0

for example, in any website (WORDPRESS or etc..) they store passwords in database, using SALT mehtod (as i know)... for example:

$P$dfwegfwegewgIT03.wewefefweg

if hacker got this password and username, can he detect a real password? shortly, if hacker knows any value in database and my FTP (but the real password is nowhere stored), can he enter the ftp?

  • Note that if he had access to the website, he could have compromised Wordpress to send him a copy of the FTP password next time you provide it (to WordPress). – Ángel Mar 12 '15 at 23:21
  • i mean, i had my FTP files(wordpress instalation) and DATABASE in an archived backup. and Hacker got that backup.. potentially, what he could have done (other than brute-force cracking of a password..)? – T.Todua Mar 13 '15 at 14:01
2

First of all: the salted hash generally contains only the password, not the username, but they are commonly nearly stored.

He will then be able to launch an offline Brute force attack, trying to find the password that generates that same hash using that same salt.

This attempt may be dictionary-based or exhaustion search-based.

Also, to be allowed access, one MUST have possession of at least 3 pieces of information:

  • Address (in this case, FTP's address)
  • Username
  • Password

If he already has the ftp address and the password, he still has to discover the username. It is possible to use the same technique to make several attempts until he finds a username that uses the known password in its credential.

The usage of SALTING only prevents other accounts with the same password from having the same hash, what would promptly alert the hacker about users sharing the same password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.