Home page logo
/

pen-test logo Penetration Testing mailing list archives

RE: Determining the encryption used
From: "Bob Bell (rtbell)" <rtbell () cisco com>
Date: Fri, 12 May 2006 09:10:28 -0700

John -

If what you are describing is an encrypted field within the database, I
am not sure that there is anything you can do to determining what the
algorithm is. If it is good encryption, the data should be random bits.
If you know the encryption key, then you could try a number of the
common algorithms to see if they yield valid data. Otherwise, you are
going to have to try both the algorithm and the keys, (a very very
difficult task with normal algorithms). You might have to resort to pure
cryptographic analysis techneques to solve this issue.

Bob 

-----Original Message-----
From: Tim [mailto:pand0ra.usa () gmail com] 
Sent: Thursday, 11 May, 2006 16:09
To: John Madden
Cc: pen-test () securityfocus com
Subject: Re: Determining the encryption used

From what I have picked up cracking passwords, Cain (windows app from
oxid.it) has numerous decryption methods in it and will tell 
you if the hash does not fit. As for the length some 
encryption protocols can be identified by their length (do 
not know off the top of my head though).

On 5/11/06, John Madden <chiwawa999 () yahoo com> wrote:
Hi,

While doing a pen-test I came across a database with 
encrypted fields 
and I was curious to try and see what I would do with it.

Is it possible to determine the encryption used by "looking" at the 
encrypted results or lenght ?

I know that with Base64 it's pretty easy because of the "==" at the 
end.

I would like to learn more about the subject and considering the 
amount of documentation out there, I would like your 
comments on what 
you have used and found usefull.

Also if there are any tools besides openssl that you found 
usefull to 
try all the cipher, consecutively with a passphrase/keyword 
against a 
file/string

Thank you for your time.




__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com


----------------------------------------------------------------------
--------
This List Sponsored by: Cenzic

Concerned about Web Application Security?
Why not go with the #1 solution - Cenzic, the only one to win the 
Analyst's Choice Award from eWeek. As attacks through web 
applications 
continue to rise, you need to proactively protect your applications 
from hackers. Cenzic has the most comprehensive solutions 
to meet your 
application security penetration testing and vulnerability 
management 
needs. You have an option to go with a managed service (Cenzic 
ClickToSecure) or an enterprise software (Cenzic 
Hailstorm). Download 
FREE whitepaper on how a managed service can help you: 
http://www.cenzic.com/news_events/wpappsec.php
And, now for a limited time we can do a FREE audit for you 
to confirm 
your results from other product. Contact us at 
request () cenzic com for details.

----------------------------------------------------------------------
--------

--------------------------------------------------------------
----------------
This List Sponsored by: Cenzic

Concerned about Web Application Security? 
Why not go with the #1 solution - Cenzic, the only one to win 
the Analyst's Choice Award from eWeek. As attacks through web 
applications continue to rise, you need to proactively 
protect your applications from hackers. Cenzic has the most 
comprehensive solutions to meet your application security 
penetration testing and vulnerability management needs. You 
have an option to go with a managed service (Cenzic 
ClickToSecure) or an enterprise software (Cenzic Hailstorm). 
Download FREE whitepaper on how a managed service can help 
you: http://www.cenzic.com/news_events/wpappsec.php
And, now for a limited time we can do a FREE audit for you to 
confirm your results from other product. Contact us at 
request () cenzic com for details.
--------------------------------------------------------------
----------------


------------------------------------------------------------------------------
This List Sponsored by: Cenzic

Concerned about Web Application Security?
Why not go with the #1 solution - Cenzic, the only one to win the Analyst's
Choice Award from eWeek. As attacks through web applications continue to rise,
you need to proactively protect your applications from hackers. Cenzic has the
most comprehensive solutions to meet your application security penetration
testing and vulnerability management needs. You have an option to go with a
managed service (Cenzic ClickToSecure) or an enterprise software
(Cenzic Hailstorm). Download FREE whitepaper on how a managed service can
help you: http://www.cenzic.com/news_events/wpappsec.php
And, now for a limited time we can do a FREE audit for you to confirm your
results from other product. Contact us at request () cenzic com for details.
------------------------------------------------------------------------------


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault