Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
If an adaptive hash function like bcrypt or PBKDF2 is used in hashing passwords, the number of iterations used in the hashing process can be configured.
For a penetration tester or a malicious hacker, what are the ways to determine how many iterations were used in hashing passwords, assuming that they do not have access to source codes, only a database dump of the password hashes.
The plain hash itself does not give any indication of the number of iterations. But with practical schemes, such as most crypt based ones, the number of iterations is stored alongside hash and salt in the database.
Keeping the number of iterations secret doesn't gain you much security in practice. Figuring out the number of iterations isn't that hard in practice. Choose a few users who probably have weak passwords, and compare after each iteration. Or if you can register your own accounts, you can simply attack that single user whose password you know.
If you want to improve security in a scenario where the attacker obtains only the database, but not the source-code/config file, there are much better techniques than a secret number of iteration. For example you could concatenate the salt with a secret key, or encrypt the hash. That way an attacker has no chance of attacking the hashes without gaining access to the place where you store the key.
For a penetration tester, I do not know of any easy way to determine the number of iterations given only black-box access to the application -- unless you find some other vulnerability that gives you an "in" to access this information.
If you find some other vulnerability that gives you access to the database, you can read the number of iterations from the database, since it is stored with the password hash. If you find some other vulnerability that lets you get access to the web application's source code (or compiled code), you can read the number of iterations out of the source code.
