security - I got an asignment to decrypt Password hash?

Question

I am new to Security and was trying to learn how can I crack my own user's databases. I have user's salt, password hashes and username. The SHA-256 password hash is computed from the concatenation of 3 strings i.e. one constant string potPlantSalt, the password, and the salt. SHA-256 output has been converted into the hexadecimal format and truncated to 32 characters before storing into the database as a string.

truncate ( hexstring ( SHA256 ( " potPlantSalt " + password + salt ) ) )

I have data like: username: max password hash: 2b1ac087bd54ea9dcbfba2c3e63b2335 salt: 5aa8698c4022fe1d

How can I know above user decoded password?

Answer 1

SHA256 is a one way function, this means that given the output of SHA256, it is very, very difficult and time consuming to compute an input. So time consuming that it is impractical on current hardware.

So instead you have to use a brute force attack: hash millions of potential passwords until you find one that produces the same hash as stored in the database. Note that this must not necessarily be the original password (hash collision).

If we assume that the user did not use a combination of random characters, the search space can be reduced by using a Dictionary attack.

You can reduce computation time by using more storage space with Rainbow tables.