php help

i am trying to work on a bruteforcer for (at the moment) md5 hashes

and i have it working for the most part but theres just 1 thing i can figure out

my code is as follows

$password='fd76c4079f65a804151557c566679cae';

$inc = 'aaa';

while($password != md5($inc))
{

$test = $inc++;

}

echo "pass: $inc";

?>```

i want to make this into a form eventually and have it so you can set how many characters to run for

the $inc starts at aaa because the hash i have there to test is 3 characters long

but how could i make this so i can change the length without a million 'if' statements

or if you have a better way to go about doing this all help is appreciated

if been combing google down for an hour and got nowhere

mainly because i cant figure out what exactly to google:angry:

thanks in advance!

try this hope it helps

$password='fd76c4079f65a804151557c566679cae';

for($i=1;i<=$_GET['start_lenght'];$i++)
 $inc .= 'a';

while($password != md5($inc))
{

$test = $inc++;

}

echo "pass: $inc";

?>```

SsAgEnT wrote: try this hope it helps

$password='fd76c4079f65a804151557c566679cae';

for($i=1;i<=$_GET['start_lenght'];$i++)
 $inc .= 'a';

while($password != md5($inc))
{

$test = $inc++;

}

echo "pass: $inc";

?>```

ehhh it doesnt

thanks though

i changed the code a bit and this is the code used

```markup<?

if (!$_POST['test']) {

echo "
<form method='POST'>
<input type='text' name='start_length'>
<br />
<br />
<input type='submit' name='test' value='Submit'>
</form>";

} else {

$password='fd76c4079f65a804151557c566679cae';

for($i=1;i<=$_POST['start_lengh'];$i++)
$inc .= 'a';

while($password != md5($inc))
{

$test = $inc++;

echo "$test
<br />";

}

echo "pass: $inc";

}

?>

and i put in '1' for the start_length and it just spits out a bunch of numbers

you can see what happens here: http://zomgz.info/test.php

and i just thought about something…how could i do it so it checks #'s as well

$length = $_GET['length'];

$str = substr($str, 0, $length);```

should do the trick. I know SsAgEnT beat me to it, and his way is probably better than this, but I'll post it anyway.


edit: why do you have these lines...
```markup$test = $inc++;

echo "$test
<br />";```

you're echo'ing the $test variable every time it loops through, and it's outputting as a number. it looks like the first loop (the one that populates the string), since it starts at 1 ($i=1), is never actually creating a string because 1 ! < 1 (the input)...and thus the $inc variable is defined in the second loop. I'm guessing php is assuming that $inc is an int since you're doing $inc++, so that's why it's outputting numbers instead of a string...hope that all made sense.

xtrmsk8r91 wrote:

$length = $_GET['length'];

$str = substr($str, 0, $length);```

should do the trick. I know SsAgEnT beat me to it, and his way is probably better than this, but I'll post it anyway.



interesting way of going about it...

but it looks alright...

ill try that

but also would there be a way to do this with numbers being included?

i will test your idea but i tested my and idk why but it don't want to add a near a :s

hey xtrmsk8r91 your way kinda works lol

goto: http://zomgz.info/test2.php

the code:

if (!$_POST['test']) {

echo "
<form method='POST'>
start:
<br />
<input type='text' name='start_length'>
<br />
<br />
end:
<br />
<input type='text' name='end_length'>
<br />
<br />
<input type='submit' name='test' value='Submit'>
</form>";

} else {

$password='fd76c4079f65a804151557c566679cae';
$str = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
$slength = $_POST['start_length'];
$elength = $_POST['end_length'];
$inc = substr($str, $slength, $elength);

while($password != md5($inc))
{

$test = $inc++;

}

echo "pass: $inc";

}

?>

but again how could we do numbers? lol:happy:

//MD5 Brute Forcer
//Initial idea: sleazoid
//modded by SsAgEnT
//add other credits here ;)

if (!isset($_POST['test']))
{
	echo "<form method='POST'><input type='text' name='start_length' value'1'>
	<br />
	<br />
	<input type='submit' name='test' value='Submit'>
	</form>";
}
else
{
	$password='fd76c4079f65a804151557c566679cae';
	$inc="a";
	for($i=1;$i<$_POST['start_length'];$i++)
	{
		$inc = $inc.'a';
	}
	while($password != md5($inc))
	{

		$test = $inc++;
	}
	echo "pass: $inc";
}

?>```

here is my variant tested and working if this don't work shoot your host xD

and about numbers i will take a look

ssagent's should work except it should say

$inc = ""; //I like to define it first

for($i=0;i<=$_GET['start_lenght'];$i++)
$inc .= 'a';

so the loop starts with 0 so if the input is 1, the length of $inc is 1, if you start with 1 it checks that 1 isn't < 1 so the loop doesn't get executed at all, thus no a's are added to the string. that's how I understand it anyway… :D

well check the last variand and avout the numbers idk :(

ok I wrote a function that lets you increment a string with a character set. so you can use lowercase/uppercase/numbers…whatever you want. here you go:

function incrementString($str, $charset) {
		//coded by xtrmsk8r91, increments a given string with a given character set
		if (strpos($charset, getlastletter($str)) < strlen($charset) - 1) {
			$str[strlen($str)-1] = $charset[strpos($charset,getlastletter($str)) + 1]; //last char of $str = placeincharset + 1;
			return $str;
		} else {
			$str = incrementString(substr($str,0,strlen($str)-1), $charset) . $charset[0];
			return $str;
		}
}

function getlastletter($str) { //there's probably one like this built-in but whatever
	return $str[strlen($str)-1];
}

implemented into an example md5 bruteforcer (something I whipped up just now) it looks like this:

<?php

function incrementString($str, $charset) {
		//coded by xtrmsk8r91, increments a given string with a given character set
		if (strpos($charset, getlastletter($str)) < strlen($charset) - 1) {
			$str[strlen($str)-1] = $charset[strpos($charset,getlastletter($str)) + 1]; //last char of $str = placeincharset + 1;
			return $str;
		} else {
			$str = incrementString(substr($str,0,strlen($str)-1), $charset) . $charset[0];
			return $str;
		}
}

function getlastletter($str) {
	return $str[strlen($str)-1];
}

$charset = "abcdefg0123456789";

$length = 2; //you can use $_GET['length']
$hash = "7a6f150b83091ce20c89368641f9a137"; //md5(b3), just a test
$str = "";

for ($x=0;$x<$length;$x++) //initialize string
	$str .= $charset[0];

while (md5($str) != $hash)
	$str = incrementString($str, $charset);


	echo "Your string is: $str";

?>

and if you run it you can see that it works…wow I can't believe I just did that, my head hurts now. :D

xtrmsk8r91 wrote: ok I wrote a function that lets you increment a string with a character set. so you can use lowercase/uppercase/numbers…whatever you want. here you go:

function incrementString($str, $charset) {
		//coded by xtrmsk8r91, increments a given string with a given character set
		if (strpos($charset, getlastletter($str)) < strlen($charset) - 1) {
			$str[strlen($str)-1] = $charset[strpos($charset,getlastletter($str)) + 1]; //last char of $str = placeincharset + 1;
			return $str;
		} else {
			$str = incrementString(substr($str,0,strlen($str)-1), $charset) . $charset[0];
			return $str;
		}
}

function getlastletter($str) { //there's probably one like this built-in but whatever
	return $str[strlen($str)-1];
}

implemented into an example md5 bruteforcer (something I whipped up just now) it looks like this:

<?php

function incrementString($str, $charset) {
		//coded by xtrmsk8r91, increments a given string with a given character set
		if (strpos($charset, getlastletter($str)) < strlen($charset) - 1) {
			$str[strlen($str)-1] = $charset[strpos($charset,getlastletter($str)) + 1]; //last char of $str = placeincharset + 1;
			return $str;
		} else {
			$str = incrementString(substr($str,0,strlen($str)-1), $charset) . $charset[0];
			return $str;
		}
}

function getlastletter($str) {
	return $str[strlen($str)-1];
}

$charset = "abcdefg0123456789";

$length = 2; //you can use $_GET['length']
$hash = "7a6f150b83091ce20c89368641f9a137"; //md5(b3), just a test
$str = "";

for ($x=0;$x<$length;$x++) //initialize string
	$str .= $charset[0];

while (md5($str) != $hash)
	$str = incrementString($str, $charset);


	echo "Your string is: $str";

?>

and if you run it you can see that it works…wow I can't believe I just did that, my head hurts now. :D

damn dude i love you

ill give you credit lol

hehe no problem. it's a little buggy as I'm finding out with some more testing, like it doesn't stop when it can't be incremented anymore, but feel free to tinker with it and stuff. good luck!