2

First of all i'm not asking what is a hash, or something else. I will try to explain what i'm searching clearly:

Let's say I have a dump of a database, all the passwords of this database are hashed, the passwords are 40 bytes long, so the used algorithm is based on sha-1. However, I also know that there is a salt (sha1($pass.$salt)) or sha1($salt.$pass). I'm able to register on the targeted website with a username and a password of my choice. Once it's done, I'm able to see what is my hashed password, and its plain text value (for example, if I register on the website with the password "123") and if I then dump the database to check the hash of my password (so in my case 123) I will have its hashed value. But I don't have the salt. Based on what I have, can I guess/brute force the salt used, which is fixed in the targeted application code (I can't see it).

  • 1
    So, you want to brute force the salt from a known plaintext and known hash. – schroeder Aug 3 '15 at 1:17
  • A lot of databases also store the salt, but I don't think that fact affects your question. – schroeder Aug 3 '15 at 1:18
  • In fact this is not my case.. I also didn't say that, the salt was fixed for EACH users, it's not a salt for one user. I'm a bit confused about bruteforcing. Nonetheless thank you for your replies – marc Khayle Aug 3 '15 at 1:27
  • FYI: A salt used for every hash is sometimes called a "pepper". – schroeder Aug 3 '15 at 1:30
2

How good are your programming skills?

It would not be too difficult to write a program or script that loops over all possible salt strings, take your password "123"and try sha1($pass.$salt) and sha1($salt.$pass). If the hash that comes out matches the one in the database, then you've found your salt.

One possible problem is knowing exactly which hash function they used. You said

they used algorithm based on sha-1

Do you know exactly what that is, or are you going to have to guess? It's common for a password hasher to take in the password and run sha-1 not once, but 100, or 1,000, or 10,000, or 100,000... times over before putting the hash in the database. Without knowing exactly how they have done the hashing, you will have to many many more combinations in your program, and it could take a very long time to run.

  • All the doubts are cleared, I can make this kind of program, I was just a bit confused, now i understand more – marc Khayle Aug 3 '15 at 1:54
  • Good luck! One warning: that program may take a long time to run, like weeks or months. – Mike Ounsworth Aug 3 '15 at 2:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.