jetlib.sec » Penetration Testing » Validating if password is encoded or encrypted

Feeds

133326 items (0 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

Penetration Testing

• September 06, 2011
• 

  Validating if password is encoded or encrypted

  Posted: September 6th, 2011, 6:30am PDT

  Tags:   

  Posted by Karen Sy on Sep 06

  Hi Everyone, I'm currently reviewing an app prior to launching to our
  prod. One of our security requirements is for the password to be
  encrypted.
  When i checked the password field in db, i noticed that all passwords
  are ending with a double equal sign e.g "==".
  I am under the impression that they are just base64 encoded rather
  than encrypted. However, i tried decoding it using base64 but i'm not
  getting a valid data.
  
  Am i...