I know .NET has two PRNGs, one secure and one insecure. What is the approach to cracking the insecure one (I want to use it to test an .aspx site)? I searched all over but I only found references to cracking the random of Java, C and PHP.

  • The seed is only 31-bits (and biased towards low values, since it's the uptime of the computer in milliseconds), so brute-force is often feasible. – CodesInChaos Mar 18 at 8:57
  • @CodesInChaos - The default constructor in older versions of .net uses that, yes (got fixed in .net core). – Clockwork-Muse Mar 18 at 16:07

According the the documentation the current implementation is a subtractive generator.

The code for Random is easy enough to browse. It keeps an array of the 55 previously generated values, and uses two values 21 places apart to generate new numbers, The InternalSample() method shows exactly how each new number is generated.

If you have raw output, you can easily replicate this logic and start filling the history array until you have enough values to reliably predict new values. If you don't get raw values, you will need to estimate the raw value from the values you get, in much the same way you would with other methods.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.