2

First of all i'm not asking what is a hash, or something else. I will try to explain what i'm searching clearly:

Let's say I have a dump of a database, all the passwords of this database are hashed, the passwords are 40 bytes long, so the used algorithm is based on sha-1. However, I also know that there is a salt (sha1($pass.$salt)) or sha1($salt.$pass). I'm able to register on the targeted website with a username and a password of my choice. Once it's done, I'm able to see what is my hashed password, and its plain text value (for example, if I register on the website with the password "123") and if I then dump the database to check the hash of my password (so in my case 123) I will have its hashed value. But I don't have the salt. Based on what I have, can I guess/brute force the salt used, which is fixed in the targeted application code (I can't see it).

Improve this question
4
  • 1
    So, you want to brute force the salt from a known plaintext and known hash.
    – schroeder ♦
    Aug 3, 2015 at 1:17
  • A lot of databases also store the salt, but I don't think that fact affects your question.
    – schroeder ♦
    Aug 3, 2015 at 1:18
  • In fact this is not my case.. I also didn't say that, the salt was fixed for EACH users, it's not a salt for one user. I'm a bit confused about bruteforcing. Nonetheless thank you for your replies
    – marc Khayle
    Aug 3, 2015 at 1:27
  • FYI: A salt used for every hash is sometimes called a "pepper".
    – schroeder ♦
    Aug 3, 2015 at 1:30

1 Answer 1

Reset to default
2

How good are your programming skills?

It would not be too difficult to write a program or script that loops over all possible salt strings, take your password "123"and try sha1($pass.$salt) and sha1($salt.$pass). If the hash that comes out matches the one in the database, then you've found your salt.

One possible problem is knowing exactly which hash function they used. You said

they used algorithm based on sha-1

Do you know exactly what that is, or are you going to have to guess? It's common for a password hasher to take in the password and run sha-1 not once, but 100, or 1,000, or 10,000, or 100,000... times over before putting the hash in the database. Without knowing exactly how they have done the hashing, you will have to many many more combinations in your program, and it could take a very long time to run.

Improve this answer
2
  • All the doubts are cleared, I can make this kind of program, I was just a bit confused, now i understand more
    – marc Khayle
    Aug 3, 2015 at 1:54
  • Good luck! One warning: that program may take a long time to run, like weeks or months.
    – Mike Ounsworth
    Aug 3, 2015 at 2:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .