Google
 

Saturday, January 5, 2008

Calculate The Sha1 Hash Of A String

So far as the dictionary attacks are concerned, I thought up the following function:

<?php
function twistSTR($array){
$twisted="";
$array_strlen=array();

foreach ($array as $element){
$array_strlen[]=strlen($element);
}

for ($i=0; $i<max($array_strlen); $i++){
foreach ($array as $element){
if ($i<strlen($element)){
$twisted=$twisted.$element{$i};
}
}
}

return $twisted;
}
?>

The twistSTR function basically takes an array input of strings and alternates each character of each string among all the other strings. For example:

<?php
echo twistSTR(array("this","and","that"));//output: tathnhidast
?>

It can be applied in the following manner:

<?php
if ($un===$_POST["username"] && $pwd===sha1(twistSTR(array($salt,$_POST["password"])))){
?>

It's not amazingly difficult to reverse engineer the actual output, but then again, that's not the point. The point is that when a password is entered into one of those databases, they are going to enter for example "thisandthat", not "tathnhidast".

For all the php4 users who thought you were limited to sha1.

<?php

$phrase = "Hello World";

$sha1a = base64_encode(sha1($phrase));
$sha1b = base64_encode(bin2hex(mhash(MHASH_SHA1,$phrase)));
$sha256b= base64_encode(bin2hex(mhash(MHASH_SHA256,$phrase)));

echo ("SHA1..:" . $sha1a . "\n");
echo ("SHA1..:" . $sha1b . "\n");
echo ("SHA256:" . $sha256b . "\n");
?>
# php sha.php
SHA1..:MGE0ZDU1YThkNzc4ZTUwMjJmYWI3MDE5NzdjNWQ4NDBiYmM0ODZkMA==
SHA1..:MGE0ZDU1YThkNzc4ZTUwMjJmYWI3MDE5NzdjNWQ4NDBiYmM0ODZkMA==
SHA256:YTU5MWE2ZDQwYmY0MjA0MDRhMDExNzMzY2ZiN2IxOTBkNjJjNjV...........