Hackosis

I response to my Brute Force Calculator post — I would like to take the time to explain the PHP code involved with the program. This tutorial is written assuming you have basic knowledge of HTML.

The extent of the Brute Force Calulator program deals with these specific areas of PHP:

• Comments
• Variables
• Predefined $_GET Variable
• Basic Math
• Exponents
• If Statements
• Else Statements
• Isset
• Echo Function
• Including HTML inside of PHP

NOTE: Source code download included at the end of the post.

First thing that I always do when writing PHP is include a big fat comment with the name, description, email, and license. This is important. After all, it is nice to know what the program does, how to contact the author, and to know whether it can be copied or not. I would assume if something does not have a license I can take credit for it. Not that I would do such a thing, but legally, I could. The /* and */ states a multi-line comment. A // states a single line comment. Also, I always verbosely comment each section of the code with valuable information explaining my philosophy and reasoning.

/* Brute Force Calculator

Description: Calculates the time taken to brute force any given password 

Author: 

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program.  If not, see .*/

The next part of the PHP code is the retrieval of our variables through the HTML GET method. This data is provided by the HTML form. PHP variables always start with a $.The $_GET variable is a predefined in PHP and “used to collect values from a form”.

//Uppercase
$uc = $_GET['uc'];

//Lowercase
$lc = $_GET['lc'];

//Numerical
$nu = $_GET['nu'];

//Special Characters
$sc = $_GET['sc'];

//Random Alpha/Numeric
$ran = $_GET['ran'];

//Random Alpha/Numeric and special characters
$rans = $_GET['rans'];

//Phrase or word subject to a dictionary attack
$dict = $_GET['dict'];

After we retrieve the variables from the HTML form, using simple addition the total number of characters are calculated and then stored in a variable named length.

//Length of password
$length = $uc + $lc + $nu + $sc + $ran + $rans + $dict;

Next, the key space needs to be calculated. If no length is entered for a particular character set, then 1 is assumed. The isset function checks to see if the variable is set and if not, performs the command specified for else. All If and else statements enclose the given commands in curly brackets; { and }. This is performed for each variable that is taken from the form and passed to a variable with a prepended “k” for key space.

The PHP pow function is used to calculate the key space using exponents based on the number of characters in the character set (lowercase a through z includes 26 characters). pow(number of characters in the character set(base number), length(exponent)) which is compared to 26⁴ or 26^4, for example.
Read the rest of this entry …

Symbolik.wordpress.com explains how to convert YouTube FLV files into Mp3s by utilizing ffmpeg. As a bonus, the post also provides a nice bash script to convert all FLV files in the same directory to MP3 or OGG format.

I previously posted about how to use the Clive python script to download YouTube videos. Also, Windows users can download a Windows binary for ffmpeg.

Now start hunting up those favorite songs.

Manage your thoughts with open source, cross platform wikidPad. wikidPad stores all of your information in a convenient database of your choice and features auto-completion, outline views, incremental search, and easy source code navigation. Note that wikidPad is not a web application, but more like a personal IDE notepad to manage all of those brilliant ideas.

Available for Windows, Linux, and Mac.

Learn more and Download at the wikidPad Home Page.

I have recreated the Brute Force Calculation Spreadsheet in PHP format.

This has been released under the GNU GPL. Feel free to copy, change, and redistribute as specified by the terms of the license. A human readable form is at the creative commons site.

If you make any changes, feel free to post them in the comments. If they are an improvement of design or functionality, I will include it in the source code.

– Hackosis Brute Force Calculator – Web Page Example

– Brute Force Calculator PHP Source Code

More info about calculation figures of cracking speeds and numbers are discussed in detail at the umn.edu site.

I stumbled upon an interesting find today. Mandylion Labs has a brute force calculator available in .xls format. I have also converted it (unmodified) to .ods format (Go OO.org) for you.

Take some time to enter the number of characters for your passwords to see how long it would take to crack. If it shows ‘0.00 hours’ it means that it is time to upgrade your passwords.

Also, it may be time for a personal password policy.

Brute Force Calculator XLS Format | Brute Force Calculator ODS Format

Hackosis is starting to gain more readership and there have been a couple of ‘opposing’ comments. Please read the updated Disclaimer and terms. There is also a link in the footer for future reference.
 
 

Current changes:

Please do not ask me for technical support in the comments, I will not help as this is not a technical support blog (Other commenters are free to do so at their own risk). There are plenty of places on the internet to get help. I will not tolerate flames, etc. Please keep comments on topic. Do feel free to point out obvious mistakes or other mishaps and comment in terms of constructive criticism, positive opinions, etc. We don’t want a couple of bad eggs to spoil the water.

I feel that Hackosis is a positive place, and I intend to keep it that way. I do encourage you to leave constructive comments, even if I don’t nessesarily agree with what is being said. I hope everyone understands what is being relayed here.

This may be changed or added to in the future. I will keep you posted.

- Shane

Are you doing things that make you frustrated because you know that you can aim your attention at something more valuable and rewarding?

Avoid the drudgery by learning to delegate and make more time for yourself, feel better about what you do, and most important of all — by delegating the easy tasks you are evolving the workplace.

I have successfully delegated repetitive backup work, releasing false positives, etc to other workers. It gives me sense of freedom to know that I can now focus my attention at solving the next problem and also maybe get a couple of days off without having to think that things aren’t getting done. Also, superiors will notice more of what you do, because you are doing what is more important.

Any tasks that can be delegated to the PC are a plus. Do some Googling for scripts or macros that will accomplish what you want, even if you have to modify them a bit, you can learn some programming in the process.

You may think that your boss or others may not be keen on the idea, but the worst answer you will get is “no”. The second thing to get past is, will the delegatee do it right? Well maybe, maybe not. But as long as superiors are supportive of the idea then the responsibility is on them if something goes wrong. Isn’t that a relief?

Do yourself a favor and delegate those boring tasks.

Let me know more about your delegation experiences or hurdles in the comments. dontripmyrsshackosis

Is your web application secure? Don’t know how to tell? Read The Web Application Hacker’s Handbook.

From the back cover:

Know your Enemy

To defend an application, you must first know its weaknesses. If you design or maintain web applications, this book will arm you with the protective measures you need to all of the attacks described. If you are a developer, it will show you where and exactly how to strengthen your defenses.

Normally I do not promote non-free products on the blog, but I am currently searching for some books to buy and this one really stood out.

Get it at Amazon.

Many people should be glad to know that an open source, all in one security appliance exists named Untangle. Although this is not news, it is to me. And frankly, I would probably not have implemented a Watchguard if I had known otherwise. Untangle also offers a “professional” support package if you are not confident with open source solutions or just prefer to have someone backing you up.

Untangle seems to have tons of neat features, but keep in mind that these AIO security appliances WILL slow your connection unless you have some beefy equipment running the system.

Untangle has all of the features of most enterprise all in one security appliances including:

• Spam Blocker (SpamAssassin)
• Web Filter (Unknown with URLBlacklist.com
• Protocol Control (Netfilter)
• Anti Virus (ClamAV)
• Spyware Blocker (ClamAV)
• Phishing Blocker (ClamAV)
• Intrusion Prevention (Snort)
• Attack Blocker (Custom)
• Firewall (Custom)
• Remote Access Portal (Custom)
• VPN (Open VPN)

Now, to the fun part. Version is 5.0.3 at this time of writing.

WARNING: Lots of images below.

Installation from Untangle Live CD:

Untangle first boot from the Live CD installation.

Welcome screen for installation. I can see the graphic designer had some fun with the hardware unit. First warning

I think that is the shortest EULA I have ever seen in my life. Awesome.

Yes, please own my sda. Second warning.
Read the rest of this entry …

I have just joined the sla.ckers web application security forum and found something particularly interesting from a post by jungsonn.

This protects against common URL encoding attacks such as SQL injection, white space, javascript, etc and redirects the URL to log.php. Log.php will then alert you via email.

Add this to .htaccess of your web root directory:

Options +FollowSymLinks
RewriteEngine On
RewriteCond %{QUERY_STRING} (\"|%22).*(\>|%3E|<|%3C).* [NC]
RewriteRule ^(.*)$ log.php [NC]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC]
RewriteRule ^(.*)$ log.php [NC]
RewriteCond %{QUERY_STRING} (javascript:).*(\;).* [NC]
RewriteRule ^(.*)$ log.php [NC]
RewriteCond %{QUERY_STRING} (\;|\'|\"|\%22).*(union|select|insert|drop|update|md5|benchmark|or|and|if).* [NC]
RewriteRule ^(.*)$ log.php [NC]
RewriteRule (,|;|<|>|'|`) /log.php [NC]

Create log.php in the web root directory and add the following. Ajust your email accordingly (admin@site.com) and don’t forget PHP tags!:

$r= $_SERVER['REQUEST_URI'];
$q= $_SERVER['QUERY_STRING'];
$i= $_SERVER['REMOTE_ADDR'];
$u= $_SERVER['HTTP_USER_AGENT'];
$mess = $r . ' | ' . $q . ' | ' . $i . ' | ' .$u;
mail("admin@site.com","bad request",$mess,"from:bot@site.com");
echo "Ugly!";

I hope you implement this and if you have any more .htacccess hacks, please leave them in the comments. I look forward to my future ventures at the sla.ckers forum. Don’t forget to check out the ha.ckers site as well.