0

I've understood that the following steps are taken when I log in to a site: 1. My password is hashed 2. The hash is compared to what's stored in the database. 3. If the hashes are equal, I can log in.

I'm also quite certain that if attackers gain access to the password database, they can use brute force to find the clear-text passwords if the hashing algorithm is weak enough.

My question is, is there any way for an attacker to bypass step 1 above? I.e. if he/she has gained access to a list of hashed passwords, can the hacker present that hash to the server, thus circumventing the hashing step?

  • basically can't. Since password will be hashed by a function. Hash will be rehash. If attacker can inject password at some point after hash function, you should worry. – user827918 Jul 16 '14 at 6:26
  • "I'm also quite certain that if attackers gain access to the password database, they can use brute force to find the clear-text passwords if the hashing algorithm is weak enough" true - and even if it is not weak they can use rainbow tables and find most of the passwords. There is a solution for this and that is the use of salt when hashing. – aviv Jul 16 '14 at 7:57
3

This is generally called 'Pass-the-hash' attack.

If authenticating party performs hashing itself and sends hash over the wire then system is likely susceptible to this attack.

Most web applications don't do this though. They instead send the password and server does hashing, so there's no way to send hash directly.

1

If a user logs into a system that forces his/her password to go through a hashing algorithm, then you'd need the cleartext password. Since you can't avoid the hashing step - you can't choose what steps are done and which aren't done.

The (very simplified) web application does a:

$user = lookup_user_in_db($username, md5($password));
if($user != NULL){
  // do other stuff
}

The value you submit will always go through the md5() hashing function, there's no way around that - unless you find a bug in the web app where there's a page that access the hashes rather than the password (for example: when client hashing is done).

Having said that, if the hashing algorithm is broken, or can be reversed - you would be able to "derive" the clear text value from the hash, but this is unlikely if industry standards are used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.