WebsitePanel is a windows hosting control panel that uses a CryptoKey to hash passwords into the databases.

We have lost WebsitePanel config file and lost CryptoKey. We have to reinstall WebsitePanel but for passwords we need old CryptoKey.

We have orginal and hashed passwords.

Is it possible to find CryptoKey from orginal and hashed password?

  • 1
    What does WebsitePanel support say? Its hard to tell without knowing how this cryptokey is used. Do you know something about that? What do you mean with "original passwords"? Passwords for website visitors or only a small team? – user10008 Sep 8 '14 at 16:28
  • @user10008 It says reset all passwords but we can't because it is about 10000 items. orginal password: normal password before hash. passwords are for users, servers, services, ... – Metalik Sep 9 '14 at 4:13

Hash functions are generally irreversible so if you expect that you can apply some "inverse hash" function on hashed passwords to gain the normal/original passwords, it is not possible.

If you want to obtain the key, possible solution is to apply a "brute force" attack (if you are not aware of brute force, it simply means applying all possible keys). You'll have to use some software for this because you can't manually try this. You need to know at least the size/length of the old CryptoKey so that you can try all possible combinations for that key size.

Another option is to analyze the available hashed passwords by applying the frequency analysis techniques or dictionary attacks. This may work if you have not added any salt to the key while taking hash.

  • Well, you could manually try brute forcing the key (and, if the op had a list of "remembered possible" passwords, that's what they would be), but it'd take a while.... – Clockwork-Muse Sep 9 '14 at 13:49

I don't know about the particular implementation of the CryptoKey in WebsitePanel, but when its properly implemented you can't use the database. The proper way to store passwords is in a salted and hashed form. However, weak passwords still can be brute-forced by the attacker. The purpose of the CryptoKey is to make brute force attacks against those weak passwords impossibly hard. However, please note that I don't know the particular details and this is only a good guess. Usually such keys are symmetric encryption keys with lengths well beyond brute force range. Therefore, without knowing much about the particular system used by WebsitePanel, I guess there is no other option than resetting the passwords.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.