It looks like I've found the salted hash in Blowfish format but it seems to be too short. Plus I've found 2 different versions of it.
Should I get it rather from DB by using SQL injection instead?

Last edited by bfumaster - Apr 27, 2018 - 17:40:06

dloser

Global Rank: 2

Totalscore: 747640

Posts: 441

Thanks: 501

UpVotes: 478

Registered: 17y 96d

The User is Offline

RE: Hash?
Apr 27, 2018 - 17:52:47 (8y 187d) Google/translate1Thank You!1Good Post!0Bad Post! link

How to find it is the whole challenge.

As for the two versions, obviously someone else added a user with the same name, but I'm sure you can figure out which is the right one.

bfumaster

Global Rank: 2360

Totalscore: 11058

Posts: 2

Thanks: 1

UpVotes: 1

Registered: 10y 353d

Last Seen: 1y 307d

The User is Offline

RE: Hash?
Apr 30, 2018 - 08:42:20 (8y 185d) Google/translate0Thank You!0Good Post!0Bad Post! link

I was not talking about two different users but 2 hash versions of the same user. Whatever.

Last edited by bfumaster - Apr 30, 2018 - 08:44:28

dloser

Global Rank: 2

Totalscore: 747640

Posts: 441

Thanks: 501

UpVotes: 478

Registered: 17y 96d

The User is Offline

RE: Hash?
Apr 30, 2018 - 15:07:12 (8y 184d) Google/translate0Thank You!1Good Post!0Bad Post! link

Quote from bfumaster
Apr 30, 2018 - 08:42:20

Whatever.

That's the spirit...

I've had another look an it is indeed true that in some places different hashes are shown for the same user. This is due to some Rails magic in combination with bad coding.

As far as I can tell, if you find a way to get the full hash, you'll get the right one. So no need to worry about it at this stage.

gizmore

Global Rank: 198

Totalscore: 110647

Posts: 1795

Thanks: 1390

UpVotes: 961

Registered: 18y 258d

Last Seen: 64d 15h

The User is Offline

Send EMail to gizmore

RE: Hash?
May 01, 2018 - 00:56:23 (8y 184d) Google/translate0Thank You!0Good Post!0Bad Post! link

Quote from dloser
Apr 30, 2018 - 15:07:12

Quote from bfumaster
Apr 30, 2018 - 08:42:20

Whatever.

That's the spirit...

I've had another look an it is indeed true that in some places different hashes are shown for the same user. This is due to some Rails magic in combination with bad coding.

As far as I can tell, if you find a way to get the full hash, you'll get the right one. So no need to worry about it at this stage.

Haha... "Rails magic and bad coding" does not involve @gizmore, right?
i only wrote like 5 lines for that railsbin app... Euh

Happy Hacking!

The geeks shall inherit the properties and methods of object earth.

Last edited by gizmore - May 01, 2018 - 00:57:49

zM_, silenttrack, n0tHappy, nonfungiblesecurity, quangntenemy, TheHiveMind, Z, balicocat, Ge0, arraez, jcquinterov, hophuocthinh, alfamen2, burhanudinn123, Ben_Dover, stephanduran89, braddie0, fpombal, csuquvq have subscribed to this thread and receive emails on new posts.
1 people are watching the thread at the moment.
This thread has been viewed 9775 times.