clone4 has asked for the wisdom of the Perl Monks concerning the following question:

Hi Monks,
I have written simple bruteforcer, as a solve to one javascript challenge
function Check(checksum) { var tab = " azertyuiopqsdfghjklmwxcvbnAZERTYUIOP +QSDFGHJKLMWXCVBN0123456789_$&#@"; var entry = document.forms[1].elements[0].value; var n = entry.length; var sum = 1; for(var i=0;i<n;i++) { var index = tab.indexOf(entry.substring(i,i+1)); sum = sum+(index*n*i)*(index*i*i); } if(sum==checksum) { window.location = entry+".php"; } else { alert("Wrong Pass!! Try Again."); } return false; }
the password equal to the checksum can't be longer then 20 characters, and the checksum tested is 88692589. Anyway I wrote a simple bruteforcer, however i've got no results so far... Here is the code:
$a = '@'; $b = '@'; $c = '@'; $e = '@'; $f = '@'; $g = '@'; $h = '@'; $j = '@'; $k = '@'; $l = '@'; $m = '@'; $p = '@'; $o = '@'; $r = '@'; $s = '@'; $t = '@'; $u = '@'; foreach $r ('a'..'z','A'..'Z','1'..'9','_','$','&','$','#','@',' ') { foreach $s ('a'..'z','A'..'Z','1'..'9','_','$','&','$','#','@',' ' +) { foreach $t ('a'..'z','A'..'Z','1'..'9','_','$','&','$','#','@' +,' ') { $tab = " azertyuiopqsdfghjkl +mwxcvbnAZERTYUIOPQSDFGHJKLMWXCVBN0123456789_\$\&\#\@"; $entry = $a . $b . $c . $o . $r . $s . $t; $n = length $entry; $sum = 1; $checksum = 88692589; for($i = 0; $i<$n; $i++) { $index1 = index ( $tab, $sub = su +bstr($entry, $i, 1)); $sum = $sum+($index1 * $n * $i)*($ +index1 * $i * $i); } print "$entry $sum $checksum\n"; if ($sum == $checksum) { print "Got one!\n"; print "password == $entry\n"; die; } } }
It's not the whole code, but I just repeat the same block and add characters to the $entry variable.
any ideas why it doesn't work?
Thanks for any reply
clone

Replies are listed 'Best First'.
Re: Simple Bruteforcer not working
by samtregar (Abbot) on Mar 20, 2008 at 19:26 UTC
    How many years did you run it for before deciding it didn't work?

    There are many easier ways to solve this problem, but before I give you a solution you must tell me what you're trying to break into. I'd like to think anything important would have better security than this but I'm certainly not going to help you rob a store.

    -sam

Re: Simple Bruteforcer not working
by grizzley (Chaplain) on Mar 20, 2008 at 19:37 UTC

    Count number of possibilities: 20 chars, on each position ca. 70 possibilities, that makes 70**20 = (1.7 * 10**9) * (86400 * 4) * 70**12 Let's say you check 1.7 * 10**9 operations per second, that means 4 * 70**12 days to check all possibilities. How long does your script work already? :)

Re: Simple Bruteforcer not working
by starbolin (Hermit) on Mar 20, 2008 at 20:35 UTC

    Without running your script and checking the total of the sequence myself one guess would be that it is not generating the sequence you think it should be? Try running it with a smaller subset of characters (like two or three) and see if generates the sequence you think it should. Also you should be able to get a match on a shorter target first before running on the full length target.

    Have you manually checked that the checksums are correct? It seems like $sum = $sum+($index1 * $n * $i)*($index1 * $ +i * $i); would generate an unusually large number. Note that since perl uses doubles and a lot of old C code uses ints that are 16 bits if your checksum algorithm relies on a 16 bit wrap you are going to get garbage.


    s//----->\t/;$~="JAPH";s//\r<$~~/;{s|~$~-|-~$~|||s |-$~~|$~~-|||s,<$~~,<~$~,,s,~$~>,$~~>,, $|=1,select$,,$,,$,,1e-1;print;redo}
      firstly to say, i've been working with perl(my first programming language) few days, and yeah I know there are probably tons of better solutions then this one, however that's what i'm capable of now... secondly this script is to solve javascript challange from one website. and lastely i've left it for a while, but yeah it would take years, so stopped it and started to go through the source script again, and I don't know if i'm right but the value of the checksum should rely just on the length of the password and last two characters, is that right ?