0

I found online an web app that is vulnerable to blind sql injection, I manage to get in users table and I looked at my password, in the table was the hased version, this one->57b0fcbe39b9336d, now I know that my password is dinamo, knowing the hashed version and the original password how I can use this informations to find out the hashed method?

  • The value that you posted (60e35c1b4925088a) is only 64 bits in length. This is far to short to be the result of any modern password hashing function. – mti2935 Sep 28 at 22:58
  • Hi, the web app is preety old I believe it was made between 2005-2007 and It didn;t get updated, also I made a little mistake, the hash for my pass is 57b0fcbe39b9336d, sorry i edit it now – the_owl Sep 28 at 23:09
4

You can narrow down what hash type it is using hashID:

$ hashid 218844.hash 
--File '218844.hash'--
Analyzing '57b0fcbe39b9336d'
[+] MySQL323 
[+] DES(Oracle) 
[+] Half MD5 
[+] Oracle 7-10g 
[+] FNV-164 
[+] CRC-64 
[+] Cisco-PIX(MD5) 
[+] Cisco-ASA(MD5) 
--End of file '218844.hash'--

But the only way to truly verify a hash format is to actually crack a hash.

You could try each of the above one at a time using hashcat or John the Ripper, but trying one at a time can be time-consuming. Instead, you can try many different types of hashes using a general tool like MDXfind.

We can quickly discover that this hash is a single iteration of the native MYSQL 3.23 (pre-MySQL 4.1) format, without specifying the hash type in advance:

$ cat 218844.hash
57b0fcbe39b9336d

$ cat 218844.list 
dinamo

$ mdxfind -h ALL -h '!salt,!user,!md5x' -i 5 -f 218844.hash 218844.list 
Iterations set to 5
Working on hash types: MD5 MD5UC MD4 MD2 WRL HAV128 SHA0 SHA1 SHA224 SHA256 SHA384 SHA512 GOST GOST-CRYPTO HAV256 RMD128 RMD160 TIGER TTH HAS160 EDON256 EDON512 SNE128 SNE256 MD6 MD6256 MD6512 MDC2 MD5RAW SHA224RAW SHA256RAW SHA384RAW SHA512RAW HAV128_4 HAV128_5 HAV160_3 HAV160_4 HAV160_5 HAV192_3 HAV192_4 HAV192_5 HAV224_3 HAV224_4 HAV224_5 HAV256_4 HAV256_5 BLAKE224 BLAKE256 BLAKE384 BLAKE512 BMW224 BMW256 BMW384 BMW512 CUBE224 CUBE256 CUBE384 CUBE512 ECHO224 ECHO256 ECHO384 ECHO512 FUGUE224 FUGUE256 FUGUE384 FUGUE512 GROESTL224 GROESTL256 GROESTL384 GROESTL512 HAMSI224 HAMSI256 HAMSI384 HAMSI512 JH224 JH256 JH384 JH512 SHA3-224 SHA3-256 SHA3-384 SHA3-512 LUFFA224 LUFFA256 LUFFA384 LUFFA512 PANAMA RADIOGATUN32 RADIOGATUN64 SHABAL224 SHABAL256 SHABAL384 SHABAL512 SHAVITE224 SHAVITE256 SHAVITE384 SHAVITE512 SIMD224 SIMD256 SIMD384 SIMD512 SKEIN224 SKEIN256 SKEIN384 SKEIN512 TIGER2 WRL0 WRL1 RIPEMD MD2MD5 MD2MD5PASS MD4MD5 MD4MD5PASS MD5MD5PASS GOSTMD5 GOSTMD5PASS HAV128MD5 HAV128MD5PASS HAV128_4MD5 HAV128_4MD5PASS HAV128_5MD5 HAV128_5MD5PASS HAV160_3MD5 HAV160_3MD5PASS HAV160_4MD5 HAV160_4MD5PASS HAV160_5MD5 HAV160_5MD5PASS HAV192_3MD5 HAV192_3MD5PASS HAV192_4MD5 HAV192_4MD5PASS HAV192_5MD5 HAV192_5MD5PASS HAV224_3MD5 HAV224_3MD5PASS HAV224_4MD5 HAV224_4MD5PASS HAV224_5MD5 HAV224_5MD5PASS HAV256MD5 HAV256MD5PASS HAV256_4MD5 HAV256_4MD5PASS HAV256_5MD5 HAV256_5MD5PASS RMD128MD5 RMD128MD5PASS RMD160MD5 RMD160MD5PASS SHA1MD5 SHA1MD5PASS SHA224MD5 SHA224MD5PASS SHA256MD5 SHA256MD5PASS SHA384MD5 SHA384MD5PASS SHA512MD5 SHA512MD5PASS TIGERMD5 TIGERMD5PASS WRLMD5 WRLMD5PASS SNE128MD5 SNE128MD5PASS SNE256MD5 SNE256MD5PASS MD5SHA1 MD5SHA256 MD5SHA512 SHA1PASSSHA1 SHA1UC MD5SHA1MD5 MD5SHA1MD5SHA1 MD5SHA1MD5SHA1SHA1 SHA1MD5SHA1 SHA1MD5SHA1MD5 MD5HAV160_3 MD5SHA1HAV160_4 MD5SHA1MD5SHA1MD5 MD5RMD160 MD5SHA1SHA256 SHA256SHA512 MD5WRL MD5SHA1SHA1RAW MD5PASSMD5 MD5-DBL-PASS SHA1MD5UC SHA1MD5SHA1MD5SHA1MD5 MD5SQL5 SHA1SQL5 MD5MD5UCMD5 RMD128MD5MD5 MD5BASE64 MD5BASE64MD5 MD5SHA1BASE64 MD5SHA1MD5BASE64 SHA1BASE64 MD5BASE64MD5RAW MD5BASE64SHA1RAW SHA1BASE64MD5RAW SHA1BASE64SHA1RAW MD5BASE64SHA1RAWMD5 MD5BASE64MD5RAWSHA1 MD5BASE64MD5RAWMD5 MD5BASE64MD5RAWMD5MD5 MD5BASE64SHA1RAWBASE64SHA1RAW MD5SHA1UC MD5SHA1UCMD5 MD5SHA1UCMD5UC SHA1SHA1u32 MD5SHA1u32 SHA256SHA1 MD5BASE64revMD5 MD5revMD5 MD5revMD5MD5 MD5BASE64MD5MD5 MD5SQL5-40 SHA1SQL5-40 MD5revSHA1 SQL5 MD5MD5UC RADMIN2 MD5RADMIN2 MD5RADMIN2SHA1 RADMIN2MD5 RADMIN2MD5MD5 RADMIN2MD5UC RADMIN2MD5SHA1 RADMIN2SHA1 RADMIN2SQL5-40 RADMIN2BASE64 RADMIN2SHA1MD5 RADMIN2SQL3 RADMIN2MD5MD5MD5 MD5RADMIN2MD5 SHA1RADMIN2 SHA1RADMIN2MD5 SHA1RADMIN2BASE64 SHA1MD5MD5 SHA1SHA1RAWMD5 SHA1MD5MD5MD5 SHA1MD5MD5SHA1MD5 SHA1MD5MD5SHA1 SHA1MD5MD5MD5SHA1 SHA1MD5MD5MD5MD5 SHA1MD5MD5MD5MD5MD5 SHA1SHA1RAWMD5MD5 SHA1SHA1RAWMD5MD5MD5 MD5SHA1SHA1MD5 MD5SHA1SHA1 MD5SQL5MD5 MD5SQL5-chop40 MD5-2xMD5 MD5-2xMD5-MD5 MD5-2xMD5-SHA1 MD5-2xMD5-MD5MD5 MD5-2xMD5-MD5MD5MD5 SHA1MD5RADMIN2 MD5-3xMD5 MD5-3xMD5-MD5 MD5-3xMD5-SHA1 MD5-3xMD5-MD5MD5 MD5-3xMD5-MD5MD5MD5 SHA1-2xSHA1 SHA1-2xSHA1-MD5 SHA1-2xSHA1-SHA1 SHA1-2xSHA1-MD5MD5 SHA1-2xSHA1-MD5MD5MD5 MD5-1xMD5SHA1 MD5-1xSHA1MD5 SHA1-1xSHA1MD5 SHA1-1xMD5SHA1 MD5-1xMD5SHA1-MD5 MD5-1xSHA1MD5-MD5 MD5-1xMD5SHA1-MD5MD5 MD5-1xSHA1MD5-MD5MD5 MD5-1xSHA1MD5pSHA1p SHA1-1xSHA1MD5pSHA1p MD5SHA1-1xSHA1MD5pSHA1p SHA1-1xSHA1psubp SHA1revp MD5revp MD5TIGER2 MD5SHA1MD5MD5 MD5SHA1MD5RADMIN2 MD5SHA1MD5MD5MD5SHA1 MD5SHA1RAW MD5SHA1MD5MD5MD5 MD5SQL5-32 MD5BASE64ROT13 MD5TIGER MD5SHA1MD5PASS MD5CAPSHA1 MD5SHA1BASE64MD5RAW MD5SHA1MD5MD5SHA1 MD5SHA1MD5UC MD5MD5HUM SHA1MD5HUM SHA1SHA1HUM MD5SHA1HUM MD5NTLM NTLM MD5MD4 MD5NTLMUC MD5SHA1RADMIN2MD5 MD5UCBASE64MD5RAW MD5UCBASE64SHA1RAW MD5SHA1MD5MD5UC MD5SHA1MD5HUM LM MD5LM MD5LMUC MD5RAWUC MD5SHA1UCu32 MD5MD5UCSHA1MD5MD5 MD5SHA256MD5 SHA1lsb32 MD5-2xMD5UC MD5-4xMD5 MD5-SHA1numSHA1 MD5-2xSHA1 SHA1-2xMD5 MD5padMD5 SHA1lsb35 MD4SQL3 SMF MD5-MD5SHA1MD5SHA1MD5SHA1p MD5MD5UCSQL3p MD5MD5UCp MD5NTLMp MD5-LMNTLM MD5-MD5psSHA1MD5psp MD5-MD5puSHA1MD5pup MD5WRLMD5 PARALLEL STREEBOG-32 STREEBOG-64 MD5SWAP MSCACHE MD5SHA1PASSMD5PASSSHA1PASS SHA512_CUSTOM1 MD5SQL3 MD5sub8-24MD5 MD5sub8-24MD5sub8-24MD5 MYSQL3 MD5revMD5SHA1 MD5SHA1BASE64SHA1MD5 SHA1-8TRACK SHA1WRL SHA1revMD5 SHA1SHA256 SHA1SHA384 SHA1SHA512 SHA1SQL3 SHA1UCWRL SHA1WRLMD5 SHA1MD5SHA1MD5SHA1MD5SHA1 WRLSHA512 MD5GOST MD5GOSTMD5 MD5GOSTMD5UC MD5WRLRAW SHA256UC MD4SHA1MD5 MD5RAWMD5RAW MD5SHA1BASE64SHA1RAW MD5revMD5SHA1SHA1 MD5MD2 MD5MD2RAW MD5BASE64SHA256RAW MD4UTF16 MD4UTF16MD5 RMD128MD4 MD5SHA0 MD5PASSSHA1MD5 MD5PASSMD5MD5PASS MD5PASSMD5MD5MD5 MD5-MD5PASSMD5 MD5PASSSHA1 MD5MD5PASSSHA1 SHA1MD5MD5SHA1MD5SHA1SHA1MD5 MD5SHA1MD5SHA1MD5SHA1MD5SHA1MD5SHA1MD5SHA1 MD5dcab MD5bcad MD5BASE64BASE64 MD5BASE64BASE64BASE64 PROGRESSENCODE 
Took 0.00 seconds to read hashes
Searching through 1 unique hashes from 218844.hash
Maximum hash chain depth is 1
Minimum hash length is 16 characters
Using 4 cores

MYSQL3x01 57b0fcbe39b9336d:dinamo

Done - 4 threads caught
1 lines processed in 0 seconds
1.00 lines per second
0.00 seconds hashing, 2,332 total hash calculations
0.88M hashes per second (approx)
1 total files
1 MYSQL3x01 hashes found
1 Total hashes found

The x01 in MYSQL3x01 means that only a single iteration of that algorithm was used.

Note that this is a very "fast" (good for the attacker) hash, and can be cracked at extremely high speeds on modern GPUs - billions of guesses per second.

Not the answer you're looking for? Browse other questions tagged or ask your own question.