note 38352 added to function.crypt
| From: | "Fran�oisRopert" at rn2 dot php dot net | Date: | Wed, 17 Dec 2003 18:24:55 +0000 |
| Subject: | note 38352 added to function.crypt | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-62138@lists.php.net to get a copy of this message | ||
example of blowfish use under openbsd :
You can exploit this script to read /etc/master.passwd lines.
$key : Original blowfish hash (salt of crypt function) - Don't replace ' by " because
the hash can contains $ character so he will result a bad interpretation.
$user_input : character sequence entered by user to calculate blowfish hash with $key.
$password : Blowfish hash result of $key and $user_input.
<?
$key = '$2a$07$A.QAFolLar4v27MGXrrROxpj7hvyhxT2qypSsWtIDjdOSYLMkABq';
$user_input = 'thebestostoserveyou';
$password = crypt($user_input,$key);
if ($password == $key) {
echo "succesful";
}
else
{
echo "missed";
}
Have fun :-)
----
Manual Page -- http://www.php.net/manual/en/function.crypt.php
Edit -- http://master.php.net/manage/user-notes.php?action=edit+38352
Delete -- http://master.php.net/manage/user-notes.php?action=delete+38352&report=yes
Reject -- http://master.php.net/manage/user-notes.php?action=reject+38352&report=yes
Search -- http://master.php.net/manage/user-notes.php