So far as the dictionary attacks are concerned, I thought up the following function:
<?php
function twistSTR($array){
$twisted="";
$array_strlen=array();
foreach ($array as $element){
$array_strlen[]=strlen($element);
}
for ($i=0; $i<max($array_strlen); $i++){
foreach ($array as $element){
if ($i<strlen($element)){
$twisted=$twisted.$element{$i};
}
}
}
return $twisted;
}
?>
The twistSTR function basically takes an array input of strings and alternates each character of each string among all the other strings. For example:
<?php
echo twistSTR(array("this","and","that"));//output: tathnhidast
?>
It can be applied in the following manner:
<?php
if ($un===$_POST["username"] && $pwd===sha1(twistSTR(array($salt,$_POST["password"])))){
?>
It's not amazingly difficult to reverse engineer the actual output, but then again, that's not the point. The point is that when a password is entered into one of those databases, they are going to enter for example "thisandthat", not "tathnhidast".
For all the php4 users who thought you were limited to sha1.
<?php
$phrase = "Hello World";
$sha1a = base64_encode(sha1($phrase));
$sha1b = base64_encode(bin2hex(mhash(MHASH_SHA1,$phrase)));
$sha256b= base64_encode(bin2hex(mhash(MHASH_SHA256,$phrase)));
echo ("SHA1..:" . $sha1a . "\n");
echo ("SHA1..:" . $sha1b . "\n");
echo ("SHA256:" . $sha256b . "\n");
?>
# php sha.php
SHA1..:MGE0ZDU1YThkNzc4ZTUwMjJmYWI3MDE5NzdjNWQ4NDBiYmM0ODZkMA==
SHA1..:MGE0ZDU1YThkNzc4ZTUwMjJmYWI3MDE5NzdjNWQ4NDBiYmM0ODZkMA==
SHA256:YTU5MWE2ZDQwYmY0MjA0MDRhMDExNzMzY2ZiN2IxOTBkNjJjNjV...........
Saturday, January 5, 2008
Calculate The Sha1 Hash Of A String
POSTED BY
Oriol
AT
2:10 AM