Is there any way to log in with a hash?

Question

I've understood that the following steps are taken when I log in to a site: 1. My password is hashed 2. The hash is compared to what's stored in the database. 3. If the hashes are equal, I can log in.

I'm also quite certain that if attackers gain access to the password database, they can use brute force to find the clear-text passwords if the hashing algorithm is weak enough.

My question is, is there any way for an attacker to bypass step 1 above? I.e. if he/she has gained access to a list of hashed passwords, can the hacker present that hash to the server, thus circumventing the hashing step?

Answer 1

This is generally called 'Pass-the-hash' attack.

If authenticating party performs hashing itself and sends hash over the wire then system is likely susceptible to this attack.

Most web applications don't do this though. They instead send the password and server does hashing, so there's no way to send hash directly.

Answer 2

If a user logs into a system that forces his/her password to go through a hashing algorithm, then you'd need the cleartext password. Since you can't avoid the hashing step - you can't choose what steps are done and which aren't done.

The (very simplified) web application does a:

$user = lookup_user_in_db($username, md5($password));
if($user != NULL){
  // do other stuff
}

The value you submit will always go through the md5() hashing function, there's no way around that - unless you find a bug in the web app where there's a page that access the hashes rather than the password (for example: when client hashing is done).

Having said that, if the hashing algorithm is broken, or can be reversed - you would be able to "derive" the clear text value from the hash, but this is unlikely if industry standards are used.