Encrypted password question
Clash Royale CLAN TAG#URR8PPP
Encrypted password question
I noticed in the html of my router this parameter:
form.addParameter('Password', base64encode(SHA256(Password.value)));
form.addParameter('Password', base64encode(SHA256(Password.value)));
So when I type in the password passw I get this via sslstrip:
passw
sslstrip
2018-09-25 21:13:31,605 POST Data (192.168.1.1):
Username=acc&Password=ZTQ1ZDkwOTU3ZWVjNzM4NzcyNmM2YTFiMTc0ZGE3YjU2NmEyNGZmNGNiMDYwZGNiY2RmZWJiOTMxYTkzZmZlMw%3D%3D
Is this hash easy to crack via bruteforce/dictionary? I am still a beginner, but that looks like double encryption to me.
Also, is there some faster way of getting this password than cracking it?
2 Answers
2
It's a base64 unsalted sha256 hash. It's not double encryption, but a not needed encoding.
An unsalted hash means it's trivial to just search the hash on Google and probably it will find the result.
I meant "is trivial to search", not to find the password. But to bruteforce SHA256 using any bitcoin ASIC is trivial too. A Dragonmint 16T can do 16TH/s and would bruteforce a 12 chars alphanumeric password in less than 100 hours. A 8 chars alphanumeric would fail in a tenth of a second...
– ThoriumBR
52 mins ago
Sure a Dragonmint is fast and specialized hardware. That is why using SHA256 is not secure for passwords, what is needed is a slow method such as PBKDF2, Argon2i or comparable methods, these are slow and should be used with parameters to require about 100ms or CPU time and additionally Argon2i requires substantial memory as well. Try
e88f244abd61582387cc2afc0476e112550f24395cdf338ed7ad7deace2e6ebe, it is a the SHA-256 hash of a 12 character password.– zaph
6 mins ago
e88f244abd61582387cc2afc0476e112550f24395cdf338ed7ad7deace2e6ebe
I URL decoded it, then decoded it from base64, then passed it to an online hash database.
The result was:
Hash Type Result
e45d90957eec7387726c6a1b174da7b566a24ff4cb060dcbcdfebb931a93ffe3 sha256 passw
By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.
Only trivial if the password is common.
– zaph
1 hour ago