2

I have mediawiki installed in my local machine. I had to use a form outside wiki which asks the user to upload files with the wiki username and password. In order to achieve this I went through the database and found in the user table a user's password: :B:4700e0cf:6f650d779329f7d4de5dffe728bf30d8 which was in the user_password column which is a tinyblob(opened the bin file got from db and got the above password). So my question is:

How do I check this with the password entered by the user in the external form?

In what form(encryption) this password is saved in the database?

|improve this question
  • 1
    Find the mediawiki login code and check what they use? – Martijn Dec 15 '14 at 10:48
  • @Martijn: I tried, but I couldn't. – arshad Dec 15 '14 at 10:50
  • @ArshadMuhammed Why not? – William Edwards Dec 15 '14 at 19:17
2

B in this password means that this encryption uses random salt, than md5(saltWithDash . md5(password)).

If you want to check user input with password from database, you need to extract salt from password and combine user password with that salt. Next, compare this two hashes, and if matches, user password is valid.

<?php

        $password = 'password'; // user input

        $storedPassword = ':B:838c83e1:e4ab7024509eef084cdabd03d8b2972c'; // password from database, password is "password" (without quotes).

        //extract salt from password
        $salt = explode(':', $storedPassword);

        // salt is stored in $salt[2], use print_r($salt) to check

        $hashUserPassword = ':B:' . $salt[2] . ':' . md5($salt[2] . '-' . md5($password));  // hashing user password in same method as wikimedia, hash will be the same as password from database

        //compare this two passwords

        if ($storedPassword === $hashUserPassword) {
            // Log user
        } else {
            // Wrong password
        }
?>
|improve this answer
  • Is the salt same for all users? I think it is not... – arshad Dec 16 '14 at 2:57
  • No,it isn't. But,registering an user is mediawiki job,so you only need to pull user info from database and compare username and password from users form with username and password from database. When you pull passwors from database,salt is part of the password and you extract it with explode(). Salt is random string,and every user have different salt for security reasons. – Aleksandar Dec 16 '14 at 3:01
  • I get it, but are you sure that the salt is not produced with something else like userid? And is this the way mediawiki check passwords? – arshad Dec 16 '14 at 3:15
  • Salt is just junk of data, and combined with real password, and hashed together will improve protection of password decryption. This is most common way. Plain password in database is worst case. Hashing password with hashing algorithms will do the job for small web sites, but wit rainbow tables it is possible to find hashed password. But,if you combine salt (random data) with password, hash will newer be the same. Than, hash user input with same salt, and if this two matches,user has provide valid password. Search on google for like 'hashing password with salt' – Aleksandar Dec 16 '14 at 3:23
  • The password id stored as BLOB. How do I retrieve the hashed password from the blob? – arshad Dec 16 '14 at 3:57
2

Hope this helps someone: This is how mediawiki saves the user password in the database.

Please see @Aleksander's answer for more details.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.