General Car Related Discussion. To discuss anything that is related to cars and automotive technology that doesnt naturally fit into another forum catagory.

WEBPAGE HACKING TEST - How secure is my encryption?

Thread Tools
 
Search this Thread
 
Old Jul 19, 2004 | 01:16 PM
  #1  
Stu.H's Avatar
Stu.H
Thread Starter
10K+ Poster!!
20 Year Member
Liked
 
Joined: May 2003
Posts: 11,977
Likes: 0
From: Brierley Hill
Default WEBPAGE HACKING TEST - How secure is my encryption?

This will be a good test for those that know about secured webpage flaws.

Its a simple bit of code that I devised in basic and ported it across to a webpage, and was wondering how secure it is. I obviously know how it works inside out, but from the information you have, I cant see it at all possible to get the username AND password to allow authentication.

And yes, there is both a username and password.



HERE!!!!
Reply
Old Jul 19, 2004 | 01:17 PM
  #2  
Jim Galbally's Avatar
Jim Galbally
20K+ Super Poster.
 
Joined: May 2003
Posts: 20,599
Likes: 0
From: Ramsgate, Kent Drives: E39 530D Touring
Default

404 here
Reply
Old Jul 19, 2004 | 01:21 PM
  #3  
Stu.H's Avatar
Stu.H
Thread Starter
10K+ Poster!!
20 Year Member
Liked
 
Joined: May 2003
Posts: 11,977
Likes: 0
From: Brierley Hill
Default

try now mate
Reply
Old Jul 19, 2004 | 01:25 PM
  #4  
Phil's Avatar
Phil
Jeebus
iTrader: (1)
 
Joined: May 2003
Posts: 8,663
Likes: 0
From: Staffordshire, UK
Default

Well it beat me!
Reply
Old Jul 19, 2004 | 01:25 PM
  #5  
Jim Galbally's Avatar
Jim Galbally
20K+ Super Poster.
 
Joined: May 2003
Posts: 20,599
Likes: 0
From: Ramsgate, Kent Drives: E39 530D Touring
Default

you can do a view...source which will give you your encryption algorythm:
Code:
// **** ENCRYPTS USERNAME > RESULT IN USERCODE
i=0
n=0
while(i < username.length){
do{
 m = username.charCodeAt(i);
    if(m==100){
    m = 69}
 usercode *= m;
    while (usercode > 1000000000000){
    usercode = usercode / 10
    usercode = Math.round(usercode)}
 n++}
 while (n <= i);
 n = 0;
 i++}
// *********************************************

// **** ENCRYPTS PASSWORD > RESULT IN PASSCODE
i=0
n=0
while(i < password.length){
do{
 m = password.charCodeAt(i);
    if(m==100){
    m = 69}
 passcode *= m;
    while (passcode > 1000000000000){
    passcode = passcode / 10
    passcode = Math.round(passcode)}
 n++}
 while (n <= i);
 n = 0;
 i++}
which if i could be arsed to sit here with a calculator n work it out i could work out what password etc. will let me in...
Reply
Old Jul 19, 2004 | 01:27 PM
  #6  
turbo man's Avatar
turbo man
PassionFord Regular
 
Joined: Jul 2003
Posts: 445
Likes: 0
From: Birmingham
Default

lol, owned
Reply
Old Jul 19, 2004 | 01:27 PM
  #7  
Jim Galbally's Avatar
Jim Galbally
20K+ Super Poster.
 
Joined: May 2003
Posts: 20,599
Likes: 0
From: Ramsgate, Kent Drives: E39 530D Touring
Default

also i see it links directly to another webpage, so you could bypass it altogether if you knew the name of the redirected webpage
Reply
Old Jul 19, 2004 | 03:18 PM
  #8  
AD-RS1600i's Avatar
AD-RS1600i
Too many posts.. I need a life!!
 
Joined: Aug 2003
Posts: 985
Likes: 2
From: Northamptonshire
Default

Assuming what Jim is saying is correct and all the password authentication is done client side, I reckon you should rewrite the system and place it on the server side i.e. in something like a php script. As if the workings of you security are on public view (like client side code is) some smart arse will work it out!
Reply
Old Jul 19, 2004 | 03:25 PM
  #9  
Phil's Avatar
Phil
Jeebus
iTrader: (1)
 
Joined: May 2003
Posts: 8,663
Likes: 0
From: Staffordshire, UK
Default

Originally Posted by Jim Galbally
also i see it links directly to another webpage, so you could bypass it altogether if you knew the name of the redirected webpage
The page name is the same as the password though, so if you know one then you know both!
Reply
Old Jul 19, 2004 | 03:41 PM
  #10  
Gra's Avatar
Gra
PassionFord Post Whore!!
 
Joined: May 2003
Posts: 6,220
Likes: 0
From: Middle of Nowhere
Default

surley it would also be good to write an applet so no right click is allowed as well tho
Reply
Old Jul 19, 2004 | 03:55 PM
  #11  
Jamz's Avatar
Jamz
Advanced PassionFord User
 
Joined: Apr 2004
Posts: 2,385
Likes: 0
From: Naaaaarch
Default

Not going to stop anyone doing View->Source
Reply
Old Jul 19, 2004 | 04:02 PM
  #12  
Gra's Avatar
Gra
PassionFord Post Whore!!
 
Joined: May 2003
Posts: 6,220
Likes: 0
From: Middle of Nowhere
Default

i agree, but it would make it a bit harder tho surley, tis alli am saying
Reply
Old Jul 19, 2004 | 04:08 PM
  #13  
Jim Galbally's Avatar
Jim Galbally
20K+ Super Poster.
 
Joined: May 2003
Posts: 20,599
Likes: 0
From: Ramsgate, Kent Drives: E39 530D Touring
Default

heres a thouht... are you doing this as a fun learning thing or do you simply want some easy security on there? as im pretty sure IIS has security stuff built in anyway using the normal bits n bobs (i think it even does SSL too) would be muchos easier
Reply
Old Jul 19, 2004 | 04:13 PM
  #14  
Anonymous's Avatar
Anonymous
Banned
 
Joined: Dec 2002
Posts: 142
Likes: 1
Default

people, just because you can see the formula does not mean you can break it as any good formulas are one way hence the password is encryted again to to see if it's correct.

As to if this formula is one way and how 'strong' it is could only be answered by someone who is good with maths which I am not. So Jim put your calculator away as it will not help you here!!LOL

Is it using a standard one-way encrytion formula or did you make one up ?
Reply
Old Jul 19, 2004 | 04:17 PM
  #15  
Anonymous's Avatar
Anonymous
Banned
 
Joined: Dec 2002
Posts: 142
Likes: 1
Default

--edited

scrap that, had a good look at, pretty sure it is a one way formula but at a guess it's not very strong and if you really wanted to a program could be written to give you the all string input possbility's for a given string input length from a passcode.
Reply
Old Jul 19, 2004 | 04:43 PM
  #16  
Stu.H's Avatar
Stu.H
Thread Starter
10K+ Poster!!
20 Year Member
Liked
 
Joined: May 2003
Posts: 11,977
Likes: 0
From: Brierley Hill
Default

well u wont work it out, its not physically possible

no calculator in the world will give you the answer

look at the code again.

Reply
Old Jul 19, 2004 | 04:50 PM
  #17  
Stu.H's Avatar
Stu.H
Thread Starter
10K+ Poster!!
20 Year Member
Liked
 
Joined: May 2003
Posts: 11,977
Likes: 0
From: Brierley Hill
Default

also its not possible to disable the right click, its still easy to get round that.

all pages get cached in the temporary internet files, and these can simply be loaded with notepad to view.

Originally Posted by turbo man
lol, owned
Reply
Old Jul 19, 2004 | 04:51 PM
  #18  
ballin's Avatar
ballin
10K+ Poster!!
iTrader: (1)
 
Joined: Apr 2004
Posts: 10,863
Likes: 12
From: .
Default

thats what i was thinking, just coming out with "if i could be bothered then i could work it out" doesnt really cut it, work it out or dont say you can

oh, and it beats me
Reply
Old Jul 19, 2004 | 05:52 PM
  #19  
Stu.H's Avatar
Stu.H
Thread Starter
10K+ Poster!!
20 Year Member
Liked
 
Joined: May 2003
Posts: 11,977
Likes: 0
From: Brierley Hill
Default

bttt

Reply
Old Jul 19, 2004 | 06:01 PM
  #20  
Dan B's Avatar
Dan B
Advanced PassionFord User
 
Joined: Apr 2004
Posts: 2,364
Likes: 0
Default

*sits down with a piece of paper and a Unicode-converter*
Reply
Old Jul 19, 2004 | 06:27 PM
  #21  
Dan B's Avatar
Dan B
Advanced PassionFord User
 
Joined: Apr 2004
Posts: 2,364
Likes: 0
Default

I'm going to hazard a guess there's too many variables here......the 922968215732 (usercode) and 359751198262 (passcode) are the multiples of the Unicode values of the corresponding characters in the username & password, but without knowing how many characters there are in each, it's going to be guesswork to decrypt the username/password. Plus there's the manipulation of dividing the usercode by 10 if the total (m) is more than 1000000000000 before you reach the end of either the username or password, and then rounding it to the nearest integer.
Reply
Old Jul 19, 2004 | 08:03 PM
  #22  
_Ben_'s Avatar
_Ben_
I'm Finding My Feet Here Now
 
Joined: Jun 2003
Posts: 148
Likes: 0
Default

With the information we have the only way to solve this problem is with brute force. By hand this is far too time consuming, so there would have to be something pretty special in the member's area to make it worthwhile.

You can make assumptions with regards to which characters are allowed in the password as the password is the name of the html file (obviously only certain characters are allowed in this situation).

Hiding the maths by making it server side would make it even tougher to crack.

ps. I make the only permissible character codes as follows:

33 to 64, 69, 97 to 99, 101 to 126.
Reply
Old Jul 19, 2004 | 08:07 PM
  #23  
warleydaddy's Avatar
warleydaddy
PassionFord Post Whore!!
 
Joined: May 2003
Posts: 5,893
Likes: 0
From: In the Plough,probabley havin a Guinness!!
Default



Pete....
Reply
Old Jul 19, 2004 | 08:50 PM
  #24  
Stu.H's Avatar
Stu.H
Thread Starter
10K+ Poster!!
20 Year Member
Liked
 
Joined: May 2003
Posts: 11,977
Likes: 0
From: Brierley Hill
Default

yep brute force is only way

username is escort btw

this code only took a couple of days to sort out so im quite pleased then

Reply
Old Jul 19, 2004 | 10:57 PM
  #25  
Dan B's Avatar
Dan B
Advanced PassionFord User
 
Joined: Apr 2004
Posts: 2,364
Likes: 0
Default

Unless I'm using the formula wrong, I make "escort" to convert to 168,787,479,564, which isn't the 922,968,215,732 listed in the source?

101 * 115 * 99 * 111 * 114 * 116 = 1,687,874,795,640

That's greater than 1,000,000,000,000, so divide by 10 to get 168,787,479,564?
Reply
Old Jul 19, 2004 | 11:04 PM
  #26  
DaveEscos's Avatar
DaveEscos
BANNED
 
Joined: May 2003
Posts: 23,032
Likes: 2
From: Mongsville, wiping Jimbo.'s spastic arse.
Default




hmmmm, i knoooowww
Reply
Old Jul 19, 2004 | 11:34 PM
  #27  
Stu.H's Avatar
Stu.H
Thread Starter
10K+ Poster!!
20 Year Member
Liked
 
Joined: May 2003
Posts: 11,977
Likes: 0
From: Brierley Hill
Default



fook knows dan, but thats the username and it says it if u enter it as a user

instead of saying incorrect user it say password not correct for user

i'll dig the code out sometime and have a look

Reply
Related Topics
Thread
Thread Starter
Forum
Replies
Last Post
TPM961
Restorations, Rebuilds & Projects.
19
Jan 15, 2018 10:50 AM
tankybaby66
Cars for Sale
49
Feb 6, 2016 02:24 PM
AJC
Cars for Sale
1
Oct 1, 2015 06:47 PM
Fiddy
Pictures, video & Photoshop Forum
21
Sep 29, 2015 06:10 PM




All times are GMT. The time now is 06:47 PM.