Can you crack this code?

[meeble]

My friend uses this code on his paysite for people with a password. I've told him I think it's too weak as it's JavaScript but he says it's fine. Can anyone crack this or is it ok?

Can you find out the password? I admit, I can't...

<script>

var pass=new Array()
var t3=&quot;&quot;
var lim=5
pass[0]=&quot;SKGGk6Y6CObrhkR&quot;
pass[1]=&quot;hUYRL9vGfkjpnfu&quot;
pass[2]=&quot;kYU9MqqvbPMEXcZ&quot;
pass[3]=&quot;DwyysHn5vwZML1f&quot;
pass[4]=&quot;5ehoWp1uSs60U1IF&quot;
pass[5]=&quot;62ehoWp1uSs60U1I&quot;

//configure extension to reflect the extension type of the target web page (ie: .htm or .html)
var extension=&quot;.html&quot;
var enablelocking=0
var numletter=&quot;0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ&quot;
var temp3=''
var cur=0


function max(which){
return (pass[Math.ceil(which)+(3&15)].substring(0,1))
}

function testit(input){
temp=numletter.indexOf(input)
var temp2=temp^parseInt(pass[phase1-1+(1|3)].substring(0,2))
temp2=numletter.substring(temp2,temp2+1)
return (temp2)
}


function submitentry(){
t3=''
verification=document.password1.password2.value
phase1=Math.ceil(Math.random())-6+(2<<2)
var indicate=true
for (i=(1&2);i<window.max(Math.LOG10E);i++)
t3+=testit(verification.charAt(i))
for (i=(1&2);i<lim;i++){
if (t3.charAt(i)!=pass[phase1+Math.round(Math.sin(Math.PI/2)-1)].charAt(i))
indicate=false
}
if (verification.length!=window.max(Math.LOG10E))
indicate=false
if (indicate)
window.location=verification+extension
else
alert(&quot;Invalid password. Please try again&quot
}
</script>

 

[modalman]

First of all, I would like to credit all the programmers on this thread that have withheld the publishing of the password. It seems to me Meeble, that you have failed to grasp the ethical reasons why this has happened.

Although you may be a very responsible, honest person and may even feed the pigeons in your local park and help older people cross the road you must still realise that if we released this password to you then what we have done is no different to actually hacking into a website which is illegal and a criminal offense.

Lets put it this way. If you owned an ecommerce website with a javascript password protected back office and somebody placed the script on a forum to be hacked claiming to be your friend and the password was revealed, how would you feel if the next day your customers started ringing you up complaining that their credit cards had been misused since they purchased from your website. You're postings seem to condone this type of action! Maybe you haven't thought about this enough.

I think this thread has exposed the mentality of these programmers to reveal that they are reassuringly responsible and honest, and this gives the web a good name.

The ultimately obvious simple solution to the above dilemma was to just get your friend to read the thread and this has been pointed out a few times. Doing this would have avoided all of the above.

I hope you can put yourself in our shoes and understand where we are coming from.



ASCII silly question, get a silly ANSI

 

[mwolf00]

BillyRay and modalman -

Since the pswd has been revealed by the original poster, should I post the function I wrote to crack it?

Programming today is a race between software engineers striving to build better and bigger idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning. - Rick Cook (No, I'm not Rick)

 

[modalman]

mwolf00
Meeble has said that maybe his friend has cut and paste this script from another site so its possible that multiple websites use it for validation. This could be any number from 2 to 100,000. Its probably highly unlikely though that anyone viewing this thread will come across one of those sites but I think personally that its best to leave it off the forum. However at the end of the day its up to you.

ASCII silly question, get a silly ANSI

 

[BillyRayPreachersSon]

Personally, I think that any site that uses such a weak entry scheme deserves to get hacked... And chances are that not many are using that method... Certainly no reputable site I can think of does.

mwolf00 - I have no problems with you posting your code... Other people might object, however.

Dan

 

[mwolf00]

I'm leaning towards billyRay's side on this, I've NEVER come across a site with client-side password protection (haven't been to too many &quot;seedy&quot; sites though. Here's the very simple code...

function solvePassword(){
phase1=Math.ceil(Math.random())-6+(2<<2)
pswd = &quot;&quot;
ltrArr = numletter.split(&quot;&quot

for (x=0; x<5; x++){
for (y=0; y<ltrArr.length; y++){
converted = testit(ltrArr[y])
if (converted == pass[phase1+Math.round(Math.sin(Math.PI/2)-1)].charAt(x)){
pswd += ltrArr[y]
document.getElementById(&quot;solved&quot.innerHTML = pswd
break;
}
}
}
}

Programming today is a race between software engineers striving to build better and bigger idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning. - Rick Cook (No, I'm not Rick)

 

[stormbind]

very clever mwolf. i'm impressed

----------
I'm willing to trade custom scripts for... [see profile]

 

[BillyRayPreachersSon]

James,

I posted this URL in another thread...

It's a client-side password protection scheme called &quot;Password Pro&quot;. I'd suggest this to your friend as a good alternative, should he still desire to do client-side protection.

I found it incredibly hard to bypass... My cracking program was running 24/7 for 3 months, and then I gave up (there were many &quot;matches&quot;, but none were correct).

The URL is:

http://www.geocities.com/~lef/

I'm not saying it's uncrackable, but it seems to be a lot more secure to use than the routine one your friend currently has.

That's my professional advice ;o)

Dan

 

[mwolf00]

BillyRay -

I've started to solve the &quot;password Pro&quot; and you can write a program that will give possible solutions, but since the redirect IS the password, you have to choose the correct one.

Programming today is a race between software engineers striving to build better and bigger idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning. - Rick Cook (No, I'm not Rick)

 

[mwolf00]

BillyRay -

I've written code to crack password pro, but it gets really laggy after 3 letters. Some passwords have only one solution while others have many (&quot;wolf&quot; had about 30). But when you get many, only a few make sense to try. Do you have a test page I can try it on? If the password is very long, it will take a while to solve, so please try to limit it to 5 letters for now...

Programming today is a race between software engineers striving to build better and bigger idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning. - Rick Cook (No, I'm not Rick)

 

[Einstein47]

The password is very short - if you can't get it from the clues on this page, my sympathies.

P.S. It only took me 3 min. to crack the code. And that was all creating the test page. I got the right pass on my first try.

As they say, &quot;It's all in the wrist.&quot;

Einstein47
(&quot;The pure and simple truth is rarely pure and never simple.&quot; - Oscar Wilde)

 

[adam0101]

This one is next to impossible!

Ok, I know this thread should just die, but I have another challenge. This is an encryption function I wrote. If any of you can crack either the password or the page the script goes to, you are by far the master of JavaScript. I'll give you a hint so you know if you got it right or not. The page name has something to do with the other password mentioned in this thread. Here's the code:

_______________________________________________________________________________________________________________________________________________________________________

<script>
String.prototype.unencrypt = function(){
  var chars=&quot;ABCGHIJDEFQRvwxSTU!V@W#X$Y%Z^c&(*d_e:fg)hi01234qrst5,678K[LM]N>OP9< '{\n\t\r};.-+=/\\abjklm|nopuy?zABCGHIJDEF&quot;;
  var output=&quot;&quot;,theKey=arguments[0];
  for(var i=0;i<this.length;i++){
    output+=chars.lastIndexOf(this.charAt(i))>-1 ? chars.charAt(chars.lastIndexOf(this.charAt(i))-(theKey.charAt(i%theKey.length)-0)) : this.charAt(i);
  }
  return output;
}
try{
  var password=prompt('Please enter the password','');
  eval(&quot;iA:BoeCLayz*aMsAA\\1r23k.Fgr2Pq[8AKtLKH\\1tA?;&quot;.unencrypt(password))
}
catch(er){
  alert('The password you entered is invalid.');
}
</script>

I'll even give you the function I used to encrypt it in the first place:

String.prototype.encrypt = function(){
  var chars=&quot;ABCGHIJDEFQRvwxSTU!V@W#X$Y%Z^c&(*d_e:fg)hi01234qrst5,678K[LM]N>OP9< '{\n\t\r};.-+=/\\abjklm|nopuy?zABCGHIJDEF&quot;;
  var output=&quot;&quot;,theKey=arguments[0];
  for(var i=0;i<this.length;i++){
    output+=chars.indexOf(this.charAt(i))>-1 ? chars.charAt(chars.indexOf(this.charAt(i))+(theKey.charAt(i%theKey.length)-0)) : this.charAt(i);
  }
  return output;
}

Adam
while(ignorance==true){perpetuate(violence,fear,hatred);life=life-1};

 

[adam0101]

Well, as soon as I posted the code I thought of a way to crack my uncrackable code. The script is still running to find the password, but I know it'll find it eventually. So if you give up, let me know and I'll post the code to crack it.

In the mean time, I'll be making an even harder one to crack.

Adam
while(ignorance==true){perpetuate(violence,fear,hatred);life=life-1};

 

[BillyRayPreachersSon]

Adam,

What are you passing as the parameter to your encrypt function? It seems to expect at least 1 argument, else theKey is undefined.

I assume you're calling something like:

"realpassword".encrypt(keyString);

But you don't mention what the key is... After all, we're only trying to get the password, not the password AND a key, right? ;o)

Dan

 

[adam0101]

The password is the key. The password is the only argument that is passed for both the encrypt and unencrypt methods. Sorry, I should have used the same terminology. theKey could be changed to thePassword.

Also, the password does not equal the web page name. The password unlocks the web page name, then the browsers navigates to it.

Adam
while(ignorance==true){perpetuate(violence,fear,hatred);life=life-1};

 

[adam0101]

In other words:

&quot;theCommandToNavigateToThePage&quot;.unencrypt(password);

Adam
while(ignorance==true){perpetuate(violence,fear,hatred);life=life-1};

 

[mwolf00]

Adam,

I will try to crack it if I get a chance. BTW - when you have a very long string without a space in it, it spreads the whole thread out like this. Even thought the code won't look right, its better to put a space in the line.

BillyRay -

I think that I need to take back what I said about cracking password pro. I wrote code to crack the password if it was 5 characters or less. Not only does the time to crack increase exponentially with each letter increase, but the number of possible solutions does also. While a 3 character password might have 5 sollutions a 4 character might have a few hundred (and might not). When I allow for 5 characters, that increases to a few thousand. Since it allows for 10 character passwords, well it gets very hard to crack...

Programming today is a race between software engineers striving to build better and bigger idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning. - Rick Cook (No, I'm not Rick)

 

[BillyRayPreachersSon]

Yeah - I'm guessing that the site I was trying to crack access to was using a 6-or-more letter pwd... Of course, I have no real idea, as I never found it, but yes - to have Password Pro be secure, using 10 characters is definately recommended.

Dan

 

[mwolf00]

Dan -

Actually - just the possibility of a 10 letter password makes it VERY tough. Even if you only use 4 letters...

If your password is &quot;Jake&quot; (code=2844)

checking up to 4 letters = 194 possible answers
checking up to 5 letters = 3690 possible answers

However if you use a code with a high value there are fewer possibilities..

&quot;VWXYZ&quot; (code=2861151) has only one solution in a program that only allowes for 5 letter password.

Programming today is a race between software engineers striving to build better and bigger idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning. - Rick Cook (No, I'm not Rick)

 

[adam0101]

Is anyone still trying to crack my code? If so, I'll wait to post the code that cracks it. In the mean time, I made two more functions that are way better. If you can crack either the password or the page this code navigates to, I'll give you ten bucks ($10). That's a promise. Here's the code.

<script>
function encrypt(msg,pwd){
var a,output='';
for(var i=0;i<msg.length;i++){
a=&quot;0000&quot;+(msg.charCodeAt(i)+pwd.charCodeAt(i%pwd.length));
output+=a.substring(a.length-4);
}
return output;
}

function unencrypt(msg,pwd){
var output='';
for(var i=0;i<msg.length;i+=4){
output+=String.fromCharCode(msg.substring(i,i+4)-pwd.charCodeAt((i/4)%pwd.length));
}
return output;
}

try{
var password=prompt('Please enter the password','');
eval(unencrypt(&quot;0184021202060162019302060222023100920207022202080181021702120156019401510216022901470201017201430173021202240110019802060196021901470173020802270181018402060159018902170228019201430214022702100198014702110161019302130146&quot;,password))
}
catch(er){
alert('The password you entered is invalid.');
}
</script>

Adam
while(ignorance==true){perpetuate(violence,fear,hatred);life=life-1};

 

[mwolf00]

I'll take a look at the latest - haven't looked at the first one yet...

Programming today is a race between software engineers striving to build better and bigger idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning. - Rick Cook (No, I'm not Rick)