Find the code to learn what's happening here. Somewhere in there, the passwords are undergoing a cryptographic operation. Your absolute best bet is to get a copy of the code that is used to store the passwords.
#Text encoding detector password
There is no way with a salted password to get the original value. In that case, trying to "decrypt" the data won't work - you need to match passwords by using the same hash and/or salt value that was used originally. You may be dealing with a hash or a salted hash, rather than encryption. The "=" on the end would definitely be padding, so don't include that in any decryption attempts. From your example, I'm doubtful since the string you reference is so short that it looks like it's just the encrypted text. It depends upon the format - some protocols for storing encrypted text have a cleartext portion that defines how it's encrypted. If its 16 bytes you have MD5, 20 bytes means SHA-1, 24 bytes means DES or 3DES, 32 bytes means AES. Just put in a 17 character password and look at the length. If you have the ability to put in a password and observe the output this can be determined very quickly. Since the output will always be a multiple of the underlying block size the presence of a block that is not evenly divisible by 16 bytes would mean that it cant be AES and therefore must be DES or 3DES. If not all blocks are the same length then you aren't looking at a hashing algorithm, but an encryption one.
Are all cipher texts the same length, even for different input lengths?.The next thing we need to do is to look at other blocks of cipher text to figure out the answer to the following question: We can compare this to the block size of commonly used schemes and figure out what it can't be. This means that this block includes one useful piece of information, namely that the output is 16 bytes long. The fact that it is base 64 encoded doesn't tell us much because base 64 is not an encryption/hashing algorithm it is a way to encode binary data into text. What you have posted is 16 bytes (128 bits) of base 64 encoded data. Is the password length limited ? Namely, if you set a 40-character password and cannot successfully authenticate by typing only the first 39 characters, then this means that all characters are important, and this implies that this really is password hashing, not encryption (the stored value is used to verify a password, but the password cannot be recovered from the stored value alone).You may want to try to compute MD5("username:password") or other similar variants, to see if you get a match. Assuming that the value is deterministic from the password for a given user, if two users choose the same password, does it result in the same stored value ? If no, then the user name is probably part of the computation.If the same user "changes" his password but reuses the same, does the stored value changes ? If yes, then part of the value is probably a randomized "salt" or IV (assuming symmetric encryption).
So reverse engineering is the "way to go".īarring reverse engineering, you can make a few experiments to try to make educated guesses: Application code is incarnated in a tangible, fat way (executable files on a server, source code somewhere.) which is not, and cannot be, as much protected as a secret key can. The "normal" way to know that is to look at the application code. not really an "encrypted" password, rather a "hashed" password) then this is probably the result of a hash function computed over the password the one classical hash function with a 128-bit output is MD5.
#Text encoding detector verification
If this is a value stored for password verification (i.e. Your example string ( WeJcFMQ/8+8QJ/w0hHh+0g=) is Base64 encoding for a sequence of 16 bytes, which do not look like meaningful ASCII or UTF-8.
0 kommentar(er)
