PHP md5 password; can't login

albertc · Jul 17, 2015

Hey,

Since this is my first post here, I'd like to say hello

I'm a complete noob in the php world, but I have to set up a database and some config files to make an experiment working.
My config file is for configuring the login and pass for my server, database and the GUI login panel.

This is the config file

PHP:

//$sHost should be the MYSQL host of the database, by default localhost 
  $sHost               = "localhost"; 
   
  //$sUser should be the user of the database 
  $sUser             = "root"; 
   
  //$sPass should be the password of the database user supplied before 
  $sPass             = "root"; 
   
  //$sDatabase should be the database name where the tables should be installed in 
  $sDatabase         = "database_name"; 
   
  //$sPanelUsername should be the username you want to login to the panel 
  $sPanelUsername     = "Panel_Username"; 
   
  //$sPanelPassword should be the password you want to login to the panel 
  $sPanelPassword     = "PanelPass"; //MD5(Password)

This is the part of the index.php for the login panel

PHP:

  //LOGIN 
            if (isset($_GET['login'])) { 
                if (isset($_POST["password"])) { 
                    if ((md5($_POST["password"]) == $sPanelPassword) && ($_POST["username"] == $sPanelUsername)) { 
                            $_SESSION["password"] = $sPanelPassword; 
                            $_SESSION["username"] = $sPanelUsername; 
                            //Logged in, Proceed.. 
                            header('Location: ?stats'); 
                    } 
                } 
                Print file_get_contents("inc/login.html"); 
                exit; 
            }

I did not write this myself, I got it from the net. Everything seems to work fine except the login.
I tried to change the md5 pass to a non encrypted password, but this failed misserably.

EDIT: I got no error messages.

Can someone help me out?

thx

jazzc · Jul 17, 2015

Welcome aboard.

Go here: http://www.md5.cz
Type the password you want, press the button, copy the long string into the last variable of the config file

$sPanelPassword = "LongString!!!";

When you log in, use the original password.

albertc · Jul 17, 2015

jazzc said:
Welcome aboard.

Type the password you want, press the button, copy the long string into the last variable of the config file

When you log in, use the original password.

I already did that, it doesn't seem to respond.
when I changed the md5 to non encrypted I did this:

PHP:

  //LOGIN 
            if (isset($_GET['login'])) { 
                if (isset($_POST["password"])) { 
                    if (($_POST["password"]) == $sPanelPassword) && ($_POST["username"] == $sPanelUsername)) { 
                            $_SESSION["password"] = $sPanelPassword; 
                            $_SESSION["username"] = $sPanelUsername; 
                            //Logged in, Proceed.. 
                            header('Location: ?stats'); 
                    } 
                } 
                Print file_get_contents("inc/login.html"); 
                exit; 
            }

I removed the md5 out of this string

PHP:

if (($_POST["password"]) == $sPanelPassword) && ($_POST["username"] == $sPanelUsername))

Is there a possibility that if I removed the the variables in the config file and used fixed values in the index.php, it will work?

dineshag · Jul 18, 2015

Try printing your POST data and see if your server is getting the values correct or not. This will tell you if you are able to fetch post data or not.

albertc · Jul 20, 2015

dineshag said:
Try printing your POST data and see if your server is getting the values correct or not. This will tell you if you are able to fetch post data or not.

I'm going to try this tonight.

ekapek · Aug 5, 2015

You neeed md posted pass to compare

Code:

if ((md5($_POST["password"]) == $sPanelPassword) && ($_POST["username"] == $sPanelUsername))

Also ou mix GET and POST - are you sure you send login to ?login url? Check contents of $_GET and $_POST

mantic0re · Oct 29, 2015

Md5 is not encryption, its a hash algorithm. I would guess that your database password column is setup to contain less characters than the length of the md5 string.

revproxy · Nov 21, 2015

mantic0re said:
Md5 is not encryption, its a hash algorithm. I would guess that your database password column is setup to contain less characters than the length of the md5 string.

Yes - this is very popular senario, check the length - you can fix it with simple query:

Code:

alter table [table] modify [column] varchar(32);

flaveris · Dec 22, 2015

And please - for the sake of security - don't use md5 for password hashing!

) Those hashes can be decoded in an eye blink.

iBrazilian · Dec 22, 2015

Just use bcrypt for more security.

IMpossible · Dec 22, 2015

Or just use:

md5("yourpasswordhere")

PHP md5 password; can't login

albertc

Newbie

jazzc

Elite Member

albertc

Newbie

dineshag

Newbie

albertc

Newbie

ekapek

Regular Member

mantic0re

Junior Member

revproxy

BANNED

flaveris

Newbie

iBrazilian

Power Member

IMpossible

Supreme Member

Main Menu

Marketplace

Making Money

BlackHat World