보안뉴스에 MD5 암호화 관련해서 재미있는 기사가 나왔다.
MD5 해쉬된 패스워드의 원문을 구글 검색을 통해서 적은 노력으로 찾을수 있다고 한다.

아이디어가 정말 훌륭하다.


기사 : http://www.boannews.com/media/view.asp?idx=28850&kind=0
소스 : https://github.com/juuso/BozoCrack/blob/master/bozocrack.rb

BozoCrack / bozocrack.rb


require 'digest/md5'
require 'net/http'

class BozoCrack

  def initialize(filename)
    @hashes = Array.new
    @cache = Hash.new

    File.new(filename).each_line do |line|
      if m = line.chomp.match(/\b([a-fA-F0-9]{32})\b/)
        @hashes << m[1]
      end
    end
    @hashes.uniq!
    puts "Loaded #{@hashes.count} unique hashes"

    load_cache
  end

  def crack
    @hashes.each do |hash|
      if plaintext = @cache[hash]
        puts "#{hash}:#{plaintext}"
        next
      end
      if plaintext = crack_single_hash(hash)
        puts "#{hash}:#{plaintext}"
        append_to_cache(hash, plaintext)
      end
      sleep 1
    end
  end

  private

  def crack_single_hash(hash)
    response = Net::HTTP.get URI("http://www.google.com/search?q=#{hash}")
    wordlist = response.split(/\s+/)
    if plaintext = dictionary_attack(hash, wordlist)
      return plaintext
    end
    nil
  end

  def dictionary_attack(hash, wordlist)
    wordlist.each do |word|
      if Digest::MD5.hexdigest(word) == hash.downcase
        return word
      end
    end
    nil
  end

  def load_cache(filename = "cache")
    if File.file? filename
      File.new(filename).each_line do |line|
        if m = line.chomp.match(/^([a-fA-F0-9]{32}):(.*)$/)
          @cache[m[1]] = m[2]
        end
      end
    end
  end

  def append_to_cache(hash, plaintext, filename = "cache")
    File.open(filename, "a") do |file|
      file.write "#{hash}:#{plaintext}\n"
    end
  end

end

if ARGV.size == 1
  BozoCrack.new(ARGV[0]).crack
else
  puts "Usage example: ruby bozocrack.rb file_with_md5_hashes.txt"
end



+ Recent posts