51

I created a protection for my web pages with apache2 in ubuntu. Now I am creating an application in c++ and I want it uses the same file that Apache2 uses for authentification, but my problem is that I don't know how to decrypt the password generated by apache2. (Maybe I need a key that is used for encryption).

Thank you.

1
  • I'm wondering why did you need to decrypt a password in the first place ...
    – jave.web
    Mar 11, 2021 at 3:07

2 Answers 2

77

.htpasswd entries are HASHES. They are not encrypted passwords. Hashes are designed not to be decryptable. Hence there is no way (unless you bruteforce for a loooong time) to get the password from the .htpasswd file.

What you need to do is apply the same hash algorithm to the password provided to you and compare it to the hash in the .htpasswd file. If the user and hash are the same then you're a go.

9
  • 3
    @Mils: It hashes the password you submit and compares the hash values.
    – Kerrek SB
    Nov 11, 2012 at 3:13
  • 4
    Apache takes the password provided, hashes it and compares the username provided and the generated hash to the username (if it exists) entry in the .htpasswd file. If they match the user is allowed. Nov 11, 2012 at 3:13
  • 4
    Yes you can. You need to know which hash algorithm is used. There are 4 possibilities: Crypt (ALG_CRYPT), MD5 (ALG_APMD5), SHA-1 (ALG_APSHA) and PLAIN TEXT (ALG_PLAIN) (not recmmended). Nov 11, 2012 at 3:21
  • 1
    Hey there, I tried to use the both algorithm; Crypt and MD5 But I have a problem when I compare the two passwords, with my code I obtain all time the same password (crypted). I noticed that for the same password if you repeat the process Apache2 generate another encrypted password.
    – Mils
    Nov 12, 2012 at 15:24
  • 4
    Apache uses a salt in the MD5 algorithm. The salt in this case is $apr1$aYXnafBT as seen in the generated hash. If you take the salt from the entries and apply it to the password and the generate the hash in c++ you should get the same hash. Nov 12, 2012 at 18:23
7

See in particular Apache HTTPd Password Formats

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.