0

I know that a password is stored as a hash, because then it is not possible to get the password even if you have access to the password database/file/...

But if you have access, couldn't you just replace the password hash with some hash where you know the related password, for example, if you know that 1234 has the hash '...'?

2
  • 2
    Getting access to add/update/delete records in the database is usually a higher bar for the attacker than simply dumping the database.
    – mti2935
    Jul 18, 2022 at 17:47
  • 2
    What @mti2935 said, especially because there's lots of places a non-live copy of the DB might leak (backup tapes, images stored in insecure cloud storage for backup or replication, improperly-cleaned snapshots for testing purposes, etc.) but only write access to the live database is directly exploitable by inserting your own password hash.
    – CBHacking
    Jul 18, 2022 at 23:57

1 Answer 1

2

If you have write access to the hash database, you can indeed write a new hash. If you wanted to recycle another hash, you'd need to replicate the scheme and the cryptographic salt (whose primary purpose is preventing hash recycling).

Of course, if you have all of that, you could just generate the hash of whatever new password you want.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .