full-disclosure - mysql password cracking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1097331081.10946.30.camel@CPE000102e82401-CM0011ae015e92>
From: ppatters at cbnco.com (ppatters)
Subject: mysql password cracking

On Fri, 2004-10-08 at 16:03, David Hane wrote:
> I'm wondering how dangerous it is to allow a user on a
> mysql db to view the grants for another user. Could
> they take the encrypted password data and possibly
> crack it? If they can, how easy is it?

I periodically export the mysql database with the encrypted user email
passwords and run it through John the Ripper, and it finds a few every
time.  So it will all depend on how good the password is.

Try it yourself with John http://www.openwall.com/passwords/unix.shtml;
it's not difficult.  If you use the big wordlists available at
http://www.openwall.com/passwords/wordlists/, you will be amazed at how
many passwords you can get.