2

I have the following password captured using sqlmap-

 $2a$08$9eaKUtKdFV8fuOAx0sfr4emrG1aHzGeNsn/rVdW243nw6Ktt.Uc0O

Now, I don't know how to decrypt this password because I don't know which algorithm was used for its encryption.

I have tried online free decryption tools, but none of them find the way to discover which algorithm was used.

2
  • 1
    "I have tried online free decryption tools, but none of them find the way to discover which algorithm was used." most passwords generated in most programming languages nowadays uses a internal salt so (online) rainbow tables becomes useless.. Notice this (PHP) code and see the hash is different foreach run even for the same password.. Also blowfish is slow to run on GPU's so bruteforcing on GPUs is also not a option Apr 25, 2019 at 12:08
  • Ok i am going to check the link for guidance and thanks for your precious time. Apr 26, 2019 at 16:58

2 Answers 2

10

How are passwords stored?

Passwords are not (or at least should not be) stored using encryption. They should be stored using a hashing algorithm. So if you are trying to decrypt it to recover the original password, then that isn't going to work.

Here are some links to read about how password storage works:

How to figure out which hash algorithm was used?

Let's break down your sample password:

(This section is completely quoted from A. Hersean answer below. Please scroll down and give them an upvote)

According to wikipedia and the passlib documentation we can deduce :

  • "$" is a separator
  • "2a" means that the algorithm used is bcrypt with the blowfish hashing function;
  • "08" is the cost parameter, i.e. 2^8 rounds;
  • "9eaKUtKdFV8fuOAx0sfr4e" is the 128 bit salt encoded in Radix64;
  • "mrG1aHzGeNsn/rVdW243nw6Ktt.Uc0O" is the hash encoded in Radix64.

Even knowing that it's a hash and not encryption, it's still hard to reverse-engineer which hash algorithm was used (this is by design).

Tools to identify hash type

If you google for "hash identifier tools", you'll find plenty of free websites. Personally, I like the linux command-line tool hash-identifier (in Kali, or hashid in Ubuntu):

~ hashid 
$2a$08$9eaKUtKdFV8fuOAx0sfr4emrG1aHzGeNsn/rVdW243nw6Ktt.Uc0O
Analyzing '$2a$08$9eaKUtKdFV8fuOAx0sfr4emrG1aHzGeNsn/rVdW243nw6Ktt.Uc0O'
[+] Blowfish(OpenBSD) 
[+] Woltlab Burning Board 4.x 
[+] bcrypt 

I hope this has been helpful!

6
  • Very nice, your theory is very clear, now i got it what is this... In fact i was totally wrong about the password hashing (I thought it is encrypted string) but yes it is hash not encryption- thanks for very good clarifications and also for important links for reading... Mar 18, 2019 at 4:00
  • 3
    $id is a standard format and $2a is a version of bcrypt Mar 18, 2019 at 10:41
  • 2
    I added an answer in complement to yours (a comment would have been too long). Feel free to include it in your answer if you wish so, I would then delete mine.
    – A. Hersean
    Mar 20, 2019 at 10:26
  • @A.Hersean Thanks! I've referenced your answer so that hopefully you still get some upvotes. Mar 20, 2019 at 13:30
  • I did not answer to get upvotes, but thank you for your kind consideration. I'll leave my answer then.
    – A. Hersean
    Mar 20, 2019 at 14:48
4

To complement the answer of Mike Ounsworth, according to wikipedia and the passlib documentation we can deduce :

  • "$" is a separator
  • "2a" means that the algorithm used is bcrypt with the blowfish hashing function;
  • "08" is the cost parameter, i.e. 2^8 rounds;
  • "9eaKUtKdFV8fuOAx0sfr4e" is the 128 bit salt encoded in Radix64;
  • "mrG1aHzGeNsn/rVdW243nw6Ktt.Uc0O" is the hash encoded in Radix64.
1
  • very nice details- love your answer too... Mar 21, 2019 at 16:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .