Discuz! Password Encryption Method

It is found that the Discuz forum is encrypted using multiple encryption methods.

(Dz6.1 encryption method: md5 (Forum password), shell ))

 

Share it now:

User table: cdb_uc_members

Field: uidusernamepasswordsalt

// ======================

// The database link is omitted ....

// ====================

$ User = $ GET ["user"];

$ Pass = $ GET ["pass"];

$ Result = mysql_query ("select * fromcb_memberswhereusername = '$ user '");

@ $ Salt = mysql_result ($ result, 0, "salt ");

$ Pas = md5 ($ pass );

$ Pas = $ pas. $ salt;

$ Pas = md5 ($ pas );
$ Result = mysql_query ("select * fromcb_memberswhereusername = '$ user' andpassword =' $ pas ");

@ $ Username = mysql_result ($ result, 0, "username ");
If ($ username! = ''){

Echo "OK ";

} Else {

Echo "no ";

}

?>

Reference a cow:

Use the salt method to randomly obtain a string, and then connect the plaintext password MD5 with the random string, and then perform MD5 again. This greatly improves the security factor.
Encrypted password: md5 ($ newpw). $ salt) $ salt is the string returned by random $ hash
This greatly improves the security of user passwords.