Follow us on Twitter!
Understanding is the answer, hatred is the problem, and hackers are the slaves abused and destroyed in the process of peace online - Deshouleres
Friday, April 18, 2014
Navigation
Home
HellBoundHackers Main:
HellBoundHackers Find:
HellBoundHackers Information:
Learn
Communicate
Submit
Shop
Challenges
HellBoundHackers Exploit:
HellBoundHackers Programming:
HellBoundHackers Think:
HellBoundHackers Track:
HellBoundHackers Patch:
HellBoundHackers Other:
HellBoundHackers Need Help?
Other
Members Online
Total Online: 10
Guests Online: 9
Members Online: 1

Registered Members: 82822
Newest Member: TheBunter
Latest Articles
View Thread

HellBound Hackers | Computer General | Hacking in general

Author

Random URL Crack


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 27-12-05 08:16
I'm developing a web application that has to include a "code" in the URL. The code is a randomly generated, 16-character string.

This is an example:

http://www.myserver.com/page.htm?id=userid&code=aDYHnP5%5eOT9EJS8T

Assume the following:

1. You know the userid.
2. You know the code is 16 characters.
3. There are no restrictions to the number of times you could hit the URL.

Could anyone tell me how long it might take to break the code and access the contents of this URL. I'm not sure how challenging this is and would love some experienced input.
Author

RE: Random URL Crack

Mr_Cheese




Posts: 2468
Location: Brighton, UK
Joined: 30.11.04
Rank:
Uber Elite
Posted on 27-12-05 12:04
well, lets say you brute forced the URL (which would be the only option)..

say you are bruting at 3 attemtps a second. you have 9999999999999999 possibly combinations.

So, it sould take about 10598968 years to brute force every combination.

Not to mention you could add a quick anti brute force script using sessions.
i.e.. Every false attempt you add 1 to a session number... if session number > 5 then die("wait for session to clear"Wink

simple. So i think your script is pretty safe.


http://www.hellboundhackers.org/
Author

RE: Random URL Crack


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 27-12-05 13:11
well its 18 characters long, you have 16 letters * 2 for caps, plus 10 digits, including say 10 special chatrers ., &, / ? etc. you have 52, and 18 of then so thats 52^18 as cheese says 3/second you have (52^18)/3 /60 /60 /24 /365.25 =8.2^22 years. if you dont know tahts gigantic. [EDIT] There are 26 letters not 16 Pfft [/EDIT]




Edited by on 27-12-05 23:11
Author

RE: Random URL Crack

n3w7yp3
Member

Your avatar

Posts: 358
Location: USA
Joined: 19.03.05
Rank:
Moderate
Posted on 27-12-05 22:06
Hmm, are we allowed parallel sessions, and do we have to come from only 1 host?

Also, is the string really random, or just psuedo random (like a PNG)? If its psuedo random, it may be possible to view a few thousand valid strings and then make a few guesses to get the real one.

But like Mr_Cheese and wolfmankurd said, if you're coming from only one host with one connection, it would take an inordinate amount of time.


"Root is a state of mind" -- K0resh
Author

RE: Thank you


Member

Your avatar

Posts:
Location:
Joined: 01.01.70
Rank:
Guest
Posted on 28-12-05 10:00
The "code" portion of the URL included some URL-encoded characters -- that's why the code appeared longer than 16 characters.Smile However, even with that, I think I get the idea that this random approach would be tough to break.

Thanks for the feedback.

p.s. - Parallel hits would be allowed, but I think at some point firewall alarms would be triggered.
Author

RE: Random URL Crack

n3w7yp3
Member

Your avatar

Posts: 358
Location: USA
Joined: 19.03.05
Rank:
Moderate
Posted on 28-12-05 18:41
No, parallel session would not trigger firewall alerts, unless you're using something like PIX.

It would however, trip an IDS or an IPS alert, quite quickly.


"Root is a state of mind" -- K0resh