PHP MD5-SHA1 Cracker

noize · 04-04-2013, 02:18 PM

MD5 Cracker:

PHP Code:
<html>
<head>

<div align="center" style="position: absolute; top: 37px; left: 7px; width: 187px; color: red; font-family: helvetica; font-size: 14px;">
Coded by Noize at<br>
HackCommunity.com<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
MD5 Hash Cracker
</div>

<link rel="stylesheet" type="text/css" href="http://noizethehacker.altervista.org/style.css" />
<title>MD5 Hash Cracker</title>
<script type="text/javascript">
window.onload = function() {
    document.getElementById('hash').focus();
}
</script>
</head>

<body bgcolor="black">
<div id="center_body">
<font color="#00ff00">

#########################################################<br>
<font face="sans-serif" size="4" color="white"><b>Noize's MD5 Hash Cracker</b></font><br>
#########################################################<br>

<form method='post' action='' style="position: relative; left: 6px;">
<br>
Hash:&nbsp;&nbsp;&nbsp;&nbsp; <input type="text" name="hash" id="hash" placeholder="MD5 Hash" /><br>
Wordlist: <input type="text" name="wordlist" id="wordlist" style="position: relative; left: -1px;" placeholder="wordlist.txt" value="wordlist.txt" /><br>
<input type="submit" value="&nbsp;&nbsp;&nbsp;&nbsp;Crack&nbsp;&nbsp;&nbsp;&nbsp;" style="position: relative; top: 3px; left: 95px; margin-bottom: -5px; color: #00ff00; background-color: black; font-family: arial; font-size: 13px; cursor: pointer;" /><br>
<input type="hidden" name="submit" />
</form>
#########################################################<br>

</font>

<a href="sha1cracker.php">
<font color="black">
<input type="button" class="switch_hash" value="SHA1">
</font>
</a>

<br>

<?php

if (isset($_POST['submit'])) {
    $wordlist = htmlentities($_POST['wordlist']);

    if(!file_exists( $wordlist ))
    {
        echo '<font color="red">Wordlist not found at location ' . $wordlist . '.</font>';
        exit();
    }

    $hash = trim($_POST['hash']);
    $wordlist = file($_POST['wordlist']);
    $bFound = false;

    foreach( $wordlist as $line ) {
        $line = trim($line);
        if(md5($line)==$hash) {
            $bFound = true;            
            echo 'Hash cracked!<br>The root of the hash is ' . htmlentities($line) . '.';
            break;
        }
    }
    if(!$bFound){
        echo"Failed to crack the hash.";
    }
}

?>

</div>

<div align="center" style="position: relative; bottom: -352px; left: -35px; font-family: verdana; color: #666; font-size: 12px;">
&copy; Special thanks go to 
    <a href="http://www.hackcommunity.com/User-zomgwtfbbq" style="
    font-size: 12px;
    font-family: verdana;
    color: blue;"
    target="_blank">
zomgwtfbbq</a> &#183 
    <a href="http://www.hackcommunity.com/User-1llusion" style="
    font-size: 12px;
    font-family: verdana;
    color: blue;"
    target="_blank">
1llusion</a> &#183 
All rights are shit
</div>

</body>
</html> 

You can view the cracker (MD5/SHA1) here.
On that server you can find a wordlist at the path tools/wordlist.txt.
Convert text in MD5 hash here: http://tools.perceptus.ca/text-wiz.php?ops=9, if you want to test it and give feedback/report bugs, I'll appreciate it.

Original post:

PHP Code:
if (isset($_POST['submit'])) {
    $hash = $_POST['hash'];
    $wordlist = $_POST['wordlist'];
    foreach( $wordlist as $line ) {
        if(md5($wordlist['line']) == $hash ) {
            echo 'Hash cracked!<br>The root of the hash is ' . $wordlist[$line] . '.';
            exit();
        } else {
            echo 'Failed to crack the hash.';
            exit();
        }
    }

    if(!file_exists( $wordlist ))
    {
        echo '<font color="red">Wordlist not found at location ' . $wordlist . '.</font>';
    }
} 

This should take the wordlist (chosen by the user), and look if any line hashed with MD5 is equal to the given hash.
This just doesn't work.
I'm not a great PHP coder, so I'd like to know if anybody may give me any suggestion.
Thanks.

I've just added SHA1 cracking too, I'm not publishing code as it's just the same but with SHA1 replacing MD5.
Code for button (if any wants to view it) is available as HTML/CSS.

Deque · 04-04-2013, 03:26 PM

What exactly doesn't work?

I am not a PHP coder at all, but shouldn't it be:

Code:
if(md5($line) == $hash ) {

And:

Code:
echo 'Hash cracked!<br>The root of the hash is ' . $line . '.';

noize · 04-04-2013, 03:42 PM

(04-04-2013, 03:26 PM)Deque Wrote: What exactly doesn't work?

I am not a PHP coder at all, but shouldn't it be:

Code:
if(md5($line) == $hash ) {

And:

Code:
echo 'Hash cracked!<br>The root of the hash is ' . $line . '.';

Well, what doesn't work is the actual cracking part, so the part you just talked about. I'm pretty sure the error is in the thing you corrected.
Also, I've got to sadly say that your correction is not working too.
I'm just learning PHP, and so I'm not good with this stuff.

For whatever, this is the code for the whole page:

PHP Code:
<html>
<head>

<div align="center" style="position: absolute; top: 37px; left: 7px; width: 187px; color: red; font-family: helvetica; font-size: 14px;">
Coded by Noize at<br>
HackCommunity.com<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
MD5 Hash Cracker
</div>

<link rel="stylesheet" type="text/css" href="http://noizethehacker.altervista.org/style.css" />
<title>MD5 Hash Cracker</title>
<script type="text/javascript">
window.onload = function() {
    document.getElementById('hash').focus();
}
</script>
</head>

<body bgcolor="black">
<div id="center_body">
<font color="#00ff00">

#########################################################<br>
<font face="sans-serif" size="4" color="white"><b>Noize's MD5 Hash Cracker</b></font><br>
#########################################################<br>

<form method='post' action='' style="position: relative; left: 6px;">
<br>
Hash:&nbsp;&nbsp;&nbsp;&nbsp; <input type="text" name="hash" id="hash" placeholder="MD5 Hash" /><br>
Wordlist: <input type="text" name="wordlist" id="wordlist" style="position: relative; left: -1px;" placeholder="wordlist.txt" value="wordlist.txt" /><br>
<input type="submit" value="&nbsp;&nbsp;&nbsp;&nbsp;Crack&nbsp;&nbsp;&nbsp;&nbsp;" style="position: relative; top: 3px; left: 95px; margin-bottom: -5px; color: #00ff00; background-color: black; font-family: arial; font-size: 13px; cursor: pointer;" /><br>
<input type="hidden" name="submit" />
</form>
#########################################################<br>

</font>

<br>

<?php

## Coded by Noize ##

if (isset($_POST['submit'])) {
    $hash = $_POST['hash'];
    $wordlist = $_POST['wordlist'];
    foreach( $wordlist as $line ) {
        if(md5($line) == $hash ) {
            echo 'Hash cracked!<br>The root of the hash is ' . $line . '.';
            exit();
        } else {
            echo 'Failed to crack the hash.';
            exit();
        }
    }

    if(!file_exists( $wordlist ))
    {
        echo '<font color="red">Wordlist not found at location ' . $wordlist . '.</font>';
    }
}

?>

</div>

</body>
</html> 

zomgwtfbbq · 04-04-2013, 03:52 PM

PHP Code:
<?php
if (isset($_POST['submit'])) {
    $wordlist = $_POST['wordlist'];
    if(!file_exists( $wordlist ))
    {
        echo '<font color="red">Wordlist not found at location ' . $wordlist . '.</font>';
    }
    $hash = trim($_POST['hash']);
    $wordlist = file($_POST['wordlist']);
    $bFound = false;
    foreach( $wordlist as $line ) {
        $line = trim($line);
        if(md5($line)==$hash) {
            $bFound = true;            
            echo 'Hash cracked!<br>The root of the hash is ' . $line . '.';
            break;
        }
    }
    if(!$bFound){
        echo"No match in wordlist";
    }

} 
?>

Haven't tried your code and don't know if it's the full code but this should probably work.

noize · 04-04-2013, 03:58 PM

(04-04-2013, 03:52 PM)zomgwtfbbq Wrote:
PHP Code:
<?php if (isset($_POST['submit'])) { $wordlist = $_POST['wordlist']; if(!file_exists( $wordlist )) { echo '<font color="red">Wordlist not found at location ' . $wordlist . '.</font>'; } $hash = trim($_POST['hash']); $wordlist = file($_POST['wordlist']); $bFound = false; foreach( $wordlist as $line ) { $line = trim($line); if(md5($line)==$hash) { $bFound = true; echo 'Hash cracked!<br>The root of the hash is ' . $line . '.'; break; } } if(!$bFound){ echo"No match in wordlist"; } } ?>
Haven't tried your code and don't know if it's the full code but this should probably work.

Man, thanks a lot. It works this way.
Just a minor mistake, you should have declared wordlist variable before looking if it existed, this way it displays "No wordlist" even if it cracked successfully.
Anyhow, thanks again Wink

Now I'm updating first post with the full code.

1llusion · 04-05-2013, 12:25 AM

Hi,

I just couldn't help myself, you have 2 security issues in your script.

The first one is a confirmed reflected XSS which is due to no input validation at:

PHP Code:
if (isset($_POST['submit'])) {
    $wordlist = $_POST['wordlist']; 

You could fix it by using:

PHP Code:
if (isset($_POST['submit'])) {
    $wordlist = htmlspecialchars($_POST['wordlist']); 

The second security issue is by opening a file, that the user defines:

PHP Code:
$wordlist = file($_POST['wordlist']); 

You don't use any protection here and this flaw could be used to brute-force file locations and names on your server.

I personally would take out the part where user enters the name of the dictionary by himself and instead, use a menu, where the user simply ticks which one he wants. Also, I'd use integer values for passing the choice of the user and on the server, I'd simply filter out everything except the integers. This way you:
1) Have no chance of XSS vulnerability
2) Have control over what the user can access.

When I have some time, I'll edit the script to the more secure solution Smile

1llusion · 04-05-2013, 12:25 AM

Hi,

I just couldn't help myself, you have 2 security issues in your script.

The first one is a confirmed reflected XSS which is due to no input validation at:

PHP Code:
if (isset($_POST['submit'])) {
    $wordlist = $_POST['wordlist']; 

You could fix it by using:

PHP Code:
if (isset($_POST['submit'])) {
    $wordlist = htmlspecialchars($_POST['wordlist']); 

The second security issue is by opening a file, that the user defines:

PHP Code:
$wordlist = file($_POST['wordlist']); 

You don't use any protection here and this flaw could be used to brute-force file locations and names on your server.

I personally would take out the part where user enters the name of the dictionary by himself and instead, use a menu, where the user simply ticks which one he wants. Also, I'd use integer values for passing the choice of the user and on the server, I'd simply filter out everything except the integers. This way you:
1) Have no chance of XSS vulnerability
2) Have control over what the user can access.

When I have some time, I'll edit the script to the more secure solution Smile

zomgwtfbbq · 04-05-2013, 11:12 AM

(04-05-2013, 12:25 AM)1llusion Wrote: Hi,

I just couldn't help myself, you have 2 security issues in your script.

The first one is a confirmed reflected XSS which is due to no input validation at:

PHP Code:
if (isset($_POST['submit'])) { $wordlist = $_POST['wordlist'];

You could fix it by using:

PHP Code:
if (isset($_POST['submit'])) { $wordlist = htmlspecialchars($_POST['wordlist']);

The second security issue is by opening a file, that the user defines:

PHP Code:
$wordlist = file($_POST['wordlist']);
You don't use any protection here and this flaw could be used to brute-force file locations and names on your server.

I personally would take out the part where user enters the name of the dictionary by himself and instead, use a menu, where the user simply ticks which one he wants. Also, I'd use integer values for passing the choice of the user and on the server, I'd simply filter out everything except the integers. This way you:
1) Have no chance of XSS vulnerability
2) Have control over what the user can access.

When I have some time, I'll edit the script to the more secure solution

That's actually my bad, I didn't realize he was going to put it online. Confused

urprised:

zomgwtfbbq · 04-05-2013, 11:12 AM

(04-05-2013, 12:25 AM)1llusion Wrote: Hi,

I just couldn't help myself, you have 2 security issues in your script.

The first one is a confirmed reflected XSS which is due to no input validation at:

PHP Code:
if (isset($_POST['submit'])) { $wordlist = $_POST['wordlist'];

You could fix it by using:

PHP Code:
if (isset($_POST['submit'])) { $wordlist = htmlspecialchars($_POST['wordlist']);

The second security issue is by opening a file, that the user defines:

PHP Code:
$wordlist = file($_POST['wordlist']);
You don't use any protection here and this flaw could be used to brute-force file locations and names on your server.

I personally would take out the part where user enters the name of the dictionary by himself and instead, use a menu, where the user simply ticks which one he wants. Also, I'd use integer values for passing the choice of the user and on the server, I'd simply filter out everything except the integers. This way you:
1) Have no chance of XSS vulnerability
2) Have control over what the user can access.

When I have some time, I'll edit the script to the more secure solution

That's actually my bad, I didn't realize he was going to put it online. Confused

urprised:

1llusion · 04-05-2013, 01:30 PM

I've secured the script a bit:

PHP Code:
<?php
//Enter in the array locations of the wordlists
$files = array('tools/wordlist.txt');
?>

<html>
<head>

<div align="center" style="position: absolute; top: 37px; left: 7px; width: 187px; color: red; font-family: helvetica; font-size: 14px;">
Coded by Noize at<br>
HackCommunity.com<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
MD5 Hash Cracker
</div>

<link rel="stylesheet" type="text/css" href="http://noizethehacker.altervista.org/style.css" />
<title>MD5 Hash Cracker</title>
<script type="text/javascript">
window.onload = function() {
    document.getElementById('hash').focus();
}
</script>
</head>

<body bgcolor="black">
<div id="center_body">
<font color="#00ff00">

#########################################################<br>
<font face="sans-serif" size="4" color="white"><b>Noize's MD5 Hash Cracker</b></font><br>
#########################################################<br>

<form method='post' action='' style="position: relative; left: 6px;">
<br>
Hash:&nbsp;&nbsp;&nbsp;&nbsp; <input type="text" name="hash" id="hash" placeholder="MD5 Hash" /><br>
Wordlist: <select name="wordlist">
            <?php
                //Writing out the options based on our array:

                foreach($files as $key => $file){
                    echo "<option value=$key>$file</option>";
                }
             ?>
          </select><br>
<input type="submit" value="&nbsp;&nbsp;&nbsp;&nbsp;Crack&nbsp;&nbsp;&nbsp;&nbsp;" style="position: relative; top: 3px; left: 95px; margin-bottom: -5px; color: #00ff00; background-color: black; font-family: arial; font-size: 13px; cursor: pointer;" /><br>
<input type="hidden" name="submit" />
</form>
#########################################################<br>

</font>

<br>

<?php

if (isset($_POST['submit'])) {
    //Checking if the wordlist is set. If yes, filter out everything except numbers
    $wordlist = empty($_POST['wordlist']) ? NULL : preg_replace("/[^0-9]+/", "", $_POST['wordlist']);

    //Check if the wordlist is empty (it could have been set with characters other than numbers - for example in hack attempt)
    //Also check if the ID is valid in our array
    if(empty($wordlist) && !is_numeric($wordlist) || $wordlist > count($files)){
        echo '<font color="red">Invalid wordlist.</font>';
        exit();
    }

    $hash = trim($_POST['hash']);

    //Opening the file defined in our array
    $wordlist = file($files[$wordlist]);
    $bFound = false;

    foreach( $wordlist as $line ) {
        $line = trim($line);
        if(md5($line)==$hash) {
            $bFound = true;            
            echo 'Hash cracked!<br>The root of the hash is ' . $line . '.';
            break;
        }
    }
    if(!$bFound){
        echo"Failed to crack the hash.";
    }
}

?>

</div>

<div align="center" style="position: relative; bottom: -432px; left: -8px; font-family: verdana; color: #666; font-size: 12px;">
&copy; Special thanks go to my friend 
    <a href="http://www.hackcommunity.com/User-zomgwtfbbq" style="
    font-size: 12px;
    font-family: verdana;
    color: blue;">
zomgwtfbbq</a> &#183 
All rights are shit
</div>

</body>
</html> 

Added:

Array of pre-defined wordlists named $files (add wordlist locations there)
SELECT tag where user chooses the wordlist (This tag is automatically generated from the $files array).
Secured passing of values. Now only integer values can be submitted as wordlist

Unfortunately, it looks like I broke the design a bit. I'm sorry for that!
The script right now is not vulnerable to XSS nor file location brute-force Smile

PHP MD5-SHA1 Cracker
Author Message