Waraxe IT Security Portal

syntax9 · Active user

http://www.XXXX.net/forum/privmsg.php?folder=inbox&mode=read&p=13025 :: forum_data=a:2:{s:11:\"autologinid\";s:32:\"44263345643adcdd3e2ba71.20088370\";s:6:\"userid\";i:987;}; forum_sid=cbc960460408a3a08272a8f478688421

my question is. why is it not 32 chars? rather 23 chars then period (.) then 8 chars = 31 chars not 32.

AtApi · Beginner

I have the same problem... can someone help us?
I think its a different encryption or is a MD5 hash with some salt...
Any hints?

AtApi

shai-tan · Valuable expert

lmao sounds like a proof of concept. Waraxe Released an SQL injection for phpbb 2.0.6 back in the day that didnt get the full 32 characters of the md5 from the DB... all you had to do was look at tyhe user table structure and rearrange the nulls or 0s to the right columns. Send me the link to the exploit and Ill see what I can do. Bear in mind that Im on holiday.

Shai-tan

syntax9 · Active user

Here's the new session key format:

The value is the output of the PHP uniqid() function. The prefix is the output of a mersenne twister PRNG.

This value is passed to the client, and the md5() of the clients value is stored in the sessions_keys table. The fact that it's stored in a hashed format means that a read-only database compromise will not allow an attacker to simply replay a value from the database.

If you wish to validate the users cookie, take the users stored value, run it through md5() and then validate that with the value in the database.

lld_master · Regular user

alright that explains alot.
Is there a way to convert it to MD5? without access to the DB?

syntax9 · Active user

http://md5-hash-online.waraxe.us/

lld_master · Regular user

no, thats a tool to convert a STRING to MD5...

from wat i see written above it goes likes this:

1-------------------------------------2=============3
USERS ACTUAL PASSWORD => MD5 => this form of the hash

that link poiints to a converstion between 1 and 2, I need a conversion between 2 and 3.

Unless I understood wrong....