Verifying Potentially Stolen Passwords 

You’re currently being DDoS’ed and receive a ransom note. The attackers claim they’ve hacked your system and provide a list of usernames and passwords as “proof”. But did they really breach your system, or are they bluffing? Let’s investigate by checking the list against the database of hashed passwords. 

1. Retrieve the Stored Password Hash from the database

DECLARE @StoredPasswordHash VARBINARY(64) = 0x6B6122460051B52CF12DCECD9CF092FFE21F3BEF85F54A3A4257DE5E7FBFAD4E;

This is the hashed password stored in our database. It’s in VARBINARY format, making it ready for direct comparison during authentication. 

2. Retrieve the Stored Salt

DECLARE @StoredSalt VARBINARY(32) = 0x97D2DD046552D320A4FBA033B9EF7C59FFBF634127063BB1F83257D3266ABD45; 

Each password has a unique salt (random data added to the password before hashing). This prevents attacks like rainbow table lookups. 

3. Convert the Input Password to Binary

DECLARE @PasswordToCheck NVARCHAR(MAX) = 'superduperstrongpassword'; 
DECLARE @Password VARBINARY(MAX) = CONVERT(VARBINARY(MAX), @PasswordToCheck); 

The password we’re checking is converted into a binary format for hashing. 

4. Combine the Salt and Password

DECLARE @SaltAndPassword VARBINARY(MAX) = @StoredSalt + @Password; 

The salt is prepended to the password before hashing. 

5. Hash the Salted Password

DECLARE @ComputedHash VARBINARY(64) = HASHBYTES('SHA2_256', @SaltAndPassword); 

We hash the concatenated salt + password using the SHA-256 algorithm. The result is the final computed hash. 

6. Compare the Computed Hash with the Stored Hash

IF @ComputedHash = @StoredPasswordHash 
BEGIN 
    PRINT 'Password is correct'; 
END 
ELSE 
BEGIN 
    PRINT 'Password is incorrect'; 
END 

If the computed hash matches the stored hash, the password is valid. Otherwise, it’s incorrect. 

What This Means 

If the leaked credentials from the ransom note do not match the stored hashed passwords, then the attackers did not actually hack the database. Instead, they likely are using fake data or data from other attacks. 

To further investigate, you can check whether the username or email has previously been compromised using services like haveibeenpwned.com

Tags: SQL