

But you can try to crack them - even with an unknown salt. This involves trying many possible strings, to see if they result in the same hash. It is harder if the salt is also unknown.

If it's older Joomla, it's MD5-ish (though I'm not sure of the details there, digging into the source code for older Joomla or John the Ripper or hashcat would probably tell you). Newer Joomla uses phpass, so there are quite a few possible salts, so this would probably be non-trivial (unless the password is trivial).

Edit: Looking at this answer and other sources, unless yours was a custom naive implementation, Joomla hashes prior to 2.5.18 had a large 32-hex salt (16^32 or ~34x10^38 possibilities). Even if the password is 'password', cracking this hash without the salt would be very unlikely.

  • Thank you for your answer. Yes its an older Joomla and its MD5 I'm pretty sure about this and I use hashcat and it's not gonna crack it. So now is there any way available that I'm gonna use to crack it? – Antu Sep 9 '18 at 4:38
  • Looking at the hashcat example hash for "hashcat" (19e0e8d91c722e7091ca7a6a6fb0f4fa:54718031842521651757785603028777), if that second field is the salt ... it looks like a very large salt space. Looks pretty unlikely to crack to me. – Royce Williams Sep 9 '18 at 14:08
  • Yeah, looking at stackoverflow.com/questions/10428126/joomla-password-encryption and other sources, unless yours was a custom naive implementation, it's usually 32-hex salt (the hashcat one is artificially only digits). If so, even if the password is 'password', cracking this hash without the salt would be practically impossible. – Royce Williams Sep 9 '18 at 14:16
  • Thank you. So according to your link without knowing salt, cracking password will be hard enough. – Antu Sep 10 '18 at 4:20

If you were able to obtain the hash, you probably can obtain the salt too. I don't know about Joomla, but every software I have seen stores the password hash and the salt together in the same table or even as a sole string

If you have both of them you could try to perform bruteforce attacks, that is, hash every possible password using that salt and check if it's the same. This is time expensive as you have to iterate through all possible characters for every position in the password. Using all printable character gives you 100^(password length) possible passwords, and if you don't know the actual password length you should repeat this process for every possible length

I'm a developer and suddenly I fall in a stupid situation like I need to crack a hash

From what you're saying, it seems like you forgot your own password or an already known one. In this case I'd recommend creating a password dictionary with simple password that you might have used and apply a rule based attack using hashcat or john the ripper. This dictionary should NOT have transformations, f.e. if your password is P@s5W0rd! the dictionary should contain only password as the rules will make all possible transformations. How rule based attacks work is beyond the scope of this question, but the hashcat documentation explains it very well and hashcat itself includes a lot of rules for common transformations.

Furthermore, if you're attempting to recover access to a Joomla instance and you have write access to the database, is way more optimal to just override the hash and the salt. To do that you could just take a look at the Joomla source code to see how it's hashed and do the same with a newly known password or use a web application like this one (In case you go with the web application, for better security please change your password through Joomla after setting a new one in the database)

  • Thank you, As you say Yes I know a password which was developed by my previous developer I can change that password but I actually want to know that the plaintext and I think brute force attack is not a good solution for crack a password it also takes lots of time. I was finding if there was a hash tool that helps me out to crack md5 hash without knowing the salt. I also use hashcat and it's not found any match. – Antu Sep 10 '18 at 4:34
  • @Antu Well, bruteforce and dictionary attacks are the only solution. If there were a - known - better method every Joomla instance would be vulnerable – Mr. E Sep 11 '18 at 16:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.