5 ms·
I got frustrated trying out different passwords, so I looked at the source code. The username is "anne.kingston". I found the password hash, but not sure how t
by Serious_Cheese 6y ago
I got frustrated trying out different passwords, so I looked at the source code.
The username is "anne.kingston". I found the password hash, but not sure how to go back to get the password itself.
Password hash: (hashy == "3880" && saltedhashy == "2425")
The hash is computed in a loop as: `prehash += (s[i].charCodeAt() * (i+1));`
I'm not sure how to go reverse this. Maybe someone can help?
Here's a tuple of passwords tried and their hash and salthash:
(Password, Hash, Salthash)
(daniel, 8221, 2197)
(hello, 7004, 3970)
(password, 3970, 1268)
(123, 302, 4415)
(something, 4814, 2749)
- umvi 6y agojust brute force it. With a hash that small there's bound to be tonnes of collisions
- GekkePrutser 6y agoYeah the JS gives some snide comments about this being the 'creative' way. But this is what I like about pentesting. There is no good or bad way. If you get stuck, try something else. Any way you can break the system is a good one.