+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: PHPBB3 Password Storing (/showthread.php?tid=5227994)
PHPBB3 Password Storing - Mcclures - Apr 5, 2016
Ive been reading into phpbb hash password storing, and hashcat couldnt decrypt it even with a 3gb wordlist.
I was wondering, Could i edit the login.php and change it so it saves Username and Password into a text file on my forum?
There are a lot of people, especially spammers, that i want to hack.
INCLUDING an person who stole 40Euro from my paypal, (He has an account on my forum, and he told me he uses the same password for everything)
If this is impossible, I was hoping to change the hash with an account that i have, would there be any way to get the password that way?
Thanks in advance.
* - Sheeple - Apr 5, 2016
You can't change the hash from a different account;however, you may post the hash in the Hashing and Ciphers sub-section under the Encryption,Decryption section and I, and the other members would love to attempt to crack this hash for you.
Or you could PM me the hash and I'll run it for a bit.
Edit: Well actually if you're an admin on the forum, maybe you can do something to find the plaintext, but I do not know of a way to help other than to crack the hash.
* - Mcclures - Apr 5, 2016
(Apr 5, 2016 04:48 PM)Sheeple Wrote: You can't change the hash from a different account;however, you may post the hash in the Hashing and Ciphers sub-section under the Encryption,Decryption section and I, and the other members would love to attempt to crack this hash for you.
Or you could PM me the hash and I'll run it for a bit.
Edit: Well actually if you're an admin on the forum, maybe you can do something to find the plaintext, but I do not know of a way to help other than to crack the hash.
In PHPMyAdmin, I can edit the hash for each user, and i can change it with another user. also, the hash i need cracking is $2y$10$Fqb.1tRyPAu2D4aueFR3cOrj.t68ffn/WP/g8CIDDOchgVdKRbz1K
(and i cant pm im not really into posting)
* - Sheeple - Apr 5, 2016
It's a bcrypt hash not phpbb. I won't be able to help you in regards of cracking it.
If you change the hash with another user it won't do much for you, although he may request to change his password.
Maybe at that point you can disable the hashing of passwords?
I don't know I'm not a website expert
* - Mcclures - Apr 5, 2016
Bump... I need a script to log passwords when someone logs in to my website....
* - Hooded Robin - Apr 5, 2016
change the hash in pma panel to one you know the plaintext for, login, then change it back when done
* - Mekkay - Apr 8, 2016
thank you guys I wish you continued success :)