Solved

Decode/encode for .htpasswd (.htaccess) file

Posted on 1997-11-15
2
20,621 Views
Last Modified: 2008-11-28
Hello...

Anyone know how to encode/decode the passwords
in .htpasswd (Apache Webserver) file ?

A piece of code will be greatly appreciated.

Thanks in advance.


Miranda
myr@dnet.net.id
0
Comment
Question by:myr
2 Comments
 
LVL 6

Accepted Solution

by:
alamo earned 200 total points
ID: 1441011
Apache's .htpasswd uses unix's "crypt" function. crypt is a "one way" encryption method used to encrypt passwords. There is an encode ONLY - no decode. In order to check that a password is correct, you have to encode the proposed password and compare the encrypted result with the encrypted password in the .httpd file. If the encrypted strings match, then the passwords match. The whole idea behind this sort of encryption is that you can't find out what the password is, you can only verify whether a proposed password is correct.

The zipfile at http://free.dom.de/xcrypt.html contains a windows DLL which implements the crypt function, as well as sample VB code (the VB code is very simple, "Text2.Text = crypt(Text1.Text)"). There is source for both the VB code and the DLL (DLL source is in C).

The complexity of the crypt algorithm (DES, basically) makes it impractical to implement in VB, though if you really wanted to you could certainly translate the C source to VB code. It would be slow, though.

If all you want to do is to to generate .htpasswd file entries, then you are all set with the zipfile I just mentioned. If you want to actively check passwords in VB, though, then it's not enough because with that DLL you can't specify the "salt". The "salt" is the 3-character string that is used to initialize the encryption. The encrypted password entries in the .htpasswd file include the correct salt as the first 3 characters - so to check a proposed password, you would get the first three characters from the encrypted password you want to check against, and use those as the salt so the encryption would come out the same. If you want to do this, then you can still use the .zipfile I gave you but will need to recompile the dll. The dll uses a fixed salt rather than one passed as an argument, it would be very easy to make the salt a passed argument as well.

I hope this will do the job for you, it's everything you need to know to do this except for decoding passwords (which as I said is impossible, except via dictionary attack). Please leave a comment if I have been unclear about anything... good luck!
0
 

Author Comment

by:myr
ID: 1441012
Thank you very much Alamo!
I've donwloaded the DLL and have a try,
it's work just fine (I'm using VB5).

Miranda
myr@dnet.net.id
0

Featured Post

Networking for the Cloud Era

Join Microsoft and Riverbed for a discussion and demonstration of enhancements to SteelConnect:
-One-click orchestration and cloud connectivity in Azure environments
-Tight integration of SD-WAN and WAN optimization capabilities
-Scalability and resiliency equal to a data center

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I’ve seen a number of people looking for examples of how to access web services from VB6.  I’ve been using a test harness I built in VB6 (using many resources I found online) that I use for small projects to work out how to communicate with web serv…
Since upgrading to Office 2013 or higher installing the Smart Indenter addin will fail. This article will explain how to install it so it will work regardless of the Office version installed.
Get people started with the process of using Access VBA to control Outlook using automation, Microsoft Access can control other applications. An example is the ability to programmatically talk to Microsoft Outlook. Using automation, an Access applic…
This lesson covers basic error handling code in Microsoft Excel using VBA. This is the first lesson in a 3-part series that uses code to loop through an Excel spreadsheet in VBA and then fix errors, taking advantage of error handling code. This l…

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question