1

I read this article https://www.sjoerdlangkemper.nl/2016/02/11/cracking-php-rand/ about cracking php rand() function. and I involved with some problems on testing methods mentioned in article. I used php 5.5.16(Windows x64 version) for testing.

t1.php:

<?php
include 'test.php';
$t =  Token::gen(10);
echo $t;
echo "\n";

test.php:

<?php
class Token {
    public static function gen($len = 5)
    {
        $token = '';
        while($len--){
            $choose = rand(0, 2);
            if ($choose === 0)
                $token .= chr(rand(ord('A'), ord('Z')));
            else if($choose === 1)
                $token .= chr(rand(ord('a'), ord('z')));
            else
                $token .= chr(rand(ord('0'), ord('9')));
        }
        return $token;
    }

}

I generated some CSRF Tokens in vulnerable application as follows:

> php.exe .\t1.php
308AXoL3zs
> php.exe .\t1.php
g18tZZHgv3
> php.exe .\t1.php
Chk7ir55g4
> php.exe .\t1.php
33oRvjqqYf

I took 308AXoL3zs and used it in wincrackseed.c file. I edited that file a little bit. here my edited file:

https://pastebin.com/kS8S8Ps5

my problem is when I tried to crack seed using this attack, attack was active about 2-3 hours but nothing matched ! in my laptop its checked over 34 million seeds in that period of time. but in article Sjoerd Langkemper said:

This will take about 10 minutes for the Windows version

0

You must log in to answer this question.

Browse other questions tagged .