Re: Determine Salt used by MySQL in root'd server

["Valin, Christian" <christian.valin () ncogroup com>]

Your answer is Crypto-analysis step 1:
You must use known values.

But if you already have root access to a server for pen-testing, why are you
focusing on the strength of password hashing if you suspect they are also
salted?  I'd highly recommend you focus on actual vulnerability assessment
so that you can recommend a strategy to minimize the risk - either by
applying patching or some other compensating control.


On 6/13/11 2:47 AM, "Voulnet" <voulnet () gmail com> wrote:

> Hello folks, I'm doing a pentest on a server, and I got root access
> through a Joomla web app, I got a dump of the jp_users table in MySQL,
> however the passwords are obviously hashed and salted. I honestly
> don't expect the passwords to be strong, so they can be bruteforced,
> md5-looked up easily. However, how can I determine the salt value? I
> already have root access on the server but I don't know where to look
> in MySQL to find the salt value.
>
> ------------------------------------------------------------------------
> Securing Apache Web Server with thawte Digital Certificate
> In this guide we examine the importance of Apache-SSL and who needs an SSL
> certificate.  We look at how SSL works, how it benefits your company and how
> your customers can tell if a site is secure. You will find out how to test,
> purchase, install and use a thawte Digital Certificate on your Apache web
> server. Throughout, best practices for set-up are highlighted to help you
> ensure efficient ongoing management of your encryption keys and digital
> certificates.
>
> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
> ------------------------------------------------------------------------


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------