81–90 of 263 posts
There is like... four people I know I could send this to who'd laugh, it's so niche. Yet I also laughed out loud when I got how conventionally impossible it is.
> Yet I also laughed out loud when I got how conventionally impossible it is. Maybe give it a whirl with https://sha256algorithm.com/? haha
Earlier quoted context omitted.
I ended up crossposting it to the few security rooms I'm in for quick laughs But for what it's worth, this also serves as a great initial CTF-type introduction to how debuggers work in web browsers.
If the debugger is open, Passwordle automatically breaks the execution right where the answer is determined. Now that's service.
[0] https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...
They cynical side of me notes what a great phish this could be. People are inclined to enter passwords they regularly use just to see the visualization of their favorite passwords. With a little logging -> send home, you'd be harvesting passwords left and right.
It's hosted on Github Pages which is just static file serving. And thanks to CORS restrictions I don't think you could phone home. Unless there's a workaround I'm not thinking of.
They cynical side of me notes what a great phish this could be. People are inclined to enter passwords they regularly use just to see the visualization of their favorite passwords. With a little logging -> send home, you'd be harvesting passwords left and right.
It's hosted on Github Pages which is just static file serving. And thanks to CORS restrictions I don't think you could phone home. Unless there's a workaround I'm not thinking of.
They also don’t set a CSP header, which opens up the opportunity to exfiltrate data by other means, e.g having the browser load an image on your.site/$password.jpg.
Got it in one "guess." Apparently どうぞ means "here you are." Makes me think the brick was deliberately left in the door for folks who look for such things.
My wife was looking at me when I opened this. “What are you grinning at?” I just locked my phone and put it face down on the table…
Why would you do that xD - I'd have explained it to her instead, doing what you did I'm not sure I'd be happy about as wifey ...
I actually did explain after that ellipsis, her response:
“That’s niche!”
She is also well aware of what hashing is.
This would be kind of fun to write a solver for. You'd burn the first few guesses to get some positional constraints, then filter a rainbow table down to viable guesses. I'm not sure you'd be able to get a very good success rate in just 10 possible guesses though.
In practice, I don't think it's computationally feasible. You can't keep all 2^90 = 10^27 possible solutions around in memory. Bitcoin does 200 EH/s, so 2e20 hashes/s. So the entire bitcoin mining network would have to work for 2 months (5e6 seconds) or so - don't see how you can meaningfully reduce the work (it would indicate a flaw in SHA256, no?).
nice, though I'm very disappointed the answer wasn't hunter2
Yeah same. From the source code, the answer is a random 14-character string, generated on load: function randomPassword() { let letters = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'; let digits = '0123456789'; let punctuation = '!"#$%&\'()*+,-./:; ?@[\\]^_`{|}~'; let s = letters.repeat(7) + digits.repeat(4) + punctuation.repeat(3); let length = 14; let res = Array.from({length}, (() => s[randomInt(s.length…
do I gain a bitcoin if I win ?