Questions tagged [hash]

A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

88 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
180 views

How to do client + server side hashing?

I don't want the password to be sent in clear text over the internet, even when using HTTPS the server admin can read the password if they somehow cache or log post requests. Now, what I have come ...
4
votes
0answers
1k views

How exactly does “Apache Shiro's” hashing work when using a Desktop-Client

I was looking at this question How does storing hash passwords work? and every answer essentially says that Hashing is done via the server, or most of it should, as that is the safest way to do it. I ...
2
votes
0answers
72 views

Can I skip any password hashing for localhost authentication?

Setup I have several services (Postfix, Apache (PHP)) that access a PostgreSQL database on a Debian Linux 10 system. everyone is on the same host they use the loopback interface (127.0.0.1) to ...
2
votes
0answers
419 views

How does Veracrypt work?

I’m a layman in security and was trying to understand how hashes and encryption algorithms are used in Veracrypt/Truecrypt. Reading the documentation, this is what I understood (please, feel free to ...
2
votes
1answer
254 views

BIOS password hash

Is it possible to find the BIOS password hash in a BIOS dump and decrypt it? For instance, a person could use flashrom Live CD to dump the BIOS with flashrom -r but how would you find the BIOS ...
2
votes
0answers
104 views

Add additional rounds on existing SHA-512 salted hashes without knowing clear text password?

Assuming you have a salted SHA-512 password hash with 5000 rounds. For example: {CRYPT}$6$rounds=5000$6835c5dcf0bb7310$hVod/jy7uONMSa.FVpLHb/2OrWpAj3lB/....
2
votes
0answers
102 views

Extracted LM Hashes doesnt match actual password

I'm new to LM Hashing and Windows authentication, and I'm having problems with LM hashes. I've created 2 accounts with the password "123", and both of them have different hashes, and none of the ...
2
votes
0answers
112 views

Strategy regarding an (almost always) offline app

I'm currently in internship in a software/app development company, where I have to come up with an idea about how can we handle the fact that the user will mostly use an app offline. Basically, the ...
2
votes
0answers
3k views

Using PBKDF2 for hash and AES key generation implementation

I am writing a Java application that is required to locally authenticate a user with a password and then use the password to generate an AES-256 key for local file encryption/decryption. I understand ...
2
votes
0answers
415 views

OAuth2 password analog (private, unique, & static) – Encryption

I’m making a webapp which encrypts each user’s data, using AES-256, with a unique key for each account. I’m thinking about adding external signon via the “Sign in with Google” scheme. However, I’ve ...
2
votes
3answers
423 views

Secure preshared key 2 way authentication

I have the following setup: A server and a client will be connected over tcp. The server and client both have access to the preshared secret key. When the client connects to the server, the client and ...
2
votes
0answers
466 views

Mimikatz hash dump of logged-off users

If I want to dump hashes of domain users on my computer, do they have to be logged on, or can I dump hashes of logged off users? When I try mimikatz in my lab, I can only get dumps from others users ...
2
votes
0answers
263 views

The optimal settings of Winrtgen GUI

I'm working with Winrtgen GUI on windows, but I can't fix the right settings to create a rainbow table for a: password length=1-7 Charset=alpha numeric all space What are the ideal values to put in ...
2
votes
0answers
466 views

CMS/PKCS#7: specifying signatureAlgorithm with digest?

I'm confused about algorithm selection for Cryptographic Message Syntax (a.k.a. CMS, PKCS#7) signed objects (RFC5652 Section 5.1). The SignerInfo structure (RFC5652 Section 5.3) has two separate ...
1
vote
1answer
46 views

Use delay with a fixed total time to defend against timing attacks

Consider this common example used to demonstrate timing attacks: async def sign_in(username, password): user = await get_user_from_db(username) if user is None: return False # early return :(...
1
vote
0answers
195 views

John the Ripper doesn't crack passwords when I use wordlists

Title says it all, I can't tell if John is just crashing or "gives up" on cracking the hash. First I start off by creating an md5 hash out of a word I KNOW is on the rockyou.txt wordlist: echo -n '...
1
vote
0answers
88 views

Is multiplying hashes a valid way to ensure two sets of data are identical (but in arbitrary order)

Let's say "User A" has a set of data like below. Each entry has been hashed (sha256) to ensure integrity within a single entry. You can't modify data of a single entry without also modifying the ...
1
vote
0answers
59 views

Store passwords local with plain text access on WinPE

I have an application that needs to store Network Credentials for a Network Drive/Share on the disk. The user shouldn't need to enter the password every time. The OS is WinPE, so he cannot map the ...
1
vote
0answers
65 views

Manipulation-save logging

I have to keep a journal of all transactions that are performed in my application. Think of an invoice journal. What options do I have? E.g. an option in syslogd, or a table configuration in MySQL ...
1
vote
2answers
563 views

Are all fields of the PE certificate directory hashed during authenticode signing?

In a Windows portable executable (PE) file the certificate directory points to an offset to a WIN_CERTIFICATE structure. My understanding is that while the field is named bCertificate, it actually ...
1
vote
0answers
44 views

Rotating session names vs a static session name with a rotating validation string

I'm building my own session management library in the Go programming language and I had an interesting idea to save memory. I created something called an overseer that looks for expired and abandon ...
1
vote
0answers
45 views

Increase password iterations?

Is it possible to strengthen the macOS login password by increasing the number of sha-512 iterations?
1
vote
0answers
98 views

How do I examine a fresh Windows 10 installation

I suspect an unauthorized modification has been applied to a fresh new installation of Win 10 x64 and/or a PC running it by a person who knows me personally with the purpose of tracking my activity ...
1
vote
0answers
132 views

Restrict Public API To Access From Single App

I have a REST api on a server and an application for android phones that mostly makes calls to that api and presents the info to the user. Because the application needs to be a quick way to lookup ...
1
vote
0answers
73 views

Re-using the hash value of password to server by malicious actor

Let's say Alice logged into https://www.facebook.com with her email and password: Email: Alice@gmail.com Password: correctHorseShoeBattery Nonce given by ...
1
vote
0answers
71 views

Get Hash from OS X-Encrypted USB Drive?

I have a personal USB that was encrypted using Disk Utility on OS X 10.11 El Capitan using AES-256 encryption. I no longer have the password, but I have a list of likely prefixes that were used, ...
1
vote
0answers
63 views

Can Hash Length Extension attacks be avoided by changing the data structure?

I read about Hash Length Extension attacks here and here. From the articles I gained that this attack relies on the data structure, in the way that the secret has to be prefixed to the data (please ...
1
vote
0answers
706 views

Different CRC32 implementations? different results?

So recently I managed to implement the Caffe-Latte attack in python. I got stuck for two weeks because the final ICV wouldn't match. After some digging around I found that airbase-ng (which already ...
1
vote
0answers
3k views

How to reasonably hash a composite key into a UUID?

The Problem In our system users are identified by a composite key. We'd like to devise a scheme to deterministically convert this composite key into a UUID. Solutions? The obvious first suggestion ...
1
vote
0answers
76 views

Detecting cloaking at the client side

According to this paper(reference: section IX), it may be possible for clients to detect cloaking. It basically says, whenever you fetch a page from a url(assumed to clicked from the search results),...
1
vote
0answers
322 views

How to cache auth credentials to speed up authentication

I'm developing some REST API that requires a HTTP basic auth to access. The APIs are written in Django, and the auth is based on Django auth middleware that is: it checks against the DB, the username ...
1
vote
0answers
268 views

Digest algorithm for the PRNG in OpenVPN

Considering the following OpenVPN (2.4) option from the manual: --prng alg [nsl] (Advanced) For PRNG (Pseudo-random number generator), use digest algorithm alg (default=sha1), and set nsl (default=16)...
1
vote
1answer
398 views

Postfix + MySQL ENCRYPT() encryption method change

I already have my mail server (postfix, courier, mysql) and roundcube as my webmail client, Encrypt() is the current password encryption function, Is there a way to change the default password ...
1
vote
0answers
295 views

Use Burp to fuzzy test the hash value (the values after the # in the URL)

I know its possible to use a tool like Burp to test Cookie/post/get values , but is it possible to use such tool to perform a brute force/dictionary attack (fuzzy test) on the values after # symbol. ...
1
vote
0answers
184 views

Can an rdiff signature of a file be made public without disclosing non-public information?

I'm building a system which involves passing around what are essentially uncompressed TARs of linux userlands including some additional private files. An original file (X) is sent to a worker, and the ...
1
vote
0answers
97 views

Using hash of root password to encrypt files/folders (Debian 8 Linux)

I have an application that requires unattended decryption of files/folders. Would it be possible to utilize the hash of the root password to prevent an attack where a malicious user changes the root ...
1
vote
0answers
575 views

HMAC Token - Check Logic

I have a situation where I need a token that provides authentication. The common HMAC procedure I found is: Get Some key using login credentials Create Message, append key and other message data (...
1
vote
0answers
53 views

Transmitted sensitive user data

At the moment, I have set up mitmproxy and can record all HTTP/HTTPS communications between the client and server. For research purposes I am looking to find a way to detect potential leakage of ...
1
vote
0answers
326 views

SHA1 and SHA256 initial digest to start from

Let's say I have: C = A + B where A and B contain strings and the plus sign means concatenation. I already hashed A with SHA1 and SHA256 and got a digests. I forget what the original A string was, but ...
1
vote
0answers
192 views

Token-based authentication for specific requirement

We have the following requirement for creating a token in .NET to be used in providing a challenge token and an actual authentication (auth) token. The auth token will then be used to authenticated ...
1
vote
0answers
1k views

Storing Social Security Numbers in a Database

I'm developing an online application that needs the user's social security number. The application won't be processed on the web server so I'll be using an asymmetric key. So a compromised web server ...
1
vote
0answers
950 views

John The Ripper and OpenCL on AMD FirePro

Trying to work with John 1.8.0 Jumbo 1 I noticed that OpenCL won't work for me. I used autoconfig (meaning configure and build with the option to enable OpenMPI) in order to build JTR for my Mac Pro. ...
1
vote
0answers
460 views

PKCS#7 signed data structure in signed PDF document

Is it mandatory to include PKCS#7 data (OID 1.2.840.113549.1.7.1) octet string into the sequence of PKCS#7 signed data? I mean if you want to sign PDF, you are basically adding PKCS#7 container ...
1
vote
0answers
2k views

Brute-Force/Dictionary attack against encypted file using PBKDF2 key derivation

I have been following this very useful post by Thomas. My use case is slightly different. I am developing a mobile application which requires some sensitive data to be stored on the device in a SQLite ...
1
vote
0answers
118 views

Does whosthere.exe of pth toolkit have to run with administrative rights?

To see the users that are connected to the machine and they're pass hashes with Whosthere.exe, do I have to run it as an administrator?
1
vote
0answers
296 views

Persistent login by hashing password hash

It seems that persistent logins are technically the same as storing a password on the client, and therefore should be avoided whenever possible. However, real life users would be unhappy with having ...
1
vote
1answer
483 views

How to crack a list of hashed passwords given their possibilities

I am trying to crack a number of passwords that have been hashed using SHA-256 using some java code. I have the hashes available and I also have the possibilities in which the password can be. Some ...
0
votes
0answers
48 views

How does JtR crack password protected documents?

I've been trying to figure this out using an encrypted zip file as an example. I am quite familiar with the idea that PBKDF2 creates a key drivered form a password and then that key is used to ...
0
votes
0answers
51 views

How does jarsigner -verify work?

Every jar file contains a MANIFEST.MF file containing a hash for every file. With jarsigner -verify you can verify a jar file, but what are the steps taken to verify a signed .class file in a jar? I ...
0
votes
1answer
49 views

John the Ripper / Hashcat rule, reject candidate if char at position X is the same as character at position Y

I'm using John to generate some word lists and I'm trying to figure out the most optimized way to do the next step. What I want to do is add ever possible 3 digit number to a set where the first digit ...