[weewee2018]

How is he getting the salt from the database?

[shoo]

this corresponds to sad scenario where the database itself is leaked and the attacker has access to it. the blog describes how the salt is stored as prefix to each hash.