Log in

View Full Version : Java script - can you reverse to get password?


aXLe
September 6th, 2005, 21:41
Here is a little Javascript challenge. The source contains the algorithm. Can you reverse it?!

laola
September 6th, 2005, 23:15
Hehehe, nice one. Just had a glimpse at the code, gotta leave for work soon. I'll give it a try

aXLe
September 7th, 2005, 01:23
To be honest it's a little problem I found today - I'm still looking at it myself, but I thought I'd throw it up here

I was wondering whether only a bruteforce type attack would be suitable?

SiGiNT
September 7th, 2005, 01:31
Tried to get it to gen it's own password - no luck - but I'm not great at math - the closest I got was !eM esreveR - but no joy.

SiGiNT

aXLe
September 7th, 2005, 01:40
Hmmmm - how did you get it to gen it's own password?

If you put in an "alert(f)" statement before function check you will see that the f array contains a large number for each letter, and it is this number that is added to code, then multiplied by the offset - nasty

Looks like quite a clever piece of code.

SiGiNT
September 7th, 2005, 01:57
Like I said my math sucks, (pretty bad for an Engineer), but anyway !eM esreveR yields the code - 4023276530 - 1 digit too long but at least looks close to 432195701.

SiGiNT

HMMMM! just noticed, the target number looks as though it's "made up" not a random sequence, (4321 is not random), as you would expect - that would leave me to believe that the pwd is probably not a phrase or word.

aXLe
September 7th, 2005, 04:51
Weird - "!eM esreveR" is the reverse of "Reverse Me!" - I made up that string

Looks pretty tough to me - seems brute force might be the only way, since it depends also on the length of the password as a multiplier.

Difficult to work backwards - but not impossible. a LOT of combinations to try though

Would be interesting to feed some kind of dictionary file through it I guess....

bilbo
September 7th, 2005, 08:33
Nice...

First we need a good Javascript debugger...
The best I found up to now is Venkman, which is a plugin for Firefox.
All open source stuff, very good! Install it and play with it!
Oops, I forgot to say that the Javascript code you submitted us does not run on Firefox (neither on Opera): please remove the line
Code:
<-- Begin

it is a bug (an unterminated comment!)

Next (sorry mates, this is a weakness of my brain, but I need this step to completely understand the algorithm) convert the algorithm to C language. During the conversion step you will find some funny things. For example the way the array f[] is built: he takes the decimal square root of some number (only the integer part) and then uses it as it was an hexadecimal number!
But very strange (I would think a programming bug!) is the way the characters of the password are taken into account: the first character is skipped, and one more character (the null) is taken into account at the end of the password. In this way, all the results you will find will indicate the password characters excluding the first one, which can be any one.

Finally we can revert the algorithm: you will find 20638*62 solutions (*62 is the unrestriction regarding the first character, the initial dot you will see at the beginning of each solution.

The length of the password is immediately found searching for a divisor of the given code between 2 (1 is trivial) and e.g. 50. The only divisor is 7, this means the only possible length is 8.

The algorithm emulator (define 1 instead of 0) and the reverse of it is attached.
Have fun!

bilbo

P.S.: where did you find this code?

aXLe
September 7th, 2005, 20:19
Wow - did that produce the correct solution? i haven't run it yet. Good work!

P.S Code was taken from a live web page

i_registered
September 8th, 2005, 10:26
Why reverse if you can have it all (incl. generator):

http://javascript.internet.com/passwords/password-pro-in.html

bilbo
September 8th, 2005, 11:11
Many thanks, i_registered, for having pointed out the link. I was not able to find it!

Finally we can give credit to the author, Lefteris Haritou.

The link you suggested has yet the bug I mentioned in my post (first character of the password is ignored:
Code:

var lpass=(pass.length)+1
for (l=1; l<lpass; l++){
K[l]=pass.charAt(l)
}


A more recent version, on the author site, http://www.geocities.com/~lef/files/scripts/pass.js, is corrected:
Code:

var lpass=pass.length
for (l=0; l<lpass; l++){
K[l]=pass.charAt(l)
}


Anyway, the reversed algorithm is not there ;-)
And it's a pity that the author didn't try to reverse his algorithm: he would have discovered that
(a) the algorithm is reversable (vulnerable)
(b) many solutions can be found for the same "code"

Best regards, bilbo

SiGiNT
September 8th, 2005, 11:37
Interesting,

Everything you need to know is readily accessable - here is the code generating script.

<HTML>
<HEAD>
<TITLE>The JavaScript Source: Password Protection: Password Pro (In)</TITLE>
<META HTTP-EQUIV="The JavaScript Source" CONTENT = "no-cache">
<META NAME="date" CONTENT="2000-09-09">
<META NAME="channel" CONTENT="Web Developer">
<META NAME="author" CONTENT="Lefteris Haritou">
<META NAME="section" CONTENT="Password Protection">

<Script language="JavaScript">
<!-- Begin
var base= new Array("0", "1", "2", "3", "4", "5", "6", "7", "8", "9","A", "B", "C", "D", "E", "F", "G", "H", "I", "J", "K", "L", "M", "N", "O", "P", "Q", "R", "S", "T", "U", "V", "W", "X", "Y", "Z","a", "b", "c", "d", "e", "f", "g", "h", "i", "j", "k", "l", "m", "n", "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "z"
var code=0;
var z=23;
var y=28;
var f= new Array();
var K= new Array();
for (x=0; x<10; x++){
f[x]=x<<9
f[x]+=23
}
for (x=10; x<36; x++){
y=y<<1
v= Math.sqrt(y)
v = parseInt(v,16)
v+=5
f[x]=v
y++
}
for (x=36; x<62; x++){
z=z<<1
v= Math.sqrt(z)
v = parseInt(v,16)
v+=74
f[x]=v
z++
}
function make(){
var pass = prompt("Enter the password you wish to set.",""
if (pass==null || pass==""{
exit()}
else{
var code=0;
var lpass=(pass.length)+1
if (lpass<5){
alert("Please enter a password with more than 3 characters";
make()}
else{
if (lpass>9){
alert("Sorry Password Invalid\n\nThere is a limit of 8 characters";
make()}
else{
for (l=1; l<lpass; l++){
K[l]=pass.charAt(l)
}
for (y=1; y<lpass; y++){
for(x=0; x<62; x++){
if (K[y]==base[x]){
code+=f[x]
code*=y
}
}
}
alert("Your access code is: "+code+"\n\n\nWrite it down!\n\n\n\nYou need it below!";
alert("Be sure to also create the protected file, "+pass+".html";
}
}
}
}
function exit(){
if (confirm("Do you really want to exit ?"){
history.back()}
else{
make()}
}
// End -->
</Script>

SiGiNT

Actually this whole routine is not necessary - you can just modify the pwd checking routine to display (code) instead of the wrong password nag and then insert that number where code==xxxxxxxxx

aXLe
September 8th, 2005, 17:22
Good stuff!

I found this code protecting a "protected downloads" area of an engineering software companies web page, and wondered whether it could be reversed.

The trap is that the final password is also the name of the page!

The code is implemented as per the code snippet :

function go(){
location.href=pass+".html";

ie. with the correct password, you are sent to (password).html.

I had culled out this from the pass3.html sample file I uploaded.

SO, if there are multiple solutions that generate the correct code, only one will take you to the web page (since the actual password is the name of the page)

If the first character is ignored (whether by design or error) that gives another multiple of solutions for the correct password!

Interestingly on the web page where I found this little algorithm, no credit had been given to the author.

To test the reversal, I guess one could simply write the generator such that it pumps the potential password in through the coding algorithm, and only echos it out to screen (or file) if it matches the CODE. So you end up with a list of potential passwords only.

If this first character thing is a bug (fair to assume it is given that it appears to have been corrected in the later revision), then it is most likely also fair to assume that the first charater will also be in the range 0-9 A-Z a-z.

bilbo - I'll have a play with your code

bilbo
September 9th, 2005, 02:11
Quote:
[Originally Posted by aXLe]The trap is that the final password is also the name of the page!

The code is implemented as per the code snippet :

function go(){
location.href=pass+".html";

ie. with the correct password, you are sent to (password).html.

I had culled out this from the pass3.html sample file I uploaded.

SO, if there are multiple solutions that generate the correct code, only one will take you to the web page (since the actual password is the name of the page)

If the first character is ignored (whether by design or error) that gives another multiple of solutions for the correct password!


In that case (differently from e.g. Unix password checking) more are the solutions and better is the protection!

But a question arises now: what is the usefulness of a password check routine? Wouldn't be simpler to directly go to the link
Code:
location.href=pass+".html";
without any check?

And another (search related) question...

I tried to locate some sites which have installed the PasswordPro protection.
I googled for "var z=23" AND "var y=28": no results!!!
But if you google for example for "Here is how to use the Password Pro on your own site", some pages come out which hold the javascript code too...
The reason is that the most known search engines (tried google, yahoo and teoma) do not enter the javascript snippets in the HTML pages.

Does anybody know some search engine which indexes those scripts too?

EDITED: one found - www.alltheweb.com!

Best regards, bilbo

aXLe
September 9th, 2005, 05:21
bilbo,

location.href=pass+".html";

where pass is the variable that the user has entered for the password. ie if the password was for example "letmein" then the resulting link is letmein.html - relative to the current address I believe.

eg if this code was sitting on http://www.thisisanexample.com/downloads then the code will direct to http://www.thisisanexample.com/downloads/letmein.html - at least that's how I believe it works.

So your algorithm would have to be modified to also use the first character. Does each code as generated by your algorithm, when passed through the original one, come out to equal CODE?

Peres
September 9th, 2005, 14:08
The source code posted here reminds me of a page in the javascript section in the old Fravia's website. Have anybody else had the same deja-vu?

Peres

goggles99
September 9th, 2005, 14:28
I believe that this js stems originally from the Adobe GoLive JavaScript Library, it's a one-way encryption algorithm.

There is tons of info on it already on the internet,
To find it, search in google for "(K[y]==base[x])" <- with the quotes

LLXX
September 9th, 2005, 18:36
Quote:
[Originally Posted by goggles99]I believe that this js stems originally from the Adobe GoLive JavaScript Library, it's a one-way encryption algorithm.

There is tons of info on it already on the internet,
To find it, search in google for "(K[y]==base[x])" <- with the quotes

It's hardly "one-way", as demonstrated in the post on the first page of this thread. It is easily invertable. However, in almost all of the results I found searching "(K[y]==base[x])" in Google, its security isn't discussed at all.

Perhaps the original author deliberately intended to make this "hash function" contain a lot of collisions, making it more difficult to bruteforce the name of the protected page.

goggles99
September 9th, 2005, 19:47
Quote:
[Originally Posted by LLXX]It's hardly "one-way", as demonstrated in the post on the first page of this thread. It is easily invertable. However, in almost all of the results I found searching "(K[y]==base[x])" in Google, its security isn't discussed at all.

Perhaps the original author deliberately intended to make this "hash function" contain a lot of collisions, making it more difficult to bruteforce the name of the protected page.

I counted 7 out of the 64 results discussed reversing it (not counting the Russian ones)...
That's "Hardly any???"

Nothing in existence is literally "One Way", anything can be reversed if given enough time and processing power so don't take what I say so literally. MD5 is called "One Way" too, but is it really?

Wouldn't the JavaScript MD5 implementation be more secure than this? (though still not totally secure of course) The resulting url could have the hash embedded into it.

aXLe
September 12th, 2005, 01:59
Bilbo - thanks! Works great!

bilbo
September 13th, 2005, 01:41
Quote:
[Originally Posted by aXLe]Bilbo - thanks! Works great!

You're welcome...
But the initial problem is still there: you have to try accessing 20638*62 documents; only one will not return you error 404 (not found) :-)

laola
September 13th, 2005, 01:59
I think most websites will use descriptive names for their pages, so creating the 1.3 million strings and filtering them with a dictionary could cut down the number of test items quite noticeably. Only if that does not help, you will have to wade through the whole amount of possible solutions.

As usual, the weakness is not in the algo itself, but rather a matter of PEBKAC

bilbo
September 13th, 2005, 08:04
You are right, laola, but in this case we are unlucky!

I've tried to remove all the solutions with interspersed digits, so the possible solutions (expanding the first letter) went down to 133094; and I have (case-insensitive) compared each of them with 16577 8-characters words taken out from a dictionary.

No solutions popped out!

Here is the program I wrote to do the job:
Code:

// written by bilbo - 13sep05

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <math.h>

#define MAXLEN 50
#define CODE 432195701

char base[10+26+26] = {
'0', '1', '2', '3', '4', '5', '6', '7', '8', '9',
'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O',
'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z',
'a', 'b', 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n', 'o',
'p', 'q', 'r', 's', 't', 'u', 'v', 'w', 'x', 'y', 'z'
};
int f[10+26+26];
char words[20000][8+1]; // we assume no more than 20000 words will be selected

void
init_f(void)
{
int x, y, z;
char tmp[40];
int tmp1;

for (x=0; x<10; x++) { // digits
f[x] = x << 9;
f[x] += 23;
}
for (x=10,y=28; x<36; x++,y++) { // upper cases
y = y << 1;
_itoa((int)sqrt(y), tmp, 10);
sscanf(tmp, "%x", &tmp1);
f[x] = tmp1 + 5;
}
for (x=36,z=23; x<62; x++,z++) { // lower cases
z = z << 1;
_itoa((int)sqrt(z), tmp, 10);
sscanf(tmp, "%x", &tmp1);
f[x] = tmp1 + 74;
}
}

int
init_dict(void)
{
int i=0;
char buf[50+1];
FILE *fp = fopen("antworth.txt", "r";

if (!fp) {
fprintf(stderr, "Cannot open dict file\n";
exit(0);
}

while (fgets(buf, 50, fp)) if (strlen(buf) == 8+1/*newline*/) {
strncpy(words[I], buf, 8);
words[i++][8] = 0;
}

return i;
}

/*
* used to compare each possible solution against the dictionary words
*/
int __cdecl
cmp(const char *a, const char *b)
{
return stricmp(a, b);
}

void
main(void)
{
unsigned code[MAXLEN]; // leftover at every step
int dictwords, // number of words selected from the dictionary
solutions=0; // possible alphabetic solutions
int i, j, idx;
int last_i[MAXLEN] = {0};
char c;
char buf[8+2]; // possible solution, to be filtered against the dictionary
void *t; // bsearch() result

init_f();
dictwords = init_dict();
printf("Selected %d 8-character words...\n", dictwords);

// first, we find the password length
for (i=2; i<MAXLEN; i++) if (CODE%i == 0) {
printf("found divisor %d => password length may be %d\n", i, i+1);
idx = i;
}

code[idx] = CODE / idx;
printf("\n";

j = idx; // set the initial level to the higher one

while (1) {
if (j != 1) {
for (i=last_i[j]; i<62; i++) if ((code[j]-f[I])%(j-1) == 0) break;
last_i[j] = i+1;
} else { // last level
for (i=last_i[1]; i<62; i++) if (code[1] == (unsigned)f[I]) break;
last_i[j] = i+1;
if (i < 62) // found a complete solution
if (last_i[1]>10 && last_i[2]>10 && last_i[3]>10 &&
last_i[4]>10 && last_i[5]>10 && last_i[6]>10 &&
last_i[7]>10) // only if no numbers are interspersed
// a loop to substitute the first character
for (c='A'; c<='Z'; c++) {
++solutions;
sprintf(buf, "%c%c%c%c%c%c%c%c\n", c,
base[last_i[1]-1], base[last_i[2]-1],
base[last_i[3]-1], base[last_i[4]-1],
base[last_i[5]-1], base[last_i[6]-1],
base[last_i[7]-1]);

t = bsearch(&buf, words, dictwords, 8+1, cmp);
if (t) printf("found solution %s\n", buf);
}
}

// try going one level down
if (i+1<62 && j>1) {
code[j-1] = (code[j]-f[I]) / (j-1);
j--;
} else {
// backstep up, resetting lower levels
if (++j > idx) break; // done
for (i=j-1; i>=0; i--) last_i[I] = 0;
}
}

printf("Alphabetic solutions filtered by dictionary: %d\n", solutions);
}


ANTWORTH.TXT was the dictionary I used, found at http://rabbit.eng.miami.edu/dics/

Maybe using another dictionary we could have more luck?

Best regards, bilbo

laola
September 13th, 2005, 10:11
Not only with another dictionary, just keep in mind that things like "easy2see" have 8 chars as well Maybe just filter out the entries which have not let's say 4 or more letters that resemble natural words. I am too lazy to generate the string list myself, maybe you could send me a snippet (20-30 lines will do nicely) by PM? Just so that I can see how the strings look.
I guess we may need something like a dictionary permutator. I think l0pht presented a similar tool for determining the weakness of user passwords for windows machines. If the wet stuff in my head isn't too far out, of course
Might be helpful in our case as well

edit: You may want to try the nine times larger "amerlen" dictionary as well

aXLe
September 13th, 2005, 18:06
Good stuff Yeah - I'm still going on it.

One thing I realised though is that since the actual password is the name of a page, which is not case sensitive, then the first character will be in the range 0-9, a-z (can ignore A-Z). 20638*36 is a lot less than 20638*62, but unfortunately is still rather a lot

This assumes of course that the author of the actual page did not realise that the 1st character was being ignored - else they may have used some other character (though would have to be legal for a page/file name).

I would mention the link to the actual page I am attempting to gain access to, but I fear it would result in this thread being deleted?

bilbo - that was some pretty slick code there - good stuff


On the dictionary thing, you'd need one that included l337 words etc - I noticed that one of the potential passwords in the list was ".NVMwar3" - the VMwar3 thing seemed too coincidental to me, with the capitalisation of "VM" and the "3" instead of an "e", but alas I've tried a-z,0-9 in front with no luck

Oh yeah - one more thing while I think of it. Since the resulting url is a html file that resides in the same folder on the server ( at the root of the web page so to speak) and is not therefore protected by any other security, is there any way to view a list of .html files residing on the server? I'm guessing not.

aXLe
September 13th, 2005, 18:37
Quote:
[Originally Posted by bilbo]You're welcome...
But the initial problem is still there: you have to try accessing 20638*62 documents; only one will not return you error 404 (not found) :-)


Is there an easy way to script that? Taking your output file as input?

ie direct the result of your original code out to a text file, then use this as the input for a script that tests against the URL and logs the results (substituting the "." for the characters 0-9, a-z) - if not a 404 error. I've not tried doing that before - can it be scripted?

On that, I guess we could remove any duplicates from the output that differ only in case, though there probably aren't any/many.

laola
September 13th, 2005, 20:50
Well, of course it can be scripted. In perl, you shouldn't need more than a few lines to read line by line from a text file, form an url request and process the web server response.

However, whipping out 1.3 million web site requests may qualify you for some inspection from authorities for DOS attempt

And another side note: Why do you think web site page names are case-insensitive? I admit it can depend on the web server running, but on unix and derivatives, file names can be case-sensitive for sure. I am too lazy to try it, but I guess one can have helluva lot of fun with pages like index.html, Index.html, Index.Hmtl, and so on. Could make up for some riddle of notpr0n quality (google for notpr0n if you like creative riddles)

Woodmann
September 13th, 2005, 21:58
I am going out on a very weak limb here....

It is true that *nix systems use case sensitive passwords and file names.
I dont see how you can discount the first digit/letter to not be in the A-Z range.
And why not "L337" code ??

We need to pass an 8 digit/letter/character passwd to gain access. We all know that using characters enhances protection because most will use a dictionary attack.
So how do you incorporate "L337" into a brute force attack ?? This I know nothing of.

Lastly, what if the first digit/letter/character is passed off to be the last digit/letter/character ?? It provides a way to obsfucate the true passwd.
ERRRRrrrrrrrrrrr... How do I explain this ??
You type in "12345" and it gets converted to something you cannot see ??
You are left to try and understand why "12345" does not work even though you can see it inside the code.

Just thinking outside the box........

Woodmann

LLXX
September 14th, 2005, 02:37
Quote:
[Originally Posted by laola]Well, of course it can be scripted. In perl, you shouldn't need more than a few lines to read line by line from a text file, form an url request and process the web server response.

However, whipping out 1.3 million web site requests may qualify you for some inspection from authorities for DOS attempt

That is why you use, rotating+chained proxies, for bruteforcing like that. 1.3 million hits dispersed roughly evenly all over the place (and over a long period of time, a few days or a week) aren't as suspicious as 1.3 million from one IP address in a few hours.

Another thing, I highly doubt the password is going to be a standard dictionary word or anything recognisable, since they are obviously trying to obscure the page name. It'll probably be very random.

+At least you're lucky the page name isn't the MD5 of some wierd string

bilbo
September 14th, 2005, 02:39
Quote:
[Originally Posted by aXLe]One thing I realised though is that since the actual password is the name of a page, which is not case sensitive, then the first character will be in the range 0-9, a-z (can ignore A-Z). 20638*36 is a lot less than 20638*62, but unfortunately is still rather a lot

That's not correct, generally speaking, as laola and Woodmann pointed out.
Try for example http://www.atlapedia.com/index.html and http://www.atlapedia.com/Index.html

Quote:
[Originally Posted by aXLe]Oh yeah - one more thing while I think of it. Since the resulting url is a html file that resides in the same folder on the server ( at the root of the web page so to speak) and is not therefore protected by any other security, is there any way to view a list of .html files residing on the server? I'm guessing not.

Your guess is correct, again generally speaking, because the HTTP server could (but even could not) block your directory listing request. But you could have other chances. For example FTP could be enabled...

Quote:
[Originally Posted by laola]Could make up for some riddle of notpr0n quality (google for notpr0n if you like creative riddles)

Nice, but too complicated for my 0-1 brain... Here are the first 80 levels solved: http://forums.miniclip.com/showpost.php?p=193920&postcount=251

Woodmann
September 14th, 2005, 19:17
Howdy,

I was looking at this little script in more detail.
I took a look at the original script and tried a few user names and passwords to see what it generated.

Of course the output in numbers is still a riddle to me.
I am fairly sure that the thought that it is looking for a set number of characters is not true. I also dont think it passes over the first character.

I have tried a 10 letter word that generates a 5 digit number.
I have tried a 4 letter word that generates a 5 digit number.
I have tried a 6 letter word that generates a 7 digit number.

The script that has been posted here has been altered somewhat.
Also, in the original script, the password entered will always return the same generated number.

Woodmann

bilbo
September 15th, 2005, 02:31
Hi, Woodmann,

I am attaching a little executable, derived from the source I attached in a previous post, which I hope will make better intelligible the used algorithm.

The program first shows the constants which are assigned to each character of the password (always the same constants), and then it shows how the code is built, step by step.

Let's see the output for the password goofy.

Code:

Characters to constants mapping:
0->23 1->535 2->1047 3->1559 4->2071 5->2583 6->3095 7->3607 8->4119 9->4631 A->12 B->21 C->26 D->38 E->53 F->72 G->101 H->139 I->294 J->375 K->584 L->841 M->1164 N->1678 O->2425 P->4989 Q->6478 R->10076 S->14494 T->21785 U->30621 V->69677 W->87452 X->139356 Y->201113 Z->278810 a->80 b->83 c->93 d->99 e->113 f->131 g->159 h->194 i->346 j->416 k->619 l->861 m->1165 n->1649 o->2256 p->4766 q
->6077 r->9554 s->13713 t->20576 u->28894 v->65661 w->82386 x->131248 y->164801 z->262524

Enter password: goofy
step 1, character 'o': (partialcode 0 + mapping 2256) * 1 = 2256
step 2, character 'o': (partialcode 2256 + mapping 2256) * 2 = 9024
step 3, character 'f': (partialcode 9024 + mapping 131) * 3 = 27465
step 4, character 'y': (partialcode 27465 + mapping 164801) * 4 = 769064

Final code 769064


Quote:
I am fairly sure that the thought that it is looking for a set number of characters is not true.
It is not looking for a set number of characters, but a given code can be generated only by a settled number of characters.
Look! The last operation performed on the partial code (step 4 for goofy) is a multiplication by the number of characters - 1 (4).
This means that the number of characters required to generate some code, minus one, must be a divisor of it.
The code proposed by aXLe, 432195701, is equal to 7*61742243(prime), so the only possible password length is 7+1 = 8.
The code coming out from "goofy" sample, 769064, is equal to 2*2*2*251*383 (I used RSATool to factorize it). This means that possible password lengths are theoretically more than one: 2+1(3), 2*2+1(5), 2*2*2+1(9).

Quote:
I also dont think it passes over the first character.
Please replace password "goofy" with "woofy" and the same code will pop out.

Quote:
I have tried a 10 letter word that generates a 5 digit number.
This sounds impossible to me.
The littlest constant is mapped for the character 'A', and is 12. This means that the littlest code will be obtained with a password made by all 'A'. But the code for 10 A (AAAAAAAAAA) is 11836908 (8 digits). It is impossible, given a 10-characters password, to find a littler code than that!

Best regards, bilbo

EDITED: by the way, the "goofy" password has only 62(first character)*35 collisions. This is the list:
Code:

.uNO3
.NuO3
.lUc6
.Ulc6
.bUn6
.Ubn6
.u6cE
.6ucE
.hUOG
.UhOG
.u6bb
.6ubb
.eU5e
.Ue5e
.ucqe
.cuqe
.eU4n
.Ue4n
.rTln
.Trln
.UGkq
.GUkq
.lO5y
.Ol5y
.cO8y
.Oc8y
.NK9y
.KN9y
.D8Ly
.8DLy
.A4Py
.4APy
.oofy
.MJqy
.JMqy

aXLe
September 15th, 2005, 07:11
Quote:
[Originally Posted by Woodmann]Howdy,

The script that has been posted here has been altered somewhat.
Also, in the original script, the password entered will always return the same generated number.

Woodmann


The script posted is exactly as per the live site, except that rather than direct you on to password.html, I changed it to pop up a correct/failed box - I also removed the 3 attempts bit.

The actual algorithm and CODE variable is the same

I'm pretty sure this actual host is running IIS (returns IIS error about page not found) - does that make it case insensitive as far as the final destination url goes?

bilbo
September 15th, 2005, 09:33
Quote:
[Originally Posted by aXLe]I'm pretty sure this actual host is running IIS (returns IIS error about page not found) - does that make it case insensitive as far as the final destination url goes?

In that case you're right to assume that URLs are case-insensitive
bilbo

woody
November 14th, 2005, 12:48
the code
<pre>
for (y=1; y<lpass; y++)
{
for(x=0; x<62; x++)
{
if (K[y]==base[x])
{
code+=f[x]
code*=y
}
}
}
alert("Your access code is: "+code+"\n\n\nWrite it down!\n\n\n\nYou need it below!";
alert("Be sure to also create the protected file, "+pass+".html";
</pre>

means link will give you any value dependent on entered password . That means - if i am not wrong, there is nothing to reverse as there is no number to compare .

The first revision of psw check could be possible to reverse in guess and try manner (not pure brute force less tie to spend) but not this one.

aXLe
July 21st, 2006, 02:32
Its been a while since I last looked at this. The other day I pulled out bilbo's code and modified it slightly so it adds all the additional combinations for the missing 1st character (ie if password was .edrtgdf, then I modified it to generate 0edrtgdf, 1edrtgdf, 2edrtgdf,..... Aedrtgdf,Bedrtgdf, etc) using 0-9 and A-Z only.

I ended up with around 750000 potential passwords(!).

Then I wrote an app in VB6 to attempt each one on the server with a delay between them. I split the list into 4, and ran 4 simultaneous sessions.

I calculated that I should have it done (find the correct password) within a day - took only a couple of hours luckily and I was in