2

I have mediawiki installed in my local machine. I had to use a form outside wiki which asks the user to upload files with the wiki username and password. In order to achieve this I went through the database and found in the user table a user's password: :B:4700e0cf:6f650d779329f7d4de5dffe728bf30d8 which was in the user_password column which is a tinyblob(opened the bin file got from db and got the above password). So my question is:

How do I check this with the password entered by the user in the external form?

In what form(encryption) this password is saved in the database?

3
  • 1
    Find the mediawiki login code and check what they use?
    – Martijn
    Dec 15, 2014 at 10:48
  • @Martijn: I tried, but I couldn't.
    – arshad
    Dec 15, 2014 at 10:50
  • @ArshadMuhammed Why not?
    – William
    Dec 15, 2014 at 19:17

2 Answers 2

2

B in this password means that this encryption uses random salt, than md5(saltWithDash . md5(password)).

If you want to check user input with password from database, you need to extract salt from password and combine user password with that salt. Next, compare this two hashes, and if matches, user password is valid.

<?php

        $password = 'password'; // user input

        $storedPassword = ':B:838c83e1:e4ab7024509eef084cdabd03d8b2972c'; // password from database, password is "password" (without quotes).

        //extract salt from password
        $salt = explode(':', $storedPassword);

        // salt is stored in $salt[2], use print_r($salt) to check

        $hashUserPassword = ':B:' . $salt[2] . ':' . md5($salt[2] . '-' . md5($password));  // hashing user password in same method as wikimedia, hash will be the same as password from database

        //compare this two passwords

        if ($storedPassword === $hashUserPassword) {
            // Log user
        } else {
            // Wrong password
        }
?>
6
  • Is the salt same for all users? I think it is not...
    – arshad
    Dec 16, 2014 at 2:57
  • No,it isn't. But,registering an user is mediawiki job,so you only need to pull user info from database and compare username and password from users form with username and password from database. When you pull passwors from database,salt is part of the password and you extract it with explode(). Salt is random string,and every user have different salt for security reasons.
    – Aleksandar
    Dec 16, 2014 at 3:01
  • I get it, but are you sure that the salt is not produced with something else like userid? And is this the way mediawiki check passwords?
    – arshad
    Dec 16, 2014 at 3:15
  • Salt is just junk of data, and combined with real password, and hashed together will improve protection of password decryption. This is most common way. Plain password in database is worst case. Hashing password with hashing algorithms will do the job for small web sites, but wit rainbow tables it is possible to find hashed password. But,if you combine salt (random data) with password, hash will newer be the same. Than, hash user input with same salt, and if this two matches,user has provide valid password. Search on google for like 'hashing password with salt'
    – Aleksandar
    Dec 16, 2014 at 3:23
  • The password id stored as BLOB. How do I retrieve the hashed password from the blob?
    – arshad
    Dec 16, 2014 at 3:57
2

Hope this helps someone: This is how mediawiki saves the user password in the database.

Please see @Aleksander's answer for more details.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.