please point me in right direction

c0mp1ex
5 years ago

0

so here is what i have done so far
i found makehash function in login.htm and the hashed credentials in login.js
i thought as username hash was small so i brutforced it and got that username and submited it with arbitrary password and got incorrect password

Now so half part is done we got our username so for password i already had the hashed value
so i made my custom reverse hashing algorithm in python
```def split(word):
return [char for char in word]

file = open(“possible_letters.txt”, “w”)

passwords = []
alpha = split(
“abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789”)

def reverse_slicing(s):
return s[::-1]

def guess_password(hash, s):
hash = int(hash)
if(hash == 0):
file.write(reverse_slicing(s)+“\n”)
return
if(hash>=62):
for x in range(hash-62, hash):
if x % 9 == 0:
guess_password(x/9, s+str(alpha[hash-x-1]))
else:
for x in range(0, hash):
if x % 9 == 0:
guess_password(x/9, s+str(alpha[hash-x-1]))

guess_password(78323683, “”)```

i thought that there wont be many possible passwords with same hash but i found
1428480 possible passwords with same ary[1] hash that is with mult = 9

now i thought at the end i might get meaningful url

so i kept going and found all the corresponding ary[2] values for each possible password

then i used that login check code in login.htm to find all possible urls which is 1428480

now i cant find any meaningful url in my final output list of urls,
and i don’t think that requesting all those possible urls to this server is a good idea

please tell me , what should i do now,
i doubt that i am on completely wrong path or i missing something here
i have an idea that i should try using some dictionary for finding other pages in the level but now i
am bound to solve this level my way, all ideas are welcome though

1reply
1voice
175views
c0mp1ex
5 years ago | edited 5 years ago

0

UPDATE: Ohh, finally found it
one of the possible reverse hash of 66913 was and of that of corresponding password was ***
then i carried same process with second element on m and HURRAY, its done , baba yaga!!!!!!!!!!!!!!
:D

Discussion thread has been locked. You can no longer add new posts.
1 of 2

This site only uses cookies that are essential for the functionality of this website. Cookies are not used for tracking or marketing purposes.

By using our site, you acknowledge that you have read and understand our Privacy Policy, and Terms of Service.

Dismiss