full-disclosure - Re: Cipher detection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <58DB1B68E62B9F448DF1A276B0886DF16EC8E42D@EX2010.hammerofgod.com>
Date: Thu, 7 Apr 2011 16:39:21 +0000
From: "Thor (Hammer of God)" <thor@...merofgod.com>
To: "Maksim.Filenko@...b.com" <Maksim.Filenko@...b.com>,
	"full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: Cipher detection

Actually it is a valid Base64 string - it just decodes to 24, 106, 27, 67, 102, 236, 169, 222, 184, 61, 117, 64, 153, 160, 226, 12, 24.  To get dummy@...mple.com<mailto:dummy@...mple.com> you would have to XOR that resulting binary string with 124, 31, 118, 46, 31, 172, 108, 174, 217, 80, 5, 44, 124, 142, 129, 99, 117 which I don't see any pattern in (close to that anyway, I did it in my head so I'm sure I screwed up some of them).  Maybe someone sees something...   Of course, Cal could have done it, which means it's probably Matrix for "titties."  :-p

The input and output are both 17 bytes, so an XOR makes sense, but another 17 character example would help.  And a 20.

t



From: full-disclosure-bounces@...ts.grok.org.uk [mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Maksim.Filenko@...b.com
Sent: Thursday, April 07, 2011 1:23 AM
To: full-disclosure@...ts.grok.org.uk
Subject: [Full-disclosure] Cipher detection

Hi Full-Disclosure,

I'm trying to figure out what kind of cipher was used in this:

GGobQ2bsqd64PXVAmaDiDBg=

Looks like Base64, but it's not. The original string is:

dummy@...mple.com<mailto:dummy@...mple.com>

Thanks all!

wbr,
 - Max

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/