Re: Cracking Strings from URLs

Richard Kettlewell <[email protected]> wrote:
> [email protected] (Computer Nerd Kev) writes:
>> Rich <[email protected]> wrote:
>>> Computer Nerd Kev <[email protected]> wrote:
>>>> I got a copy of the PHP code. Turns out it's a "transposition
>>>> cipher" which adds different numbers to the ASCII value of each
>>>> character in sequence.
>>> 
>>> Also called the Ceasar cipher:
>>> 
>>> https://en.wikipedia.org/wiki/Ceasar_Cipher
>>
>> Almost, but unlike the description there, the number of shifted
>> positions varies for each character in the encrypted string, since the
>> shift length depends on the ASCII value of each character in the
>> password.
> 
> Sounds like the Vigenere cipher, see
> https://en.wikipedia.org/wiki/Vigen%C3%A8re_cipher#Cryptanalysis for the
> basics of how to break it.

Thanks for the definition. In this case I (correctly) assumed that
the encrypted content wasn't going to be suitable for a frequency
analysis attack because it wasn't language but identifying numbers
and strings used for a database lookup and webpage generation. It
seems most other methods might not be relevant either, but perhaps
"Key elimination" can be used in an approach to guess the key
length and then determine the key (I'm not sure if the fixed value
subtracted as well as the current key letter value defeats that). I
can't say I'm really following the description of "Key elimination"
there on my first attempt.

Not knowing the encryption method used before I got access to the
encryption code (which also contains the key/password), I was
interested in whether software for an automatic brute-force attack
against all such weak ciphers was available. If it had been using
something as simple as the Caesar Cipher, it'd certainly be
possible.

The point is I didn't want to spend hours figuring out ways every
known cipher can/can't be most efficiently brute-forced, and then
how long it would take with the processing power available to me to
try each in sequence. I hoped there might be an open-source project
where people who find that more fun than I do had already combined
known brute-force cracking techniques for diffent ciphers into a
simple-to-use program that tries them all in turn. Like John The
Ripper (and others) for password hash cracking. In fact I thought
given all the different open-source password hash cracker projects,
it would be extremely likely (yes I know maybe they're easier to
write since they just have to generate hashes, but still). I did
find "bruteforce-salted-openssl", but it's for brute-force cracking
real modern encryption methods, with sufficient hints, not quirky
ancient ones that OpenSSL never used (I presume).

>> That it was also base64 encoded would've thrown a spanner in the
>> works,
> 
> ??? it should be a non-issue, you only have to base64-decode it once.

Assuming a brute-force approach, trying likely sub-sets of all
possible decryption keys (in this case the key turned out to be a
single English word with some letters replaced with numbers),
unless you know that it's base64 encoded as well as encrypted, you
have to try to brute-force both the encoded and the base64-decoded
string to see if either contains the known text inside it. Plus all
the other possible ways you could encrypt text (assuming it was
ASCII text, not binary numbers, which being generated by a PHP
script it probably was) and get ASCII output, including other
binary-to-ASCII encoding schemes or a function of the encryption
algorithm itself which limits the range of bytes that it outputs.

Anyway, thanks but short of receiving software suggestions, I might
bail out of this discussion now because discussing ways I guess
such software might work is pointless and taking too much of my
time. I've spent far too long today thinking about and writing these
replies, which is basically what I wanted to avoid in the first
place by finding software written by people who'd thought this
through already. My problem is solved this time, and whether it's
possible or not, such software seemingly doesn't exist to help me
next time.

-- 
__          __
#_ < |\| |< _#