SRL Archive - Non-RuneScape Scripts

Password or string obfuscator/deobfuscator


rj

2015-03-14 15:58:01

I have a lot of passwords for a lot of different websites so I decided to create a simba script that can store your password (without storing your password in plain text, and not using one of the existing simba scramblers in simba, because you can also reverse most of them).

[spoiler=How it works]

This script using a very simple algorithm: It inserts random characters based off the keycode you entered, resulting in a scrambled string. For example lets say you have the string 'hello' and choose to use '1865' as your keycode. It will insert 1 random character before 'h', 8 random characters before 'e', 6 random characters before 'l' and so on.

[/spoiler]


The first script, outputs a string for you to store. Simply put the password you want to store into 'crunchString' and select a pin you want to use to deobfiscate the string.

[spoiler=string obfiscater]
const
keyCode = 1865;
crunchString = 'Hello55';
//leave inject alone
inject = '1234567890qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM';

procedure crunch;
var
newStr, keyCodeString:string;
i, len, len2, k, count, strLength, rem, loopCount, a, d:integer;
begin
keyCodeString := IntToStr(keyCode);
rem := length(crunchString) mod length(keyCodeString);

for i := 1 to length(keyCodeString) do
len := len + strToInt(keyCodeString[i]);

for i := 1 to rem do
len2 := len2 + strtoInt(keyCodeString[i]);

loopCount := round(length(crunchString) / length(keyCodeString));
strLength := (loopCount * len) + len2 + length(crunchString);
setLength(newStr, strLength);
i := 0;
for a := 1 to loopCount do
for d := 1 to length(keyCodeString) do
begin
for k := 1 to (StrToInt(keyCodeString[d])) do
begin
i := i + 1;
newStr[i] := inject[random(length(inject)) + 1];
end;
i := i + 1;
count := count + 1;
newStr[i] := crunchString[count];
end;
for a := 1 to rem do
begin
for k := 1 to StrToInt(keyCodeString[a]) do
begin
i := i + 1;
newStr[i] := inject[random(length(inject)) + 1];
end;
i := i + 1;
count := count + 1;
newStr[i] := crunchString[count];
end;
writeln(newStr);
end;

begin
try
crunch;
except
end;
end.

[/spoiler]


When you want to deob the string, input it into this script:

[spoiler=deob]
const
password = '';
keyCode = 1865;


type
TPassword = record
keyCode:integer;
contents:string;
end;

function TPassword.parse():string;
var
newStr, keyCodeString:string;
count, d, codeCount, l, l2:integer;
begin
keyCodeString := IntToStr(self.keyCode);
l := length(self.contents);
l2 := length(keyCodeString);
while (codeCount < l) do
for d := 1 to l2 do
begin
setLength(newStr, length(newStr) + 1);
count := count + 1;
codeCount := codeCount + StrToInt(keyCodeString[d]) + 1;
newStr[count] := self.contents[codeCount];
end;
d := 0;
result := newStr;
writeln(newStr);
end;

var pass:TPassword;

begin
pass.contents := password;
pass.keycode := keyCode;
try
pass.parse();
except
end;
end.
[/spoiler]


You can only unscramble the string if you know the keycode you used to scramble it with. I'm working on a GUI for it ATM

Brandon

2015-03-14 19:25:09

From: rj
Not using one of the existing simba scramblers in simba, because you can also reverse most of them.


Lol.. I hate to be the bearer of bad news, but did you realise that you are also reversing your own algorithm? Hence obfuscation and deobfuscation? The exact same thing Simba does..


From: rj

You can only unscramble the string if you know the keycode you used to scramble it with. I'm working on a GUI for it ATM


:S Take a look at Simba's encryption algorithms. It does exactly this.

rj

2015-03-14 20:28:56

From: Brandon
Lol.. I hate to be the bearer of bad news, but did you realise that you are also reversing your own algorithm? Hence obfuscation and deobfuscation? The exact same thing Simba does..




:S Take a look at Simba's encryption algorithms. It does exactly this.


You have to know the keypin that you used to deob it though, with simbas you obfiscate and the deob, with this one you obfiscate, give it a number, and if its the same number you deobed it with you will get the string back

idk how easy it is to crack but I was bored and figured it's better than storing plain text

Olly

2015-03-14 21:32:02

From: rj
You have to know the keypin that you used to deob it though, with simbas you obfiscate and the deob, with this one you obfiscate, give it a number, and if its the same number you deobed it with you will get the string back

idk how easy it is to crack but I was bored and figured it's better than storing plain text


uh…. I think you dont know the difference between a hash and encryption.

Brandon

2015-03-14 21:56:00

Olly is right.. You're mixing up hashing and encryption.


@OP: Hashing is where you just apply an algorithm to the blocks of data without a key or anything special. Once done, it's irreversible to some extent. Usually hashes can be broken using a rainbow table or look up table but sometimes the time complexity can be extremely large (taking forever to reverse). Some hashes have loop holes such that it can be broken in a shorter amount of time.


Encryption: You take the blocks of data and apply an algorithm to it using a special key/pass-phrase. The algorithm is always reversible given that you have the correct key/pass-phrase. Some algorithms have loop holes where you can crack it and figure out the original block of data OR the key/pass-phrase. This is called single key encryption.

There is also public and private key encryption (double key encryption) aka Alice and Bob: http://en.wikipedia.org/wiki/Alice_and_Bob Simba doesn't support this kind.


Simba has both hashes and single key encryption algorithms:



Your algorithm is a bit naive. Many before you have done the same thing.. It's easy to break and in an extremely short amount of time compared to recognised algorithms.

Simba's RC2 may not be strong, but it's stronger than yours by quite a lot. You also won't need a lot of code and you can apply whatever hash you want as well. You're better off applying the same concept of your algorithm to Simba's but there's not really a need.


Also, the only way to have cryptographically strong passwords is to never store them at all. Usually a developer only stores the salted hashed version of the password and username. Then when you log in, it applies the same algorithm to your credentials and compares that to the salt + hash already stored. This way, if the database gets compromised, the password isn't stored in reversible text. You'll NEVER be able to do this for RS because the password is required to log in via Script.


I hate to discourage you, but you're wasting your time.. to put it bluntly. Just use what's in Simba already. You have a better chance doing that. Better yet, use nothing. If you don't want to store the password, just don't. Your way requires you to enter the password into the script manually anyway. Why bother encrypting and decrypting then?

rj

2015-03-14 22:03:49

From: Brandon
Olly is right.. You're mixing up hashing and encryption.


@OP: Hashing is where you just apply an algorithm to the blocks of data without a key or anything special. Once done, it's irreversible to some extent. Usually hashes can be broken using a rainbow table or look up table but sometimes the time complexity can be extremely large (taking forever to reverse). Some hashes have loop holes such that it can be broken in a shorter amount of time.


Encryption: You take the blocks of data and apply an algorithm to it using a special key/pass-phrase. The algorithm is always reversible given that you have the correct key/pass-phrase. Some algorithms have loop holes where you can crack it and figure out the original block of data OR the key/pass-phrase. This is called single key encryption.

There is also public and private key encryption (double key encryption) aka Alice and Bob: http://en.wikipedia.org/wiki/Alice_and_Bob Simba doesn't support this kind.


Simba has both hashes and single key encryption algorithms:



Your algorithm is a bit naive. Many before you have done the same thing.. It's easy to break and in an extremely short amount of time compared to recognised algorithms.

Simba's RC2 may not be strong, but it's stronger than yours by quite a lot. You also won't need a lot of code and you can apply whatever hash you want as well. You're better off applying the same concept of your algorithm to Simba's but there's not really a need.


Also, the only way to have cryptographically strong passwords is to never store them at all. Usually a developer only stores the salted hashed version of the password and username. Then when you log in, it applies the same algorithm to your credentials and compares that to the salt. This way, if the database gets compromised, the password isn't stored in reversible text. You'll NEVER be able to do this for RS because the password is required to log in via Script.


is that why most websites change your password for you, because they don't actually know your password?

Brandon

2015-03-14 22:14:04

From: rj
is that why most websites change your password for you, because they don't actually know your password?


Websites do this when you register:


Enter Username: Foo
Enter Password: Bar

Store In Database:

[table="width: 500, class: grid, align: center"]
[tr]
[td]USR[/td]
[td]EMAIL[/td]
[td]HASH[/td]
[/tr]
[tr]
[td]Foo[/td]
[td]whatever@gmail.com[/td]
[td]Hash(Hash(Foo) + Hash(Bar) + KnownRandomSalt)[/td]
[/tr]
[/table]


Then whenever you attempt to log in, you enter your credentials:


Username: Foo
Password: Bar

and the server does (pseudo-code):


if (find((Hash(Hash(Foo) + Hash(Bar) + KnownRandomSalt)))
{
User logged in successfully.
Store Username in cookie or session or database (so that when you close tabs and revisit the website, you're still logged in).
}

As you see, the database never actually has your password stored. It only has a hashed + salted version of it. Every time you attempt to log in, it applies the same algorithm to your credentials and compares it to the stored one. Only some databases store usernames and passwords and it's quite dangerous to do (see Sony hacks lately).


Whenever you need to recover your password, they don't give you the old password. What they do is they email you a unique link that you click on and allow you to enter a new one. They basically rely on the assumption that your email is secure and not compromised.

The Killer

2015-03-15 12:14:05

From: Brandon


I'm not quite sure what I'm most impressed by this post… but I think its the fact I'v actually seen psuedo code outside of my school project… (it still seems like a stupid concept though tbh… feel free to enlighten me)
I remember reading about most of this stuff when we had the villavu hack and our database was downloaded and cracked

Brandon

2015-03-15 12:55:15

From: The Killer
I'm not quite sure what I'm most impressed by this post… but I think its the fact I'v actually seen psuedo code outside of my school project… (it still seems like a stupid concept though tbh… feel free to enlighten me)
I remember reading about most of this stuff when we had the villavu hack and our database was downloaded and cracked



I don't remember villavu's database being cracked. Besides, what's more stupid: Storing the data as plain text or encrypted text with a key? OR storing just the salted hash?

I don't think it's a stupid idea at all.. It's dumb to double hash yes, but other than that, the concept of hashing the password is better than not doing it at all.

http://security.stackexchange.com/questions/36833/why-should-i-hash-passwords

http://stackoverflow.com/a/326706/1462718

KeepBotting

2015-03-15 12:58:34

From: Brandon
I don't remember villavu's database being cracked. Besides, what's more stupid: Storing the data as plain text or encrypted text with a key? OR storing just the salted hash?


Wasn't really a "hack" but the database was compromised at one point

https://tribot.org/forums/topic/15682-villavu-hacked-what-is-going-on/

The Killer

2015-03-15 16:34:18

From: Brandon
I don't remember villavu's database being cracked. Besides, what's more stupid: Storing the data as plain text or encrypted text with a key? OR storing just the salted hash?

I don't think it's a stupid idea at all.. It's dumb to double hash yes, but other than that, the concept of hashing the password is better than not doing it at all.

http://security.stackexchange.com/questions/36833/why-should-i-hash-passwords

http://stackoverflow.com/a/326706/1462718


From: KeepBotting
Wasn't really a "hack" but the database was compromised at one point

https://tribot.org/forums/topic/15682-villavu-hacked-what-is-going-on/


Deob'ed would be a better term then… and Brandon… I was just on about the idea of pseudo code itself… nothing to do with hashing :o