CODEWITHSUNDEEP
javawordpresshash
Rilcon42
Rilcon42

Reputation: 9763

Trying to check a wordpress password hash using phpass

I have a database of hashed Wordpress passwords. I am trying to check a user's password against the database stored password, but the hashes aren't correct. I am using this github code with some logging in isMatch(). Any ideas why these passwords don't match? the plain text password is alberta10

  public boolean isMatch(String password, String storedHash) {
    // The first 12 digits of the hash is used to modify the encryption.
    String setting = storedHash.substring(0, 12);
    logger.log(Level.INFO, "----Hashed pwd from db is: "+storedHash);
    logger.log(Level.INFO, "----Hashed pwd using php-pass: "+encrypt(password, setting));

    return storedHash.equals(encrypt(password, setting));
  }

Here is my authenticate() method

private void authenticate(String username, String password) throws Exception {
    // Throw an Exception if the credentials are invalid
    PasswordHasher pwdHasher=new PasswordHasher();

    _logger.log(Level.INFO, "----Authenticating user: "+username);
    try{
    Connection conn=authenticationBiz.connWordpressDB();
    String query = "SELECT * FROM wp_users WHERE user_login = ?";
    PreparedStatement preparedStmt = conn.prepareStatement(query);
    preparedStmt.setString(1, username);
    ResultSet rs=preparedStmt.executeQuery();
    rs.next();//get first result
    _logger.log(Level.INFO, "----Hashed pwd from db is: "+rs.getString("user_pass"));
    if(pwdHasher.isMatch(password,rs.getString("user_pass")))            
        return;
    }
    catch(Exception e){
        _logger.log(Level.INFO, "----Exception in Authenticating user: "+e);            
        throw e;
    }
    throw new Exception();
}

Heres the log output:

----Hashed pwd from db is: $P$BeatnTVG2/U8KZwpaWbPUF4yghHEKf.
    17:21:40,997 INFO  [com.mollom.phpass] (default task-37) ----Hashed pwd from db is: $P$BeatnTVG2/U8KZwpaWbPUF4yghHEKf.
 ----Hashed pwd using php-pass: $P$BeatnTVG2etvrth3rlCUdiNRm93PO9xZjXNr1f5s8izUZFfIq70V

Upvotes: 5

Views: 1517

Answers (2)

Rilcon42
Rilcon42

Reputation: 9763

Turns out I was using a Github project that didnt match the initial criteria used to generate the hashes. I discovered: https://github.com/Wolf480pl/PHPass which worked perfectly

Upvotes: 2

Didier
Didier

Reputation: 79

Wordpress uses 8 hash iterations, the git hub cod you've linked uses 15 iterations, maybe you can't just try to reduce the number of hash iterations defined in the constant HASH_ITERATIONS.

Upvotes: 1

Related Questions