MySQL323 Hash

What is MySQL323?

The **MySQL323** hash format, originally introduced in MySQL versions prior to 5.0, is a legacy password storage mechanism derived from the **UNIX crypt(3)** algorithm but with a modified iteration count and block cipher mode. It was designed as a lightweight alternative to the older **UNIX DES-based** hashes, leveraging a **13-round DES encryption** of a salted password string (with a fixed 13-character salt) in **ECB mode**, followed by a **base64 encoding** of the resulting ciphertext. Unlike later iterations like `mysql_old_password` or `mysql_native_password`, MySQL323 does not incorporate a dynamic salt or key stretching, instead relying on a static salt derivation process. Its primary use-case was in early MySQL deployments (pre-2005) where security was secondary to compatibility, though it was deprecated in favor of stronger schemes (e.g., `scramble` in `mysql_native_password`) due to its inherent vulnerabilities.

The **MySQL323** format is highly susceptible to cracking due to its **predictable salt structure**, **lack of key stretching**, and **optimizable DES implementation**. The fixed 13-character salt (derived from the username) allows attackers to precompute hashes for all possible salts, enabling **rainbow table attacks** with near-linear efficiency. Additionally, DES’s **56-bit key space** is trivially broken by modern brute-force methods, especially when accelerated by **GPU/FPGA-based cracking tools** (e.g., Hashcat or John the Ripper with optimized DES plugins). The absence of iterative hashing (e.g., salted rounds) means the hash function executes in constant time, making it resistant only to **dictionary attacks** rather than brute-force. Finally, the **ECB mode** reveals no cryptographic structure, but the **small key space** and **predictable salt** render it effectively obsolete for modern security standards.

Identifying MySQL323 Hashes

Identifying a hash blindly is often difficult because multiple algorithms can output strings of the exact same length. For example, a standard 32-character hexadecimal string could be MD5, NTLM, MD4, or LM. To definitively identify MySQL323, security researchers analyze the hash against a strict regular expression (regex) signature (shown above) to find structural matches.

How to Crack MySQL323

If you need to recover the plaintext password for a MySQL323 hash during a penetration test or forensics investigation, you must supply the correct module ID to your cracking software. Use the exact commands provided at the top of this page to target the hash successfully.