Hot answers tagged

8

Bruteforce hashes You could bruteforce the hash that is stored in the database. WordPress uses phpass for hashing. Per default, WordPress does not use blowfish or similar, but just md5 with an iteration count of 8192. If you just want to find really bad passwords, bruteforcing is certainly feasible. But I would consider this a rather big violation of ...


4

I'm not sure that this is even possible. When you select your password, it's stored hashed in database. There's no reverse enginering when comes to hash algorithms. In my experience, script for password strenght is located in www.example.com/wp-admin/js/password-strength-meter.js, and this is the link to it. You can change levels and percentage for ...


3

The good news are that you can change users passwords, the bad news are that you cannot see them.Wordpress is so powerfull that even in the database it stores the password with one way encryption it's not just an md5 hash you can convert, it's not even serialized data, for the password test123 you would get something like $P$BjW8o9Dm1vC5bwAcP1iAdNVm0lbvn, ...


3

As the passwords are hashed, the only way to test their security is to brute force them. Gather a list of commonly used, weak passwords and test them against the hashes stored in your database. Unless you use a very exhaustive password list this won't catch all of the weak passwords, but it will filter out the weakest of them.


2

To reclaim a Google Analytics account after the administrator has left / forgotten credentials: Find out your Google Analytics ID (You can find this by looking at your page source code, it will look like UA-xxxxxxxx-x) Sign into, or sign up for, Google Adwords Head to the Google Adwords Help center, you'll see a 'Contact Us' button - click this Choose the ...


1

As previous answers have pointed out: you cannot read the stored passwords. An alternative solution could be: Implement the suggestion by Josip Ivic to enforce strong passwords. Delete all passwords (or only passwords for users with certain privileges). And finally, inform the affected users that a new password policy is in effect and direct them ...


1

You can't forcefully to change wp admin password, unless you have no control in each wordpress database, which is stored in phpmyadmin. And no, there is no any quick way to find out week password on 500 wordpress site. Josip mention one link to checkout password strength, but that site did not using md5 crypto algo to checkout password strength. ...


1

WordPress passwords are hashed, like any sensible application would when it comes to storing passwords because storing clear text passwords is very insecure since your users might have the same password for other services they use (think gmail?). Its not possible to convert the hash back to the password, else one might as well store them in clear text. ...


1

Try to brute-force it using a dictionary attack What a better way to assess the strength of you password? :-) Yes I know, it'll take some time... Otherwise, you could simply assume all the passwords are weak (I'd say that's gonna be a very accurate assumption) and create yourself the passwords, store the hashes in the database and give the plain text ...


1

This is a common issue with most scripting and/or framework because the ampersand (&) references a variable in the source code. Similar unsupported characters may also include brackets ( [ ] ) or angle brackets ( < > ).


1

Can you perform a query? UPDATE the_table SET password='UserNeedsToResetPassword'; Now all users' passwords dont work anymore. I choose plain text, because I cant think of a way that sha1($_POST['pass']) results in this ;) (or whatever hash you use)


1

You can force a password change by running UPDATE user SET user_password_expires = '19990101000000'; (This is not the same as a password reset as it will accept the old password one time. Less secure, more forgiving.) If you cannot be bothered to look up the DB password, you can just use maintenance/sql.php.


1

Your site is hacked. There's some security breach on your web. There are a lot of thing that you can do, but first things that you should do: You should get the backup up (both web and database) and then fix / upgrade everything and change passwords. Scan the site for suspicious code, and remove unresponsive / unnecessary plugins or modules.



Only top voted, non community-wiki answers of a minimum length are eligible