Have a good day everybody, I'm working with SQL SERVER 2008, developing a simple login. Now I'm encrypting the password with this funtion
SUBSTRING(sys.fn_sqlvarbasetostr(HASHBYTES('MD5', #cont)),3,32)
It's work perfect, if I put pass = 123 then return 202cb962ac59075b964b07152d234b70, but I need to know how to decrypt and return again 123
I hope somebody can help me, Thanks
MD5 is a hash, its like an Identifier of a value, so it might or might not contain the actual data.
Related
Is there a feature in SQL Server that makes the values we give for "passwords" encrypted/encoded? If not, what is the simplest way to encode my passwords and store them in a table?
There is a function called PWDENCRYPT that will help you do this
I study SQLInjection testing it on one site, that use Microsoft SQL Server 2008.
sqlmap-dev$ python sqlmap.py -u "https://site?id=239" --current-user --current-db -b --users --privileges --passwords
Receive users login and hashed password:
Like this: 0x01005847e7a1ffa21b9c6811420f0e502612c8dd976f685f63a6
The question is, how I can know it?
I understand that I cannot really reverse the hashed string.
I find this: https://stackoverflow.com/a/18154134/2264941
As I understand:
0x0100 - use SHA1
5847e7a1 - salt
ffa21b9c6811420f0e502612c8dd976f685f63a6 - hashed password with salt
Is this algoritm correct for MS SQL 2008 ?
Maybe there is some online instruments that can help me?
You cannot do this. That is literally the whole point in hashing and salting... You could try a password cracker but it will take A LONG TIME.
I want to decrypt password in SQL Server 2012 using DES to send that password in the mail using a SQL Server job.
Can anyone help me?
Thanks in advance.
You shouldn't really be de-encrypting passwords. And either not send passwords thru the emails!
And no, there's usually a random salt in the encryption, so you cannot decrypt it like that. Only Brute Force, because it's weak encryption method nowadays.
For Brute Force you can use for example pwdcompare - More at MSDN pwdcompare
I start working on an old software of which I just forget the password. I go through the SQL Server 2008 database and found it is saved in the encrypted form
0xA77F9B75A183A3836540FBBE11963F771ED41BBE
there. I want to decrypt the password column and want to know the real password. So that I can access my application.
Thanks in advance
therewere no way you can decrypted, but if MD5 you could try the fallowing http://www.md5online.org/ they will cracked for you. but if you were unhappy with this answer and your programm is valuable for, try this http://www.devart.com/dbforge/sql/sqldecryptor/
i have a column of varbinary(max) type and used a salt of nvarchar(60) type that is generated randomly. I saved the salt in db and saved password using hashbyte(password+ salt).
Now I want to compare user password and authenticate him.
I tried taking his password and running this query--
SELECT [email] from admin where
[password]=HashBytes('SHA1','xxxxxx' +'/KsDnXdU+_a<t19wYCnEi/lxmXmAutR3DVA$#]~dSBskRMB?sb#41+=MFRpE')
It is not returning me email. I ran it directly on sql server management studio. But It gave me blank. Why is it so?
When im selecting by email im getting role, this means email is registered.
Is something wrong in my salt or query?
I fixed it. Actualy adding salt directly was causing me a bug, though it was getting added directly and hash was computed and no error was returned from sql server.
When i ran this query
Select role from admin where salt='/KsDnXdU+_a<t19wYCnEi/lxmXmAutR3DVA$#]~dSBskRMB?sb#41+=MFRpE'
I got no result. I realised, it was some Conversion problem. I used then Convert(nvarchar(60),'%?r>%Vb+$hUZO8}=38/_J[#q#1mf^rz!V&q~\dLH5nQ&/edR\c[6ya|q$e%r')
and ran my query as
SELECT [email] from admin where
[password]=HashBytes('SHA1', 'xxxxxx'+Convert(nvarchar(60),'%?r>%Vb+$hUZO8}=38/_J[#q#1mf^rz!V&q~\dLH5nQ&/edR\c[6ya|q$e%r'))
This returned me email. I am really not sure why this happened, but using sqlserver 2005, and above query i fixed it. I request moderators, If it is any bug in sql server 2005, please do let other know.
You need to use the same code when reading and when writing:
INSERT INTO dbo.admin (email, password, salt)
VALUES(#email,HashBytes('SHA2_512',#password+#salt),#salt);
and
SELECT email FROM dbo.admin
WHERE password = HashBytes('SHA2_512',#password+salt);
The only difference is that the select references the stored salt instead of a passed in salt.
You also should use the SHA2 algorithm as SHA1 is not secure anymore (http://www.md5decrypter.co.uk/sha1-decrypt.aspx). For SHA2_512 your column needs to be 64 bytes (http://msdn.microsoft.com/en-us/library/ms174415.aspx). You should use the specific length instead of (MAX) if possible.
As Aaron noted, SHA2 is not supported before SQL 2012. You can use a CLR implementation instead. This can get you started: http://geekswithblogs.net/hroggero/archive/2009/09/19/strong-password-hashing-with-sql-server.aspx However, it is using only 256 bits.