5 ms·

Password is randomized on each load. Author has conveniently left a debugger statement in the code.

TYMorningCoffee 5y ago
I did not know about the debugger statement until I read your comment: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/debugger https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe... . Thank you.
- aerovistae 5y ago
  Massively useful! I also recently learned you can right click a line of code in the chrome debugger to add a logpoint - i.e. "log the value of this expression when you reach this point in the code" - so I don't have to manually add console.log statements. Basically the reverse of discovering the debugger statement!
  - culturestate 5y ago
    > you can right click a line of code in the chrome debugger to add a logpoint...so I don't have to manually add console.log statements Thank you, this is the best thing I've learned in 2022.
    - Vinnl 5y ago
      Next try https://www.replay.io https://www.replay.io, which allows you to add logpoints to code that has already executed.
  - core-utility 5y ago
    This was news to me too
  - AdamTReineke 5y ago
    One more trick: Add a conditional breakpoint with the condition: `value = "someOverrideValue", false` to make the breakpoint change the value when it is reached without actually stopping execution. Great for when you need state changed but the app is always trying to override it. Here's a video from a talk I gave five years ago that demonstrates that: https://youtu.be/uixXOTCNbhs?t=1182 https://youtu.be/uixXOTCNbhs?t=1182
    - bspammer 5y ago
      Woah. Now that is incredibly useful.
      - azalemeth 5y ago
        It's also used by malicious websites that don't like security researchers looking at their source, just to say.
  - therein 5y ago
    You can also right click a DOM element in the inspector and click `store as a global variable`. It will automatically do the following for you temp1 = document.querySelector(SELECTOR_FOR_NODE_YOU_PICKED)
- xeromal 5y ago
  It's pretty powerful. I oftentimes struggle to get VS code to pick up a breakpoint when debugging serverless node functions, but the debugger statement usually gets it working.
core-utility 5y ago
Part of me wishes the author just took common passwords from rockyou.txt so that they're at least guessable. Though random really does add to the absurdity.
- ugjka 5y ago
  It's OK, the goal is to find a collision
- jpeter 5y ago
  Or use a new password every day like worle. So you have a community effort to guess it
  - faeyanpiraat 5y ago
    Is any of the information (yellow/green for characters) presented getting you closer to the real answer in any meaningful way though?
    - SamBam 5y ago
      No, that's the joke of the site.
    - core-utility 5y ago
      Inherently with a (proper) hashing algorithm, the value and placement of characters in the hash means next-to-nothing in terms of the actual original text. For example: password = 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8 passwurd = 1966e583daff0fce5630d5de44f303f0e77f77940f02c7d648defadc31059c7b Notice they're very different results, even though the original text only has 1 character difference.
      - therein 5y ago
        The Avalanche effect for anyone interested in reading more. https://en.wikipedia.org/wiki/Avalanche_effect https://en.wikipedia.org/wiki/Avalanche_effect

I did not know about the debugger statement until I read your comment: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/debugger https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe... . Thank you.

aerovistae 5y ago
Massively useful! I also recently learned you can right click a line of code in the chrome debugger to add a logpoint - i.e. "log the value of this expression when you reach this point in the code" - so I don't have to manually add console.log statements. Basically the reverse of discovering the debugger statement!
- culturestate 5y ago
  > you can right click a line of code in the chrome debugger to add a logpoint...so I don't have to manually add console.log statements Thank you, this is the best thing I've learned in 2022.
  - Vinnl 5y ago
    Next try https://www.replay.io https://www.replay.io, which allows you to add logpoints to code that has already executed.
- core-utility 5y ago
  This was news to me too
- AdamTReineke 5y ago
  One more trick: Add a conditional breakpoint with the condition: `value = "someOverrideValue", false` to make the breakpoint change the value when it is reached without actually stopping execution. Great for when you need state changed but the app is always trying to override it. Here's a video from a talk I gave five years ago that demonstrates that: https://youtu.be/uixXOTCNbhs?t=1182 https://youtu.be/uixXOTCNbhs?t=1182
  - bspammer 5y ago
    Woah. Now that is incredibly useful.
    - azalemeth 5y ago
      It's also used by malicious websites that don't like security researchers looking at their source, just to say.
- therein 5y ago
  You can also right click a DOM element in the inspector and click `store as a global variable`. It will automatically do the following for you temp1 = document.querySelector(SELECTOR_FOR_NODE_YOU_PICKED)
xeromal 5y ago
It's pretty powerful. I oftentimes struggle to get VS code to pick up a breakpoint when debugging serverless node functions, but the debugger statement usually gets it working.

core-utility 5y ago

Part of me wishes the author just took common passwords from rockyou.txt so that they're at least guessable. Though random really does add to the absurdity.

ugjka 5y ago
It's OK, the goal is to find a collision
jpeter 5y ago
Or use a new password every day like worle. So you have a community effort to guess it
- faeyanpiraat 5y ago
  Is any of the information (yellow/green for characters) presented getting you closer to the real answer in any meaningful way though?
  - SamBam 5y ago
    No, that's the joke of the site.
  - core-utility 5y ago
    Inherently with a (proper) hashing algorithm, the value and placement of characters in the hash means next-to-nothing in terms of the actual original text. For example: password = 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8 passwurd = 1966e583daff0fce5630d5de44f303f0e77f77940f02c7d648defadc31059c7b Notice they're very different results, even though the original text only has 1 character difference.
    - therein 5y ago
      The Avalanche effect for anyone interested in reading more. https://en.wikipedia.org/wiki/Avalanche_effect https://en.wikipedia.org/wiki/Avalanche_effect