vT16 Posted May 7, 2009 Share Posted May 7, 2009 Hello, We have made our own looking login system a bit more advanced then WHMCS's one, therefor we need to know how to encryption works / what method you are using.. If it's crypted, hashed etc, the method that is used to decrypt and verify the password the moment the client logs in.. Thanks, 0 Quote Link to comment Share on other sites More sharing options...
chickendippers Posted May 7, 2009 Share Posted May 7, 2009 http://forum.whmcs.com/showthread.php?t=19143 under "Security" 0 Quote Link to comment Share on other sites More sharing options...
vT16 Posted May 7, 2009 Author Share Posted May 7, 2009 There is not just MD5, but also some kind of salt or something? 0 Quote Link to comment Share on other sites More sharing options...
chickendippers Posted May 8, 2009 Share Posted May 8, 2009 That's all that's publicly been released. If you need more then you'll have to contact tech support. 0 Quote Link to comment Share on other sites More sharing options...
openmind Posted May 8, 2009 Share Posted May 8, 2009 From what I can tell it's an irreversible MD5 hash so you won't be able to decrypt it. I would use the API to get the client password... On a side note, I personally think it's a bit of a waste of time as if someone has compromised your database you're screwed anyway 0 Quote Link to comment Share on other sites More sharing options...
vT16 Posted May 8, 2009 Author Share Posted May 8, 2009 If you read my original post then you will see why we need this... 0 Quote Link to comment Share on other sites More sharing options...
openmind Posted May 8, 2009 Share Posted May 8, 2009 And if you read mine you will see the passwords cannot be decrypted Use the API, it works and does exactly what is says on the tin... 0 Quote Link to comment Share on other sites More sharing options...
vT16 Posted May 8, 2009 Author Share Posted May 8, 2009 The API is not updated / does not work with Version 4. It just returns the md5 value. 0 Quote Link to comment Share on other sites More sharing options...
ckh Posted May 8, 2009 Share Posted May 8, 2009 md5 encryption can't be decrypted, so that's all you are going to get... 0 Quote Link to comment Share on other sites More sharing options...
jozeph Posted May 9, 2009 Share Posted May 9, 2009 In this case, the get client password on API will return only the md5 hash? 0 Quote Link to comment Share on other sites More sharing options...
vT16 Posted May 9, 2009 Author Share Posted May 9, 2009 I am not requiring that the password is going to be decrypted, all i need to know is how the password function is setup with what MD5 value and how exactly the extra seed value functions.. I shouldn't be required to use the built in WHMCS login module if i don't want or need to... The fact that the password now get's encrypted (very good) but it also force us to remove the WHMCS login form and make a complete new one to get the extra login functions we want and require. As we have yet been able to figure out how we can get our client's logged in trough a custom login form instead of WHMCS's form. 0 Quote Link to comment Share on other sites More sharing options...
nhudson Posted May 9, 2009 Share Posted May 9, 2009 I am not requiring that the password is going to be decrypted, all i need to know is how the password function is setup with what MD5 value and how exactly the extra seed value functions.. I shouldn't be required to use the built in WHMCS login module if i don't want or need to... The fact that the password now get's encrypted (very good) but it also force us to remove the WHMCS login form and make a complete new one to get the extra login functions we want and require. As we have yet been able to figure out how we can get our client's logged in trough a custom login form instead of WHMCS's form. What could you possibly need to modify on the login form that you can't already do using templates and action hooks? 0 Quote Link to comment Share on other sites More sharing options...
vT16 Posted May 9, 2009 Author Share Posted May 9, 2009 For an example, integration and use of alternative login methods like AOL, Logmein, or the popular OpenID ? We have had it for a long time with v3, but with v4 it was difficult to implant as we haven't been able to figure out how we can login the client when all we know is that it's MD5, we also needs to know how the seed value is setup and function. 0 Quote Link to comment Share on other sites More sharing options...
FazeWire Web Services Posted May 9, 2009 Share Posted May 9, 2009 You need to contact support, they are not going to just give away how they encrypt passwords on the most popular billing/support suite in the world on a public forum. 0 Quote Link to comment Share on other sites More sharing options...
vT16 Posted May 9, 2009 Author Share Posted May 9, 2009 I have been in touch with them. 0 Quote Link to comment Share on other sites More sharing options...
vT16 Posted May 13, 2009 Author Share Posted May 13, 2009 After some testing back and forth, then we found out how the hash is setup 0 Quote Link to comment Share on other sites More sharing options...
atDev Posted May 17, 2009 Share Posted May 17, 2009 Are you allowed to share? If not, can someone confirm the API encrypt password method words for v4? 0 Quote Link to comment Share on other sites More sharing options...
ckh Posted May 17, 2009 Share Posted May 17, 2009 No ones going to do that in an open forum and you really shouldn't ask that here. Put in a support ticket and ask there. 0 Quote Link to comment Share on other sites More sharing options...
atDev Posted May 17, 2009 Share Posted May 17, 2009 No ones going to do that in an open forum and you really shouldn't ask that here. Put in a support ticket and ask there. Agreed, I didn't expect it to be shared in the forum, simply via a PM. Either way, nevermind figured it out. 0 Quote Link to comment Share on other sites More sharing options...
vT16 Posted May 18, 2009 Author Share Posted May 18, 2009 PW + Salt = Password Hash 0 Quote Link to comment Share on other sites More sharing options...
vT16 Posted May 21, 2009 Author Share Posted May 21, 2009 ID - Password Hash - Visitors IP = Passoword Hash 0 Quote Link to comment Share on other sites More sharing options...
hireahit Posted May 25, 2009 Share Posted May 25, 2009 You need to contact support, they are not going to just give away how they encrypt passwords on the most popular billing/support suite in the world on a public forum. With all due respect, if every single component of an encryption scheme (beyond the password or other details which are configuration data rather then part of the original source) can't be shared publicly without compromising security, it's broken by design. Security by obscurity doesn't work, at least not against an enemy who is sufficiently interested (or bored) 0 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.