How does this app "hash" their passwords with MD5, but still know the plain-text?

Question

There is a public application that has terrible security practices. When performing an API call to such application, and succesfully logging in, it will return a "user" JSON that includes the MD5 hash of their password, and the MD5 hash of their administrator's password.

The thing is, the user interface inside the application is able to show the plain-text password of every user, which leads me to believe the password is stored in plain-text or encrypted, and only MD5 hashed when returning them through the API call.

I have been performing some tests with known passwords, and they don't match the MD5 hash. Here's the thing.

When User1 sets their password as "test", the resulting MD5 is different than when the User2 sets their password as "test", meaning they are, at least, salted.

Salt is related to user data (I have tried concatenating their UserId, email, identifiers to the password before MD5 with no luck).

I know salt is related to user data because no matter how many times User1 changes their password, their hash will always be the same when the password is "test", its not a random salt generated each time.

How could I continue investigating this case? I want to know how it works internally. Test data could be shared in private.

Answer 1

There is an infinite number of ways to calculate a hash, even if the final method is MD5. It's common to have multiple hashing rounds, there might be another (hopefully much stronger, like Argon2) hashing method involved, and/or there may be a pepper.

Examples:

• MD5(salt+password)
• MD5(salt+MD5(password))
• MD5(Argon2(salt+password))
• MD5(pepper+MD5(salt+password))

Given MD5's weakness and the need for a KDF or other password-specific hash, I'd hope it's secure and just happens to look like MD5, maybe something like substr(sha256(Argon2(salt+password)), 32)

Still, if they can reference the real password, they're storing it unhashed (hopefully encrypted). This is not a good practice, but at least they're not sharing it with you directly. Given this bad practice, they're probably just doing something like MD5(salt+MD5(password)). Once an attacker breaks that scheme, they're hosed.