select HASHBYTES('sha','what is it')
Result --0x2327A09C2FDAD132E436B5CC12E9D5D283B5BA69
is it possible to convert back hashbytes to string '0x2327A09C2FDAD132E436B5CC12E9D5D283B5BA69' as a input
want to get out put as 'what is it'?
Absolutely not. A hash is, by definition, one way.
What you're looking for is encryption, which you can do using the EncryptByCert and DecryptByCert functions, explained in detail here.
No. That's the whole point of a hash.
You use them for something like a password, such that every time someone tries to log in you compute the hash of the password they tried to log in with (plus a salt) and compare that with your stored value. This way even if someone (like a disgruntled employee) finds a backup tape for the database where your passwords are stored and an encryption key, they still wouldn't be able to log into your system and act on live data.
A hash function is defined as "one way" meaning that you convert text into a digest (the result you see above). If you are using this for password encryption the accepted usage would be to run a users input (from their password form) through the hash function and verify that it matches the stored digest.
If you wish to have decryption of a provided text input you will want to look into other cryptographic solutions such as Symmetric-key or Asymmetric-key algorithms.
Of course if you are doing any of this you are going to want to sanitize your input.
Hashing as the previous posters mentioned, is definitely a one way operation. It takes a (potentially large) input, and processes the input quickly in such a way that the output is a small but very unique (based upon input) output. Both by design and by nature of having a small sized output, a hash cannot be undone as the original input has been lost in the conversion. Common hashing algorithms include the Message Digest family (usually MD5) and the SHA family you mentioned in your question.
Again as the previous poster mentioned, if you're looking for a 2-way operation, encryption is what you are looking for. Further more, if you want the same user to both encrypt and decrypt a string, stick with symmetric encryption. Some common algorithms used in practice today are AES, DES, and Blowfish.
If you have a minimal perfect hash then at the very least you should be able to brute force the original input. But presumably this is not what you're asking about, if that is right then see all of the other answers :)
Related
I am developing a web application (a dashboard of some sort), and on some pages I have a couple of data tables. Each data table has its own page number, filter and sort. Although the data is fetched asynchronously in the background (hence the page does not need to reload), but I need to store these information (page, filter, sort) so it can be persistent for example during a page refresh. As far as I know, there are two ways to store these information:
In the session storage (local storage is not an option, because I don't want these information to be persistent between sessions)
In the query string
Up until now I used to store these information in the query string because I thought it has some advantages: e.g. the user can copy, bookmark, or share the URL with a colleague to discuss some data which they find interesting (for example on the 10th page of a table after performing some filtering and sorting). With the session storage I cannot do this
But now I am extending the abilities of the filter function, and now the information is quite long to use in the query string, and may even exceed the limit (I think 2048 characters, right?). And also there may be more than a couple of tables on each page, and therefore the query string would even become longer.
So first I wanted to know what is the best practice in this situation
And second, is that feature (being able to copy/bookmark/share the page as is) really that important, or not?
Note: please note that the information that I'm talking about is nothing secret or sensitive. It's just table page number, table filter and table sort
The 2048 limit seems that's not really an actual limit, see What is the maximum possible length of a query string?
About the best approach - I've personally always hated that most "new websites" do not support the feature you care about, so I'd personally encourage you to support it!
And finally about the exact mechanism, firstly the query string approach will keep working for a lot longer than 2048 characters, but I can see that copy&pasting it might be unwieldy and depending on the media to share the URL it can introduce mistakes.
So, from the user's perspective, I think the best experience would be given by storing those searches on the backend side and enabling a shorter URL for permalinking/sharing/bookmarking.
This new URL could be obtained by the user via a specific UI button (Share/Permalink) so you save the search in that moment and return the URL, or (best experience but harder and costlier to implement) you can be saving it continuously and sending back to the UI the generated URL and use Javascript to replace the URL for the nicer version (either always or just when people copy it).
Also consider: it may be good enough to just keep using the query string :-)
Is it safer to have the salt in the source code? If the db gets compromised with salts then everything is lost.. but if they only have hashes they can't do anything with it.. If the salt is in the source code, you could use their userid or something else? anyone know..
Definitely use new salt for each password and store them in the database alongside the passwords. Please see https://en.wikipedia.org/wiki/Salt_(cryptography)#Common_mistakes for reasons. If you want to learn more about the topic, the whole wikipedia article is a great source, followed by https://en.wikipedia.org/wiki/Rainbow_table, maybe even some generic info about hashing like https://en.wikipedia.org/wiki/Cryptographic_hash_function.
Let me first say that I'm doing nothing illegal. I'm doing this for learning purposes only. Using my own virtual network.
So I am trying to SSH into a server and say I know there is a user called urbasnlug so ssh urbanslug#ipadress but I need the root passoword.
I have a wordlist that contained only strings without alphanumeric strings. How would I use this wordlist to crack a password that has an alphanumeric password which is of mixed cases but the number in the password never goes past 100
Say the wordlist had the strings:
pass
word
How could I use these list to crack a password such as PaSSword99.
Maybe in ways other than with the use of word lists.
If you can't help me at least tell me why you can't.
I can write a C or Python module to do this but I know that there has to be something out there that already exists.
So you have two things to achieve here. The first is generating the set of passwords you wish to try. The second is throwing that list of passwords against your server.
The first problem is a classic use case of John The Ripper, you can have it read in your wordlist, apply some mangling rules (such as appending 0-99 to each word, permuting cases etc), and output a final, complete password list.
The second problem is quite easy to solve once you have the password list. You could just loop over the passwords in bash, but if you're really lazy, Metasploit has an SSH scanner that reads a password list for you.
Of course, breaking this down into two stages means you are storing the huge password list as a file. In general you would be more likely to pipe the output from John The Ripper to your SSH scanner, rather than using an intermediate file.
First off it will be difficult to get the root password if you are only logged in as a normal user. However, there are different ways of getting 'root' which I believe go beyond the scope of this forum.
Nonetheless, I don't get the correlation of where you wordlist comes to play if already know the characters present in the root password;which would mean you have the root password anyway.
Try and use Hashcat to try and retrieve password. You however need a wordlist eg rockyou.txt or any of those available in the OpenWall site (makers of John the Ripper, which is another tool which is only as good as your wordlist.
i think it will be easier (faster?) to get root via a local exploit, read /etc/shadows and crack that password
In my program, I have a simple login prompt so that only certain users may enter a program, as well as make the program function differently depending on the user. What I would like to do is have the information for the user login information (username, password, etc.) securely stored without going through an online database. I know that using a text file to store this information is a very bad idea, and I'm sure there is an easier way to do this than to make an array of this login information internally inside my program. Could you all give me some suggestions of a way to do this?
Hashes are what you need. Paste a hash-making function into your code, MD5 functions are available online for all major platforms. Then store your pairs of hashes in your config file. Devise a clever way to combine a password with your admittance options into another hash so that the file is edit-proof. This way, you can distribute the account configuration and if you don't make a trivial cryptographic mistake, it will work just as you want.
Example of the config file line (hashes truncated to 6 chars for clarity):
1a2b3c print;search;evaluate 4d5e6f
Here, 1a2b3c is obtained as MD5(username.Text+verysecret), the verbs are the account's rights and 4d5e6f is obtained as MD5(line[1]+verysecret+password.Text) where line[1] is the split result of the config line where the verbs are stored and the rest is the user's password.
Note how the password gets automatically salted by the verbs and how the verbs are protected against editing because that would invalidate the password hash. The verysecret constant is something hidden in your executable code that will prevent anybody from computing the hashes and unlocking the program.
Hashing is not an asymmetric cipher or key pair; a motivated attacker can crack your program to bypass protection altogether anyway, so going to further lengths is useless.
If you are cheap to find an asymmetric scheme, but cunning enough, you can change a few initialization constants in that MD5 function. This will make the cracking of your code harder, especially against the making of a counterfeit account file.
EDIT: When authenticating, don't just if(hashfromconfig == computedhash)... Script kiddies know how to hook into the string comparison function. Write if(MD5(hashfromconfig) == MD5(computedhash))... instead... Then the string comparison will work just as before, only it will not see your precious key hash that goes into a wannabe-counterfeit file. Ideally, have several versions of the MD5 function scattered across your code and named differently. Use if(foo(hashfromconfig) == bar(computedhash))... for a nice effect.
"without going through an online database." - do you mean on the client side?
"securely stored" and "client side" are pretty much mutually exclusive terms in this scenario.
There is absolutely no way to securely store data without touching online (server-side) source of some kind. If you are touching server-side source, it might as well be a DB.
i developed a very simple vb.net application and i need a way for every user to verify that they have paid for it. i would like the simplest method possible. it will be an off-line registration. I am actually looking for a way that I can program this easily myself, and am not interested in third part solutions.
Just ask for the name, and calculate a hash (such as SHA1 or MD5) for that name (maybe lowercase and strip whitespace first), prefixed with some secret text that is hardcoded in your program. If you want different keys for different versions, then also prefix the version number before calculating the hash. That hash will be your registration key (or, if you think it is too long: take the first characters of the hash).
Have the user enter both the name and the registration key, and store those in the program's configuration. Then recalculate the hash in exactly the same way whenever you need to validate it, and compare it to the stored key.
You could store an encrypted string in the user's registry (e.g. his Full name). Decrypt that string at application start to check if the license is valid.
How secure do you want it to be?
If you're looking for rock-solid piracy protection (if it even exists) you'll have to combine it with some sort of online registration/activation system. Or use a 3rd party solution as opted by Mitch Wheat.