I have stumbled across passwords on a MySQL database behind a PHP webapp. Here are some examples.

753a524d56b48d825328ce27 789e0ad30d15 7ba0868c23e0a2 d327e265ca2abcd7c 48276b3d5618850 bffaa9b3ba92ffc3 21614da133d56e72857c 44d2059e642f97333

Apparently they are of different length each, so I would conclude that they are not hashed. Another thing that strikes me is the seeming overrepresentation of numerals. One can also observe the same symbol twice in a row fairly often. Additionaly they are mostly within the range of common password lengths.

I have tried cracking the password using auto-detection and various frameworks errored out since they could not detect the encryption method autmoatically.

Does anybody have an idea as to what encryption scheme might have been used here?

  • Why would you blindly guess what it is instead of looking at the applications source code for how it is generated and used? Aug 26 at 9:48
  • Have you tried running this thru hashid, hashidentifier and similar tools? Including online ones. Aug 26 at 11:58
  • yes, to no avail.
    – knods
    Aug 27 at 12:10


You must log in to answer this question.

Browse other questions tagged .