I know .NET has two PRNGs, one secure and one insecure. What is the approach to cracking the insecure one (I want to use it to test an .aspx site)? I searched all over but I only found references to cracking the random of Java, C and PHP.
-
The seed is only 31-bits (and biased towards low values, since it's the uptime of the computer in milliseconds), so brute-force is often feasible.– CodesInChaosMar 18, 2020 at 8:57
-
@CodesInChaos - The default constructor in older versions of .net uses that, yes (got fixed in .net core).– Clockwork-MuseMar 18, 2020 at 16:07
Add a comment
|
1 Answer
According the the documentation the current implementation is a subtractive generator.
The code for Random is easy enough to browse. It keeps an array of the 55 previously generated values, and uses two values 21 places apart to generate new numbers, The InternalSample() method shows exactly how each new number is generated.
If you have raw output, you can easily replicate this logic and start filling the history array until you have enough values to reliably predict new values. If you don't get raw values, you will need to estimate the raw value from the values you get, in much the same way you would with other methods.
