1

Topic: PHP Password encryption and login

Hi,

Today looking the forum I found different post for this topic but no one with a good solution, so I dedicated a couple of hours for to find a solutions.

The SHA512 pw is created in this way:
$password='test';    $salt=random_str(8);
$password_to_db="{SSHA512}".base64_encode(hash('sha512',$password.$salt,true).$salt);

That means that you cannot do the login without to read before the hashed pw from DB for to extract the $salt

So after had read the data from DB you may determinate le new hash i this way
$password='test12345';
$hashfromdb="{SSHA512}R7Agj9845.....";
$pwslt=substr($letta,9,strlen($letta)-9);   # Cut the first 9 chars {SSHA512}
$pwslt=base64_decode($pwslt);               # Decode the rest from base64
$pws=substr($pwslt,0,64);                       # Separate the hash (first 512 bit > 64 chars)
$slt=substr($pwslt,64,strlen($pwslt)-64); # Separate the used salt
$hashtodb="{SSHA512}".base64_encode(hash('sha512',$pwchiara.$slt,true).$slt);  # Calculate the new hash

So now you have to use $hashtodb in the select for the password

I hope it will be usefull for someone.

Have a nice day

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: PHP Password encryption and login

I don't know what you want to archive, what do you want to login into?

Those passwords you mention are mailbox passwords, so you want to login into some external page useing mailbox passwords?

If you want to archive this, you can simply use phpmailer:

https://github.com/PHPMailer/PHPMailer/ … check.phps

3

Re: PHP Password encryption and login

Exactly I need to log in in an other panel, in same mail server, using same user then the mailbox.
but can also be an other server wrinting in a way of a API.

Yes off course if you like to use an external library you may use PHPmailer.
I prefere to reduce at minimum the use of external code, for security and to reduce maintenance work.

4 (edited by Cthulhu 2023-10-01 21:44:53)

Re: PHP Password encryption and login

Then i can tell you already:

- you code doesn't even use prepared statements
- is not useing any kind of input sanitization
- is vulnerable for SQL injection
- thus is a bad solution if you focus is on security and to reduce maintenance work

a simple ' OR '1' = '1' " in the login form would allow a login into any mailbox