WebEdition CMS

[NeonFlash]

Hi,

I noticed that there is no implementation of a hashing algorithm used in
WebEdition CMS yet. You can download the sourcecode from here:

Code:

http://www.webedition.org/de/webedition-cms/

This CMS is often used by German Websites. There are 2 options available to download and install this CMS. In order to study the source code, you can go for the Manual Installation option here:

Code:

http://sourceforge.net/projects/webedition/files/webEdition/6.2.1.0/webEdition_6210.tar.gz/download

I studied the source code, and after sometime I was able to figure out that the file, we_session.inc.php in the path:

/we/include/ has the information specific to the hashing algorithm.

On line 43 of the code we have,

Code:

$useSalt = $DB_WE->f("UseSalt");
$salted = md5($_POST["password"] . md5($_POST["username"]));

So, the hashing algorithm works as follows:

Based on the value of the useSalt field in database, it will decide whether to use the salted version of password or not.

The salted version will use the username as a salt. The algorithm becomes:

md5($p,md5($s))

This algorithm can be significantly accelerated on the GPU and it would be great to have it implemented in oclhashcat-plus