XenForo Password Encryption
- Thread starter ZoomZaa
- Start date
This should help:
http://xenforo.com/community/threads/password-formula.32191/#post-367845
sha1(sha1(password) . salt)
or:
sha256(sha256(password) . salt)
http://xenforo.com/community/threads/password-formula.32191/#post-367845
sha1(sha1(password) . salt)
or:
sha256(sha256(password) . salt)
I used:
sha1(sha1($password) . salt)
Was this correct?
They're running on the same server.
The error was an Internal error. Seemed like the server could not define SHA256. So, the stored passwords should be SHA1-encrypted, shouldn't they?
Yep, that's correct. I'm not sure why it wouldn't return the same string unless something is wrong in the password and/or salt.
You should create a test account, grab the hash from the database, grab the salt and create a script to see if the hash is correct.
We'd probably need to see your code to be able to debug it effectively.
At the moment we can only see one half of the equation, e.g. the actual formula XenForo uses. The part we can't see, e.g. your script might be the part that leads us to the solution.
At the moment we can only see one half of the equation, e.g. the actual formula XenForo uses. The part we can't see, e.g. your script might be the part that leads us to the solution.
Thanks for your support.
Here is my script:
Code:
<?php
$username = $_POST['username'];
$password = $_POST['password'];
$password = sha1(sha1($password) . salt);
$con = mysql_connect("localhost","*****","*****");
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
mysql_select_db("mcsmilew_forum",$con);
$idsearch = mysql_query("SELECT user_id FROM xf_user WHERE username = '$username'");
while ($row = mysql_fetch_assoc($idsearch)) {
$user_id = $row['user_id'];
$authenticate = mysql_query("SELECT remember_key FROM xf_user_authenticate WHERE user_id = '$user_id'");
while ($row = mysql_fetch_assoc($authenticate)) {
$forumpassword = $row['remember_key'];
}
if($password == $forumpassword){
echo "Password Correct";
}
else{
echo "Password Incorrect<br>";
}
}
?>I'm still new in PHP, I'd love to hear your advice too.
I'm relatively new to PHP also, and the only PHP experience I have is ALL XenForo.
I've just figured out this little script that may help...
Because I always think in XenForo, I literally do nothing unless it involves XenForo. So the following does what you want, but entirely using XenForo functions and classes. You should be able to call these from your script.
So, talking through it.
The first 10 lines (before $username) basically load XenForo's classes.
You need to specify the full server path to Autoloader.php, in my case my PasswordCheck.php is in the XenForo root so the __FILE__ parameter is sufficient.
I then set the username and password (obviously this can be retrieved from $_POST parameters instead).
I then get the database. This handles all of the database authentication and everything.
Big difference between my code and your code is I'm selecting 'data' from xf_user_authenticate NOT the remember_key. I'm not sure what the remember_key is, but it's something different. I believe data essentially contains your password hash and salt amongst other things in a serialised array.
Now I've got that, I create the default XenForo authentication object and set the data I retrieved from the database.
I can then make a call to the authenticate function and pass in my username and password.
The response will either be true or false. I have dumped the response using Zend_Debug::dump($check)
I've just figured out this little script that may help...
Because I always think in XenForo, I literally do nothing unless it involves XenForo. So the following does what you want, but entirely using XenForo functions and classes. You should be able to call these from your script.
PHP:
<?php
$startTime = microtime(true);
$fileDir = dirname(__FILE__);
require($fileDir . '/library/XenForo/Autoloader.php');
XenForo_Autoloader::getInstance()->setupAutoloader($fileDir . '/library');
XenForo_Application::initialize($fileDir . '/library', $fileDir);
XenForo_Application::set('page_start_time', $startTime);
$username = 'Kier';
$password = 'KiersPassword';
$db = XenForo_Application::getDb();
$data = $db->fetchOne('
SELECT
auth.data
FROM xf_user_authenticate AS auth
INNER JOIN xf_user AS user ON
(user.user_id = auth.user_id)
WHERE user.username = ?
', $username);
$auth = XenForo_Authentication_Abstract::createDefault();
$auth->setData($data);
$check = $auth->authenticate($username, $password);
Zend_Debug::dump($check);So, talking through it.
The first 10 lines (before $username) basically load XenForo's classes.
You need to specify the full server path to Autoloader.php, in my case my PasswordCheck.php is in the XenForo root so the __FILE__ parameter is sufficient.
I then set the username and password (obviously this can be retrieved from $_POST parameters instead).
I then get the database. This handles all of the database authentication and everything.
Big difference between my code and your code is I'm selecting 'data' from xf_user_authenticate NOT the remember_key. I'm not sure what the remember_key is, but it's something different. I believe data essentially contains your password hash and salt amongst other things in a serialised array.
Now I've got that, I create the default XenForo authentication object and set the data I retrieved from the database.
I can then make a call to the authenticate function and pass in my username and password.
The response will either be true or false. I have dumped the response using Zend_Debug::dump($check)
$auth creates the authentication handler.
In my code it's:
$check = $auth->authenticate($username, $password);
That contains the result of the check. Will either be true or false.
Similar threads
