i tryed a Bruforce Script with
for($i=0;$istore into http://www.tools-blog.de/
therefore i wrote a md5 hash generator
i check -> if md5 Hash exissts return false
$hit[] = check Response;
}

but there are no equal hashes

thx for this arcticle

In the example given, wouldn’t it be possible, to do a bruteforce easily as well, if i get hold of the function???
e.g.
[PHP]
function bruteforce() {creates different possible passwords
from either dictonary, or systamatic approach, e.g.
return ‘HelloKitty’;}

//then i do:
$numberOFtrys=100000000000000;
whilte ($i<$numberOFtrys){
$test=bruteforce();
if (saltPlease($test) == $HASHfromYOURdb){
echo $test." is the password";
exit;
}
}
[/PHP]

So as far as I understand this issue, salt (and pepper) make a password safer, as long as "just" the database has been accessed by the attacker, but as soon as he gets hold of the function used, as well, it doesnt matter how complex the encoding algorythm is, right?

Or am I completly wrong on this, then please correct me!

kind regards

yours has the advantage though that the algorithm has 16 permutations (but to be honest it will almost always evaluate to 1, you needed substr(-1,1) to get the last digit…you got the first digit which almost never changes) but if you know the method you can derive the pass.

$pass = escape_etc ( $_POSt['passowrd''] );

$user = new User;
$user->create = time();
$user->email = ‘mail@mail.com’;
switch( substr( $user->created,0,1 ) ) {
case 1:
$user->pass = md5(‘your’ , $pass . $user->created . ‘mother’);
break;
case 2:
$user->pass = md5($pass . substr( $user->created, 0, 5) . ‘smells’);
break;
case …
}
$user->save();