2

I'm currently conducting research regarding MySQL server remote authentication. I've captured unencrypted, uncompressed authentication packets between the client and the server where the username is in plain text but the password is hashed using two salts which are also visible in the "server greeting" packet sent to the client, right after TCP connection is established.

I've ran Hash-Identifier on the password hash and it says that the hash was hashed using SHA-1 or MySQL5 algorithm, however I can't crack it using MySQL5 or even with different SHA-1 variations offered by Hashcat. The password that is hashed is "password" so it shouldn't be a problem to crack utilising basic wordlists. That leaves me with the possibility that I'm using a wrong hashing algorithm in my cracking session or more likely I'm using the salts incorrectly during the session.

What am I doing wrong? Do you know what algorithm is applied for authentication between a client and MySQL server? How do I apply the salts correctly? Can you recommend a different hash cracking software that has the capability to do these?

If you want, I can send you the Wireshark session with captured packets for you to have a closer look at the salt exchange, the hash itself, or even if you want a proof that this was done in a controlled virtual environment.

Improve this question

1 Answer 1

Reset to default
1

The various authentication methods of MySQL are publicly documented in the manual:

http://dev.mysql.com/doc/internals/en/authentication-method.html

What you describe might be a method called Secure Password Authentication.

Improve this answer
1
  • I must've missed these while I was researching the problem. Thank you so much, I'll dive into these :)
    – Stefan Roman
    Jul 2, 2014 at 16:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .