[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 30 Sep 2012 00:07:02 -0700 (PDT)
From: NeonFlash <psykosonik_frequenz@...oo.com>
To: "john-users@...ts.openwall.com" <john-users@...ts.openwall.com>
Subject: WebEdition CMS
Hi,
Sorry for the previous incomplete message.
Hi,
I noticed that there is no implementation of a hashing algorithm used in
WebEdition CMS yet. You can download the sourcecode from here:
http://www.webedition.org/de/webedition-cms/
This CMS is often used by German Websites. There are 2 options available to download and install this CMS. In order to study the source code, you can go for the Manual Installation option here:
http://sourceforge.net/projects/webedition/files/webEdition/6.2.1.0/webEdition_6210.tar.gz/download
I studied the source code, and after sometime I was able to figure out that the file, we_session.inc.php in the path:
/we/include/ has the information specific to the hashing algorithm.
On line 43 of the code we have,
$useSalt = $DB_WE->f("UseSalt");
$salted = md5($_POST["password"] . md5($_POST["username"]));
So, the hashing algorithm works as follows:
Based on the value of the useSalt field in database, it will decide whether to use the salted version of password or not.
The salted version will use the username as a salt. The algorithm becomes:
md5($p,md5($s))
Currently in JtR, the closest match I was able to find for this algorithm type is: dynamic_9
./john --subformat=LIST
Format = dynamic_9 type = dynamic_9: md5($s.md5($p))
However, the salt and usernames are reversed. Would it be possible to implement it?
Or, if we can make necessary changes to the existing configuration to add this mode, please help me understand how to do it.
Thanks :)
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
