보안뉴스에 MD5 암호화 관련해서 재미있는 기사가 나왔다.
MD5 해쉬된 패스워드의 원문을 구글 검색을 통해서 적은 노력으로 찾을수 있다고 한다.
아이디어가 정말 훌륭하다.
기사 : http://www.boannews.com/media/view.asp?idx=28850&kind=0
소스 : https://github.com/juuso/BozoCrack/blob/master/bozocrack.rb
BozoCrack / bozocrack.rb
require 'digest/md5'require 'net/http'class BozoCrackdef initialize(filename)@hashes = Array.new@cache = Hash.newFile.new(filename).each_line do |line|if m = line.chomp.match(/\b([a-fA-F0-9]{32})\b/)@hashes << m[1]endend@hashes.uniq!puts "Loaded #{@hashes.count} unique hashes"load_cacheenddef crack@hashes.each do |hash|if plaintext = @cache[hash]puts "#{hash}:#{plaintext}"nextendif plaintext = crack_single_hash(hash)puts "#{hash}:#{plaintext}"append_to_cache(hash, plaintext)endsleep 1endendprivatedef crack_single_hash(hash)response = Net::HTTP.get URI("http://www.google.com/search?q=#{hash}")wordlist = response.split(/\s+/)if plaintext = dictionary_attack(hash, wordlist)return plaintextendnilenddef dictionary_attack(hash, wordlist)wordlist.each do |word|if Digest::MD5.hexdigest(word) == hash.downcasereturn wordendendnilenddef load_cache(filename = "cache")if File.file? filenameFile.new(filename).each_line do |line|if m = line.chomp.match(/^([a-fA-F0-9]{32}):(.*)$/)@cache[m[1]] = m[2]endendendenddef append_to_cache(hash, plaintext, filename = "cache")File.open(filename, "a") do |file|file.write "#{hash}:#{plaintext}\n"endendendif ARGV.size == 1BozoCrack.new(ARGV[0]).crackelseputs "Usage example: ruby bozocrack.rb file_with_md5_hashes.txt"end