I read this article https://www.sjoerdlangkemper.nl/2016/02/11/cracking-php-rand/ about cracking php rand() function. and I involved with some problems on testing methods mentioned in article. I used php 5.5.16(Windows x64 version) for testing.
t1.php:
<?php
include 'test.php';
$t = Token::gen(10);
echo $t;
echo "\n";
test.php:
<?php
class Token {
public static function gen($len = 5)
{
$token = '';
while($len--){
$choose = rand(0, 2);
if ($choose === 0)
$token .= chr(rand(ord('A'), ord('Z')));
else if($choose === 1)
$token .= chr(rand(ord('a'), ord('z')));
else
$token .= chr(rand(ord('0'), ord('9')));
}
return $token;
}
}
I generated some CSRF Tokens in vulnerable application as follows:
> php.exe .\t1.php
308AXoL3zs
> php.exe .\t1.php
g18tZZHgv3
> php.exe .\t1.php
Chk7ir55g4
> php.exe .\t1.php
33oRvjqqYf
I took 308AXoL3zs and used it in wincrackseed.c file. I edited that file a little bit. here my edited file:
my problem is when I tried to crack seed using this attack, attack was active about 2-3 hours but nothing matched ! in my laptop its checked over 34 million seeds in that period of time. but in article Sjoerd Langkemper said:
This will take about 10 minutes for the Windows version