some useful gtk tools (maybe)

[br__ken]

if anyone is interested in some gtk tools ive made you can download them here (gtk 1.3+ env needed)

these can be useful if learning php-gtk also, they arent so hard to understand, just a little bit confusing

(this attachment: pregtk preg_* expression tester)

can test with match, split, and _replace.. pretty useful when testing/creating big expressions to see how strong they are.

it can read expressions from an xml dbase (boredom made me add that useless feature) and has a few weak-hard coded ones.

just kinda handy to have when doing form validation because you dont need to reload a test page 50 times.

[br__ken]

(attachment: gtk-md5-cracker)

this is a simple 'cracker' for md5 encrypted strings..

i got bored and wanted to see just how simple it would be to crack some of my passwords/etc. turns out md5 isnt all THAT secure with lowercase letters.

anyway, it can do a bunch of useless things and is pretty lightweight/fast

i included a dictionary of around 12.5k words to test against, plus a few more options that can generate more

[note: if anyone knows how to cycle through case alternations, let me know.. ive ben stuck on the best way to do this: meaning for the word rob it would be like Rob ROb ROB rOB roB etc]

let me know what you think.

feedback, etc: [e-mail]

[Weedpacket]

Originally posted by brøken
i got bored and wanted to see just how simple it would be to crack some of my passwords/etc. turns out md5 isnt all THAT secure with lowercase letters.

md5 was never intended for encrypting passwords. Besides, it's still just the same boring old "guess the password and see if it works" attack that would work for any hash algorithm and just means you should be a bit smarter about how you pick your passwords (if there are only a few million possible passwords it doesn't take too long to try them all until you get one that works: one password I've used in the past has (when written entirely in lowercase letters) an MD5 hash of 85EEC48ECB82FE844EAF35403F22B00D).

$string = strtolower("MixedCase");
$slen = strlen($string);
$cases = array();
for($i=0;$i<1<<$slen;$i++)
{	$c=str_pad(decbin($i),$slen,"0",STR_PAD_LEFT);
	$s=$string;
	for($j=0;$j<$slen;$j++)
	{	if($c{$j}) $s{$j}=strtoupper($s{$j});
	}
	$cases[] = $s;
}
var_dump($cases);

[br__ken]

yeah, i know its a no-brainer guess the password script, but it was more to practice using gtk. gussing 'real' passwords with this would be a task, but it works pretty good with normal bulls**t passwords. i dont think this would ever be able to crack my secure passwords though.

thanks for the mixed case thing

[Weedpacket]

Originally posted by brøken
yeah, i know its a no-brainer guess the password script, but it was more to practice using gtk. gussing 'real' passwords with this would be a task, but it works pretty good with normal bulls**t passwords. i dont think this would ever be able to crack my secure passwords though.

Yeah, I reckoned as much; that part of the post was directed more at readers who might've got the wrong impression (e.g., that MD5 is broken compared to some other hash, say, or that it needs to be broken for passwords to be vulnerable).