Re: Encrypted Password script - easy to defeat

From: Michael Sconzo (msconzoat_private)
Date: Mon Jul 07 2003 - 07:26:54 PDT

  • Next message: balwantat_private: "Delhi PenTest Group meeting" 

    Here is something that was 'constructed' over the past week.  I
worked a bit with Ian to make sure it covered what it should.

Questions? Let me know.

-Mike

On Fri, Jun 27, 2003 at 09:41:51AM +0100, Ian Lyte wrote:
> 
> List,
> 
>     I've come across a site protected by the following script :
> 
> function submitentry(){
> password = document.password1.password2.value.toLowerCase()
> username = document.password1.username2.value.toLowerCase()
> passcode = 1
> usercode = 1
> for(i = 0; i < password.length; i++) {
> passcode *= password.charCodeAt(i);
> }
> for(x = 0; x < username.length; x++) {
> usercode *= username.charCodeAt(x);

*snip* 
> 
>    Thanks in advance
> 
> Ian

-- 
The New Testament offers the basis for modern computer coding theory,
in the form of an affirmation of the binary number system.
        But let your communication be Yea, yea; nay, nay: for
        whatsoever is more than these cometh of evil.
                -- Matthew 5:37
    --------------------------------------------------------------------------- The Lightning Console aggregates IDS events, correlates them with vulnerability info, reduces false positives with the click of a button, anddistributes this information to hundreds of users. Visit Tenable Network Security at http://www.tenablesecurity.com to learn more. ----------------------------------------------------------------------------

    This archive was generated by hypermail 2b30 : Mon Jul 07 2003 - 10:59:01 PDT