Security Basics mailing list archives
Re: Determine Salt used by MySQL in root'd server
From: "Valin, Christian" <christian.valin () ncogroup com>
Date: Mon, 13 Jun 2011 07:41:13 -0400
Your answer is Crypto-analysis step 1: You must use known values. But if you already have root access to a server for pen-testing, why are you focusing on the strength of password hashing if you suspect they are also salted? I'd highly recommend you focus on actual vulnerability assessment so that you can recommend a strategy to minimize the risk - either by applying patching or some other compensating control. On 6/13/11 2:47 AM, "Voulnet" <voulnet () gmail com> wrote:
Hello folks, I'm doing a pentest on a server, and I got root access through a Joomla web app, I got a dump of the jp_users table in MySQL, however the passwords are obviously hashed and salted. I honestly don't expect the passwords to be strong, so they can be bruteforced, md5-looked up easily. However, how can I determine the salt value? I already have root access on the server but I don't know where to look in MySQL to find the salt value. ------------------------------------------------------------------------ Securing Apache Web Server with thawte Digital Certificate In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates. http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1 ------------------------------------------------------------------------
------------------------------------------------------------------------ Securing Apache Web Server with thawte Digital Certificate In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates. http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1 ------------------------------------------------------------------------
Current thread:
- Determine Salt used by MySQL in root'd server Voulnet (Jun 13)
- Re: Determine Salt used by MySQL in root'd server Valin, Christian (Jun 13)