Cracking WordPress passwords with 20 lines of Go

Re:Cracking WordPress passwords with 20 lines of Go by SmallPeePeeMan on Saturday May 30, 2020 @10:04PM (#23366581)

Realize that the attacker must first possess the user/password database for this to work. This is because the author takes the salt from that information. Without the salt, it will take much longer to brute force... even though it’s md5 hashed.

[ Parent | on HN ]

Re:Cracking WordPress passwords with 20 lines of Go by weewee2018 on Saturday May 30, 2020 @10:29PM (#23366670)

How is he getting the salt from the database?

[ Parent | on HN ]

Re:Cracking WordPress passwords with 20 lines of Go by shoo on Saturday May 30, 2020 @10:34PM (#23366694)

this corresponds to sad scenario where the database itself is leaked and the attacker has access to it. the blog describes how the salt is stored as prefix to each hash.

[ Parent | on HN ]