I've understood that the following steps are taken when I log in to a site: 1. My password is hashed 2. The hash is compared to what's stored in the database. 3. If the hashes are equal, I can log in.
I'm also quite certain that if attackers gain access to the password database, they can use brute force to find the clear-text passwords if the hashing algorithm is weak enough.
My question is, is there any way for an attacker to bypass step 1 above? I.e. if he/she has gained access to a list of hashed passwords, can the hacker present that hash to the server, thus circumventing the hashing step?