js16
Kind of like breaking an encryptions.
Each key is turned into a number and if multiple letters are submitted, it does math to all of them to make it unique. You basically have to reverse engineer what the encrypt method is doing and make it the same as the checksum.
What i would do is change the false alert to say alert(sum) and then do guesses from there.
any thoughts on why is this challenge only worth 40 points. and js15 is worth 50? js15 is as simple as alerting the comparison string. js16 will really make us reverse the algorithm so i think we should get a little more for our trouble.
im contemplating bruteforce for it but i think this chall might have more than one possible answer.
I'm with sakarin, I tried bruteforcing it in javascript but my processor went up to 100% and my browser crashed…I think it would take way too long to bruteforce it, especially considering we don't know the character set (the "tab" variable?) or the length. I'm actually really confused on how to go about this challenge, it seems impossible to reverse it because of all the factors involved in calculating the sum, and I do think there could be more than one answer…
There are definitely many possibilities for this one. I've figured out so far that he first letter doesn't matter, since "i" will always be 0 in the "for" for the first letter, and since multiplying by zero and adding 1 gives you always 1, the sum is not changed, so you can use any first letter from the set "tab".
richo have you coded your answer to the challenge. something that doesn't bruteforce and gives the right solution? i mean when someone creates a challenge it's always good to do some testing before making it public.
if so could you make it avaliable on the final url so we at least know the intended solution?
i still can't get past you comment on having multiple right answers is a feature not a bug..
This challenge is IMPOSSIBLE to solve as there are billions of valid solutions ! Bruteforce would take years !
OK you want more "valid" strings ?
[deleted]
And for each you can change the first space with any 85 chars of the tab string and it will still be valid.
So what can we do now ???
[edit] there's 2 spaces between 'p' and '4d' but it shows only one after post… HTML problem :)
oh but we can. js15 easy as it may be, is solvable through logic. this one isn't it's like hash encryption but bad because we have more than one possibility
i'd really like richohealey to tell me im just wrong and there is a non bruteforce way to solve it. that when he coded the challenge he contemplated how ppl should solve it and send it to another admin or someone to say we're all wrong. if not plz remake the challenge.
im not going to spend more of my time on it even though i don't like to have unsolved challenges on this category.
yeah i can also point out positive sides on pretty much anything but that doesn't change anything
if the purpose of this site is to illustrate real scenarios, it's a realistic mission. the others are to test your knowlege and to make you research and think. well if you can reverse the algoritm and get a positive on this challenge it means you know what the function is doing and know enough to write your own to help you out.
making you do that over and over to find THE answer is not only stupid but also not worth it for less points than js15 which was as simple as alerting something..
but even with more points i don't see the logic. what do you learn? if there is a way to do it without scrolling all possibilities it's certainly not with javascript. it would be a cool thing on a realistic. where you had another way around it but would keep lots of ppl just trying to break the js instead.
about the points, I agree with you but about the rest… cmon take it easy :p "What do you learn ??" hmm…I think I learned enough to say I am still kinda pleased depends on how you tried to solve it And it also depends on your experience. I spent so much time on it but i wanted to solve it without solid bruteforcing. anyways, It helped me to kill some time and gain alot of experience and fun :D so i'd say stoping naggin like that and enjoy yourselves and richo… be more careful next time, but still thanks for the challenge ;)
lol…I never said that the chellenge is perfect and there's nothing wrong with it i just said take it easy and dont get so pissed off about it. dont attack richo he was just helpin and it was not his duty to make this challenge. now that sth is wrong with it he'll fix it or the admins has to do sth else which is replace it or remove it.
dude im not attacking no one. you like most ppl posting on this topic have spent your time trying to do it only to reach the conclusion it's not a matter of skill but patience.
im just expressing my frustration and hoping from the same thing you do. that they fix or replace with something solvable through logic and not brute force.. (because bruteforce is attempting to submit various answers until you guess the right one. this chall will make you reverse the algoritm only to end up with a kind of dictionary that sure won't have the 100000000 possibilities you would had before but still will be something like 100000) and im pretty sure there's a mechanism that will log you out if you attempt bruteforce on any part of hbh..
sakarin wrote: oh and system meltdown is the only person apart from richo with this chall complete. probably because he has to accept the challenges so he views them before hand..
does this mean hbh is full of noobs or that there's something wrong with the challenge?
im pretty sure mastergamer did it as well
sakarin wrote: oh and system meltdown is the only person apart from richo with this chall complete. probably because he has to accept the challenges so he views them before hand..
1: I don't cheat. 2: I beat this when Richo sent it to me, and I had no help from him. 3: I have to view them before hand? It's a JavaScript challenge, all I had was the script, I had to beat it before I could set up a completion page.
not wanting to start an argument this is my last reply regarding that post. i didn't call you a cheater, i guessed that since you had to put the challenges up you need to view them, yes it's a javascript but there is a solution page to upload with the same name as the answer. you just explained how you did that after solving the challenge on your own. that's pretty cool
now regarding the other more important parts of my post and other ppl posts. how did you manage to know which one of the solutions was the page to upload? please tell me we're being stupid and there is another aproach for this challenge that will give us 1 answer instead of a really big number of them.
This is a tricky one… got me a little stumped.
It's obvious that the length must be between 10 and 17 chars long, so brute forcing is out. There doesn't seem to be a way to reverse the algo either (beyond a slightly simplified version which is easy to get to).
Got me beaten for now. Assuming its not just a guessing game, this challenge is either very clever, or very dumb. I hope its the former.
it's not random characters,
you'll know it when you get it, but there ARE collisions atm, so if you get a pass that works, but doesn't, keep going.
[edit] After discussing this with an utter nub over IRC i've decided that i like the collisions and now have no intention of removing them
Because:
If i HAD to use js to protect a site, this is deffo how i'd go about it, since even if you createa bruteforcer you still need to try all the combinations before you actually find the page.
So I've decided that i'm an accidental genius.
I'm open to discussion though, as long as it's reasonable (You know who you are, Irc-nub)
[/edit]
Richo
well if '@' is the highest value and 'a' is the lowest we can assume that the password is between 10 and 17 characters (already mentioned) minus the fact that the first doesn't matter (already mentioned) we have the range of 9 to 16 characters, with a large character set (66 i think). that makes it somewhere from
23,762,680,000,000,000 possibilities to
1,296,292,380,000,000,000,000,000,000 possibilities.
the brute forcer i wrote in php gets 25k/sec (slow i know i'm on an old comp)
so could take anywhere from 3 hundred thousand years to the rest of eternity.
this is similar to system's challenge but he ONLY HAD NUMBERS, which EXPONENTIALLY reduces the amount of work to be done.
unless my math is off (might be im tired) then this is ridiculous to brute force. i guess ill go try and reverse the algo… :right:
Xelloss wrote: http://www.g00ns.net/http://www.g00ns.net/http://www.g00ns.net/
http://www.g00ns.net/http://www.g00ns.net/http://www.g00ns.net/ http://www.g00ns.net/http://www.g00ns.net/http://www.g00ns.net/ http://www.g00ns.net/http://www.g00ns.net/http://www.g00ns.net/ … DUDE stop ruining this bloody community will ya
Ok I've written a brute forcer, fairly crappy and slow and it'll take days.
When someone said the password was alpha-numeric, does that mean lowercase or uppercase letters, or a combination of both.
And does anyone want to say how long password is?
And are we meant to just pure brute-force or are we supposed to actually figure out some stuff first and/or reverse algo?
Ok, so you all know.
a) this challenge requires bruteforcing, it's really an exercise in creating a decent Brute forcer.
b) the result makes sense, so take that how you will (it's a hint at a refining algorithm)
c) i'll dig out my solution source and post it on the complete page
d) For the last time, this WOULD constitute a more secure than usual JS login, this is demonstrated in the number of people stumped by it.
e) i didn't say secure!! MORE SECURE THAN USUAL </flame dodge>
This one is tough! The checksum is 88692589, and 88692589 is divisible by 1, 19, 37, .. The textfield has a max of 20 characters so I'm assuming the password is 19 chars long. This is because in the loop you have sum += n*(stuff), which is the same as sum += stuff and after the loop sum *= n. And it can't be a single charecter because no matter what it always results in 1. This is the easy part, still have to figure out an efficient way to brute force it.. Is the only way just to check all possible permutations, or is there a better algorithm? I haven't even tried because with 19 elements and 86 different values for the elements there are so many possibilities it would take ages.. or am I wrong here?
@guana
you are on the right track with ur pw length calculation, but the result might be wrong. Just remember what u wrote about the pw's with length 1.
And remember: knowing the pw's lenth doesn't help u so much
@shadowls
once again someone has written this super brute forcer and I'm quite sure once again if he is aked to proof this he wont answer, has lost this super program, is afraid someone steels his knowledge or it turns out he has some additional infos about the pw.
Greetz
system_meltdown wrote: [quote]sakarin wrote: oh and system meltdown is the only person apart from richo with this chall complete. probably because he has to accept the challenges so he views them before hand..
1: I don't cheat. 2: I beat this when Richo sent it to me, and I had no help from him. 3: I have to view them before hand? It's a JavaScript challenge, all I had was the script, I had to beat it before I could set up a completion page.[/quote]
Ok, I understand that your the alimighty and shit but give me a fuckin break. The Bruteforcer I have wrote has spit out over 135,00 false positives in less than 10 minutes, and I am only 9 characters in (working on a 12 character password).
here's only a handful of them… anf by my calculations that means my bruteforcerwill spit out 2,460,375,000,000,000 - yeah that's over 2 quadrillion false positives or 2 * 1000 billion. And some one mentioned grepping the has collisions. OK, come on be real. This challenge is BS. And if you beat it, its because someone helped you.
I guess most people will never even get a bruteforcer that can get to first combination in the first place. This challenge is bullshit.
[deleted]
I first started this with a brute forcer, got too many valid answers. System then posted a "wordNUMBERword" format of the password.
I then wrote two programs.
1- To generate my own wordlist making some assumptions about the problem.
2- A dictionary attack that, when the wordlist was right, solved in a few seconds.
This is atleast how I did it.
stdio wrote: I first started this with a brute forcer, got too many valid answers. System then posted a "wordNUMBERword" format of the password.
I then wrote two programs.
1- To generate my own wordlist making some assumptions about the problem.
2- A dictionary attack that, when the wordlist was right, solved in a few seconds.
This is atleast how I did it.
Ok just to specify it, did you generate it like basically bruteforcing (aaa111bbb,bbb111ccc) or did you combine several wordlists to create the right format for the challenge ?
Also can't help it but your avatar is so damn funny !:D
I basically knew the words would be English language(as they are in most challenges). The password length is also 12 (Mathmatically proven by Zues). So I made assumptions about the number and used a std dictionary to form 12 character passwords in that format. Granted the first letter of the password has sum = 0 so it actually solved before I got the real password, but if you get that right, you will obviously know what the answer should be,
stdio wrote: I basically knew the words would be English language(as they are in most challenges). The password length is also 12 (Mathmatically proven by Zues). So I made assumptions about the number and used a std dictionary to form 12 character passwords in that format. Granted the first letter of the password has sum = 0 so it actually solved before I got the real password, but if you get that right, you will obviously know what the answer should be,
Al right then, thanks for reply. as I can see there are quite a lot hints on this one, so hopefully eventually I will solve it :D
nasty one.
Ok, made myself a script to adjust the password by randomly increasing/decreasing a position, works very quick (a couple of seconds). The problem is there are more passwords that match. Found theese for example [deleted]
…
They don't give any error allert but … page not found. How many random passwords match like this?… I think there must be another hint somewhere.
The password as many said has 12 characters Also if you haven't noticed first letter is obsolete.
Here is the php script. You can start with any sequence (but I've used numbers, the password is displayed in the end)
$tab = " azertyuiopqsdfghjklmwxcvbnAZERTYUIOPQSDFGHJKLMWXCVBN0123456789_$&#@";
$checksum=88692589;
$power=Array(0, 1, 8, 27, 64, 125, 216, 343, 512, 729, 1000, 1331);
$number=Array(19,19,19,19,19,19,19,19,19,19,19,19);
$sum=0;
$n=12;
while ($sum!=$checksum)
{ $sum=1;
for($i=0;$i<12;$i++) $sum+=$n*$number[$i]*$number[$i]*$i*$i*$i;
if ($sum==$checksum) break;
$a=rand(1,11);
if($sum<$checksum) {
if($number[$a]<86) $number[$a]++;
}
elseif ($sum>$checksum) {
if($number[$a]>19) $number[$a]--;
}
else echo "[".($sum-$checksum)."]".implode(",",$number)."<br>";
}
for ($i=0;$i<12;$i++) echo $tab[$number[$i]];
?>
Loads of people dont like these 'false positives', because in a real challenge, they would be accepted as correct. In this one however, you have to find the exact pass. There are lots of threads, so to save you trawling them, here are the hints:
- The password is 12 characters long
- The password is in the format wordNUMBERword
- The password 'makes sense'
With these 3 hints, write a decent bruteforcer in your chosen language, you could have it in under an hour (I did). Obviously it would take forever to make that may web requests, so I would rewrite the encryption algo in your chosen language, then you can try more passwords / second, without killing your internet.
Part of the fun is rewriting the JS code though, there is a certain function in there that python doesnt appear to have, so I just wrote a python version, it taught me a lot about how that function worked, both in JS and python.
I would recommend python to anyone trying this challenge, its easy to read and thus easier to keep track of whats going on. By the end, you will know the algo inside out.
24 hours pass, and I have an idea. Knowing the format, this may not be as hard as I thought. 12 characters long, wordNumberword
If we had XXXXXXXXX9XX that could be tough, but if it were more like XXX999XXXX <–i forgot 2 chars, I was tired. the keyspace is cut down.
bruting (26^3) and (10^3) and (26^4) would be way faster than (26^9) and (10^1) and (26^2)
One of jjbutler's posts said he did it in less than an hour, so just a guess of how it could be worked out. Still beginning to write something.
yep I'm using really really long dictionary and list of numbers, combine them in the right format and if they have 12 char compare them against the algorithm. Thing is that I just took the biggest dictionary I found online, so it's been a while and I'm still on 'A words':( also even with the dictionary there is shit loads of false positives…
clone4 wrote: yep I'm using really really long dictionary and list of numbers, combine them in the right format and if they have 12 char compare them against the algorithm. Thing is that I just took the biggest dictionary I found online, so it's been a while and I'm still on 'A words':( also even with the dictionary there is shit loads of false positives…
Language? Also; optimize code (loops!).
jjbutler88 wrote: Remember, its a bruteforcer, but the password 'makes sense'. Think about what kind of numbers could be used to create a password like that (e.g. some1, 2moro) D
maybe too much of a hint… anyway it helps a lot, gotta get rid of a lot of numbers and words :)
spy: perl, using 3 nested loops and basically nothing else
Anyone around that has done this in C++? I've tested string::find(), it does what indexOf() does in javascript when it takes only one parameter like in the code.
{
long sum=1,index;
for(int i=0,n=entry.length();i<n;i++)
{
index = tab.find(entry.substr(i,i+1)); //tab is global
sum += (index*n*i)*(index*i*i);
}
return sum;
}```
should work, but when I test one of the false positives that someone posted, something must be wrong there.
```markuptest("aLOCs687Jaaa");``` yields 5802193
sharpskater80 wrote: Anyone around that has done this in C++? I've tested string::find(), it does what indexOf() does in javascript when it takes only one parameter like in the code.
{
long sum=1,index;
for(int i=0,n=entry.length();i<n;i++)
{
index = tab.find(entry.substr(i,i+1)); //tab is global
sum += (index*n*i)*(index*i*i);
}
return sum;
}```
should work, but when I test one of the false positives that someone posted, something must be wrong there.
```markuptest("aLOCs687Jaaa");``` yields 5802193
I don't code in C++, but maybe try to write what itineration is the loop in, because in my perl code, I get loads of false positives, but only ones that are in the last itineration of the loop will produce the alert box... ie:
[deleted]
and the format is : itineration ! sum : answer : localtime, just in case you were lost :D
stdio wrote: I first started this with a brute forcer, got too many valid answers. System then posted a "wordNUMBERword" format of the password.
I then wrote two programs.
1- To generate my own wordlist making some assumptions about the problem.
2- A dictionary attack that, when the wordlist was right, solved in a few seconds.
This is atleast how I did it.
Number 2 there, I don't understand how we could get our program to differentiate the correct pass from one that makes the checksum.
Alright, just looking at the math behind the keyspace. Remember the format too.
CNNNNNNNNNCC
CNNNNNNNNCCC
CNNNNNNNCCCC
CNNNNNNCCCCC
CNNNNNCCCCCC
CNNNNCCCCCCC
CNNNCCCCCCCC
CNNCCCCCCCCC
CNCCCCCCCCCC```
10 there, then figure the other parts where the number could start, I got 45 combinations.
So when stdio said the" wordlist was right" I guess that means he knew where the number started in the string and how far it extended.
Beside trial and error, I don't know how to figure that out. It just seems like the few people who beat it have deduced something extra about
that which led them to solving it. I'm still optimistic about there not being more than 4 consecutive of the same character, like "CCCCNNNNCCCC".
Even 5 isn't too bad though.