Password field showing as <binary> in the table???

[wannalrn]

I acquired some work, and I'm trying to retreive passwords from the database. When I view the table contents in SQL Server Ent. Manager, all I see in the password field is "<Binary>".
My question is how can view the text in the password field?

Your responses are much appreciated. I'm having trouble as I am getting back into programming after 4 years break!

Thanks

 

[jbenson001]

It is most likely an encrypted column. You will have to find out how the string is encrypted and decrypt it using the encryption key.

 

[wannalrn]

Thanks jbenson001,
that's probably the case. But no one in the company knows what the key is! The programmer who worked on this project is not here anymore. Is there any place specifically used to hold the key? Are there any workarounds to find what the contents of this field are?

Thanks Again

 

[jbenson001]

You will have to find where the data is being inserted, a stored procedure, or through a front end app.

 

[mrdenny]

The key can probably be found in the front end application (unless SQL is doing the encryption it self).

If you don't have access to the source code or you can't find the key for some reason you are pretty much screwed. Without the key you can't decrypt the data.

There are thinks you can find and download of the black hat nature which can decrypt data but it can take weeks or months to break the encryption depending on how the data was encrypted.

Is the data encrypted or was is hashed via a one way hash like MD5? If it's a one way hash you can't decrypt it as it's not actually encrypted.

Denny
MCSA (2003) / MCDBA (SQL 2000) / MCTS (SQL 2005) / MCITP Database Administrator (SQL 2005)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

 

[SQLDenis]

maybe it is just varbinary and not encrypted

run this for example
select convert(varchar(10),0x50617373776F7264)

select convert(varbinary(10),'Password')


Denis The SQL Menace
SQL blog:

http://sqlservercode.blogspot.com/