Skip to content

Commit 2a1bf9c

Browse files
g0tmi1kg0tmi1k
authored
Merge pull request #969 from molangning/patch-php-magic-hash (does remove some values)
Added php hashes Source: https://github.com/spaze/hashes/
2 parents debe0cd + b322c01 commit 2a1bf9c

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+3180
-49
lines changed

‎Passwords/PHP-Magic-Hashes.txt‎

Lines changed: 0 additions & 25 deletions
This file was deleted.

‎Passwords/php-hashes/README.md‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# PHP magic hashes
2+
3+
PHP has some unique features which makes hash collisions more easier when using the `==` to compare.
4+
5+
The raw text are taken directly from [spaze/hashes](https://github.com/spaze/hashes/)
6+
7+
- - -
8+
9+
### Floating comparison
10+
11+
Any strings that starts with any numbers of `0`, followed by `e` then ends with only numbers will be treated as zero. An example of such strings are `0e123456` and `00e123456`. [Example code](https://3v4l.org/n8iOp)
12+
13+
This behavior can be extended to numbers, like `'0' == '000`. [Example code](https://3v4l.org/K9QRb)
14+
15+
With loose comparison, these two example strings will equate to each other as both of them are treated as a zero in the backend.
16+
17+
Sometimes, hashes of specific strings will result in those special strings as an result. Those hashes are called `magic hashes`
18+
19+
Here is an example of such weak comparison for [sha256](https://3v4l.org/Lu7tm).
20+
21+
- - -
22+
23+
### Plaintext
24+
25+
Plaintext.txt just contains some ways to abuse php's weak comparison
26+
27+
- - -
28+
29+
### Truncated text
30+
31+
For bcrypt, passwords are automatically truncated to 72 characters, so as long as the first 72 characters match, the hashes will match.
32+
33+
[Bcrypt example](https://3v4l.org/MsfS0)
34+
35+
Descrypt have similar behavior to bcrypt, but passwords are instead truncated to 8 characters.
36+
37+
- - -
38+
39+
## Pre-hashed
40+
41+
<!--- Modified from https://github.com/spaze/hashes?tab%253Dreadme-ov-file#pbkdf2-hmac-sha1-pbkdf2-hmac-sha224-pbkdf2-hmac-sha256-->
42+
43+
If you use a password longer than 64 bytes and hash it with PBKDF2-HMAC-SHA1, it is first pre-hashed with SHA1.
44+
45+
For example, `PBKDF2-HMAC-SHA1(password1) === PBKDF2-HMAC-SHA1(password2)` as `sha1(password1) === bin2hex(password2)`.
46+
47+
This behavior can also be seen in `PBKDF2-HMAC-SHA224` and `PBKDF2-HMAC-SHA256`.

‎Passwords/php-hashes/floating_comp/crc32.txt‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
HFS_uPqtIQPl:0e929373
2+
HFS_NhqlNQ1D:0e965437
3+
HFS_+1G2t/1r:00e84097
4+
HFS_6nk6Zta1:0e673017
5+
HFS_MmTo331q:0e644471
6+
HFS_AzZkcN8f:0e551616
7+
HFS_0LxhhhkZ:0e840769
8+
HFS_iKGvCNnD:0e402980
9+
HFS_YYdr5SWA:00e60109
10+
HFS_kJ8SLtXh:0e513732
11+
do+d4JXvGqvL:0e687021
12+
9tawE8a0EUyU:0e626693
13+
i6BliFUdioZ2:0e805102
14+
ZzukD6ZZUYnf:0e138757
15+
R0GVRbsgqAkq:0e263353
16+
Dusy8MDlN1DG:0e859691
17+
o2XXS8QutHnK:0e616557
18+
rWySA3KKmokQ:0e951917
19+
zu9dxemJPNdk:0e223236
20+
cG4ZtD4z8JiK:0e559727

‎Passwords/php-hashes/floating_comp/crc32b.txt‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
HFS_t90miW9g:0e395566
2+
HFS_cJ3zkvQY:0e508686
3+
HFS_BtdiQ0kq:0e867068
4+
HFS_oimsNm9f:00e36431
5+
HFS_Ff7z2lY9:0e957694
6+
HFS_1ogclZt0:0e245532
7+
HFS_6lpwmZAV:00e62469
8+
HFS_1nUsdYXt:0e731733
9+
HFS_sseFHTIO:0e975617
10+
HFS_3y5RlRwJ:00e65928
11+
m7IHnxcRTBBO:0e940524
12+
s8nGXfzc1gLV:0e306100
13+
5JYJnHH7EB7w:0e383201
14+
ppBjSUTcuIde:0e956113
15+
W/GKrHQ9sRqk:0e772663
16+
cCsoYjRJ3qL0:0e050048
17+
0rc8nlzuCvtG:0e419810
18+
Prq11e6Styrp:0e292230
19+
0joOpQlWgVSD:0e501433
20+
XqrtwN9LgTM/:0e689095

‎Passwords/php-hashes/floating_comp/fnv132.txt‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
HFS_fJRRVm+S:0e604578
2+
HFS_jpRkyCVW:0e812503
3+
HFS_GrBcUOEe:0e362351
4+
HFS_CP4WQQ/m:0e829559
5+
HFS_MYXHoW7e:00e21725
6+
HFS_6m34HXl+:0e300614
7+
HFS_hVCZWCh4:0e824542
8+
HFS_VNIzVR6G:0e349231
9+
HFS_FwB287AP:0e887988
10+
HFS_fnsOA2UV:0e962163
11+
jQBvBPJca0X6:0e191084
12+
v9v5lkxbgndN:0e708569
13+
KKduycJo2NA4:0e859228
14+
RW3AsBuFRofx:00e21355
15+
H/8tFwVkV0nd:0e829312
16+
vH55u2YbjcAA:0e265582
17+
zP9Izjs2irUW:0e673403
18+
61ePjhO7MXSy:0e997362
19+
zEL2Ax4CVoFz:00e03591
20+
kAnNwLx+vmlh:0e498108

‎Passwords/php-hashes/floating_comp/fnv164.txt‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
HFS_mmjH9CNN:0e99769769728569
2+
HFS_6XEFLJOH:0e77252548411175
3+
HFS_2jtp0982:0e34597864874626
4+
HFS_b3kSpfs+:0e30751543430386
5+
HFS_aAQs6Cyu:0e66626906207668
6+
HFS_qRCQCIaK:0e97108743422874
7+
HFS_h/B2aEbV:0e48470717638788
8+
HFS_NQRnuOOl:0e78474377494907
9+
HFS_BaC2dl4c:00e7018025920202
10+
HFS_HF6Wgc28:00e4477970079172
11+
ICE1d0K/RL7T:0e87116729093816
12+
OgpHAyV7w/pt:0e92510903960722
13+
Ls/ijNyI2dW3:0e49565360806964
14+
vT+ia3KjNMMn:0e43654725309262
15+
8UZZxmSBbj7f:0e55840857685749
16+
mUxTfMMkdSec:0e33409805165683
17+
z9B8zV8jAUJl:0e43960404058632
18+
LfauICk8l0d6:0e10379759030222
19+
BMS4d1MCRE3m:0e12639087316691
20+
6KyW3y0vOXSS:0e44708754369825

‎Passwords/php-hashes/floating_comp/fnv1a32.txt‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
HFS_wyEBSA7V:0e534803
2+
HFS_NTG/rp8K:0e380702
3+
HFS_8bb79J+r:0e499146
4+
HFS_NCLJdw8D:0e279619
5+
HFS_+U/ddhtj:0e844548
6+
HFS_wR+uZeeF:0e696336
7+
HFS_t8jKENCz:00e50378
8+
HFS_p0BbTwIs:0e873774
9+
HFS_HcjAD1gZ:0e558807
10+
HFS_Y1iiKHNg:0e850401
11+
Ky/FMUV7acqp:0e338008
12+
nIao+ZCGW1yi:0e850185
13+
Ba+1AjsMkgU4:0e611004
14+
dBWEkOOVrm1H:00e81498
15+
pz0fUrCik7Xj:0e561856
16+
VVwHKixOOkp5:0e265262
17+
brm9jKlyPDuD:0e577432
18+
j9ppOBAEe4FI:0e888223
19+
2XCVJqdz5buc:0e647622
20+
ifU9AwKqTpFk:0e859873

‎Passwords/php-hashes/floating_comp/fnv1a64.txt‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
HFS_Zk558Stl:0e63735032620881
2+
HFS_Z0zC19dz:00e4539999025438
3+
HFS_AjgVckBy:0e24330735757830
4+
HFS_Rsa1ptfV:0e14987418690258
5+
HFS_EB4aWjEF:0e99230175338237
6+
HFS_xiyO7ooR:0e59842152613905
7+
HFS_ZzkcfVgb:0e25056956505672
8+
HFS_Dn1zB//4:0e03757793636208
9+
HFS_NGPMd7bq:0e44676527555825
10+
HFS_tmbw2/qf:0e40131582938791
11+
pco3ZfZmrUBJ:0e05359896370116
12+
bz9ISyvY9Vb3:0e65395150279106
13+
M6R0BrFPl148:0e43580429083055
14+
W3ip6wIFHvas:0e06505527087824
15+
eCDWwfqkpUIR:0e25777293567931
16+
IJtSxVbjF2ob:0e81314171010538
17+
064Tu56U1UEb:0e68411166834011
18+
v2juiQs2UUxS:0e06435821426364
19+
pviQoG24tL22:00e3577320523955
20+
mGToWOBcVspV:0e53560715322800

‎Passwords/php-hashes/floating_comp/haval128,3.txt‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
Hc0aB8p8CpKi:00e87990840549464436715117226983
2+
BGGJlLv/GYok:00e85650966369081160436000945995
3+
s7WMcKnZ/kzg:00e97615161216545460560708019418
4+
NK+nx5eetv/p:0e637481972504749625591446873225
5+
MUn+9Ib6/NMO:0e564934382199694374935868660885
6+
towJzaPbSeJN:0e800051290985131754184104629939
7+
EjFIOVEP2Y/w:0e648021848868658747230365721319
8+
tVf4T+/e1BRT:0e197045554516607160549489551104
9+
+Q8pxIx4VkiZ:0e323951952843860186883283848540
10+
xWAK0mTzfVrG:0e338717845199315687624058385989
11+
HFS_eVqZgPDV2o6D:0e803410568231701558419329821959
12+
HFS_FmSb/K9NnkL3:00e27465814007486943610626830963
13+
HFS_csuacgV1fhVy:0e496412321227784868481853981968
14+
HFS_h6PP2IEtlFat:0e109202590694681889848277372784
15+
HFS_woa6CK0FITIy:0e888470791968982727374420202621
16+
HFS_49EiLRodZfmQ:0e843253718875009042858566146390
17+
HFS_Ja7HxaNIKdD2:0e300530956879222335658470434733
18+
HFS_+fAaaZUkDHUE:0e087311696200150344500783258968
19+
HFS_HqJ0DJ0q3plN:0e109720983314623637038758578773
20+
HFS_76se6PIp21MU:0e223117526056466767519217492299

‎Passwords/php-hashes/floating_comp/haval128,4.txt‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
kkNwiLvp:0e224499306604034592498556683884
2+
aVzj4kSl:0e699098147704478302187197452577
3+
Rr0rtxAmJkX1:0e948786571371740736679014195910
4+
pOfQlZN1bEe+:0e763143522516249376445822634702
5+
X5FUngTs0xmK:0e034132293760348512897203627244
6+
B2wruC8LuwPp:0e792256378944410505513115026683
7+
GkKeU7RSZ+tB:00e00956485375103399460147021060
8+
eEo15Ae+wfot:0e731970944586972288355541307227
9+
hN6nZpUTJbUL:0e546684356004016895095440515698
10+
KnJ12oTxpzM0:0e230201982980004430779943196315
11+
Eq1Lp91ZUwdJ:0e850895948803892376429698758484
12+
8a0rD9lxxe/d:0e494613744998704148276916252662
13+
HFS_2vFy8egqyX86:0e411443916369260608664108755373
14+
HFS_rpeHhFxDD8Hr:0e430966836024156014941675462009
15+
HFS_s3ZC0Zi0KUT8:0e308320803113259548747746525892
16+
HFS_MeNMcKEgAq6s:0e911510173906812607381599030115
17+
HFS_mzdfepOik2d9:0e406117797053803350857960561164
18+
HFS_/gafnmo3h7te:0e707962923571076517504510602074
19+
HFS_VolXadwBfBGS:0e354055072092201161847707006284
20+
HFS_bC2bKTitaVql:0e588031527566426353005807499347
21+
HFS_4kNYv081anJC:0e924023131980996780460963248504
22+
HFS_fYISH6WAAXUQ:0e262623687505394293343859341884

0 commit comments

Comments
 (0)