In XVWA (Xtreme Vulnerable Web Application) I presented with an PBKDF2 with sha256 and 1000 iteration as such:
<?php
function create_hash($password)
{
// format: algorithm:iterations:salt:hash
$salt = base64_encode(mcrypt_create_iv(PBKDF2_SALT_BYTE_SIZE, MCRYPT_DEV_URANDOM));
return $salt . " : " .
base64_encode(pbkdf2(
PBKDF2_HASH_ALGORITHM,
$password,
$salt,
1000,
24,
true
));
}
// where $password is a user supplied data.
https://github.com/s4n7h0/xvwa/blob/master/vulnerabilities/crypto/PasswordHash.php
Is there a way to retrieve the password?