Passwords
are most often stored in their plaintext format or in their hashed
value format in a file system or in a database. If your password was
“password” and it was stored as just “password” this would be an example
of your password stored in its plaintext form. So if you could extract
the password list from your victim and the passwords were stored in
their plaintext form, then you have no need to crack anything because
you already know the passwords. Da tu du! But if you extracted the list
of passwords or dumped the database of passwords, and they were stored
in their hashed values, then it’s crackin’ time! But before we go any
further, let’s look at the basics.
What is a password hash?
A password hash is the password after it has gone through a one-way
mathematical process, or algorithm, producing a completely different
string. So let’s say your password is “
password” and you run it through the MD5 algorithm, one of the many cryptographic hash
functions out there, your final outcome will be
5f4dcc3b5aa765d61d8327deb882cf99.
There is now no possible way of changing that back to the word
“password”. The only way to reproduce that key combination is to either
know the word and run it through the same hash
function, or by trying to crack it, which is essentially the same thing.
The Login Process
Before you even go to login to one of your many password/username
protected websites, you must first create your login details. So what
happens when you create your login details and hit submit? It’s pretty
simple. Most websites run your password through a cryptographic hash
function
like the one mentioned above and then store it in a database. Here is
an example of how a PHP script would hash your password before it is
stores it in a database.
$Password = MD5($_POST[‘password’]);
In the above PHP line, the script takes the password you submitted via $_POST and runs it through the MD5() cryptographic hash
function,
which transforms the submitted password into its MD5 hash value. Then
the hash is stored in the variable $Password, which is later stored in
the database.
Now that you have your login details created, next time you go to
login, the PHP script will take the password you submitted, run it
through the hash
function,
and compare it to the hash stored in the database. If the two hashes
match, it means that the password submitted is the same password stored
in the user database, so the website will log you in. Here’s an example
in pseudo-code.
If (md5($Submitted_Password) == $Stored_Password_Hash) Then
Login()
Else
Display_Wrong_Login_Details_Message()
What is a password salt?
No, it’s not the type of salt that stings your eyes when you open them
in the ocean because you thought you saw some sort of sea creature next
to your legs and then find out it’s just a shell until you get your head
out of the water and that “shell” starts chomping on your big toe
causing you to scream like a three year old girl and splash around like a
dying fish on the shore. True story. Password salts are completely
different, even if they have the same affect on password crackers.
A password salt is a string that is added on to a user’s password
before it is encrypted. This string could be anything, the user’s
username, the exact time the user signed up, or something completely
random.
The point of a password salt is to make a password more secure by
making it much harder to crack. It does this by making the password
longer, and by making each password hash different from every other,
even if the password is the same.
For example, if the password was
“123456”, the final
hash would be MD5(“random-salt”+”123456), so even if someone else used
that same password, their salt would be different, which would result in
a different password hash. This way, if the attacker cracks a password,
he wouldn’t be able to find every other user with the same password
because their hashes would be different.
We’ll get more into salts once you learn more about password cracking.
