Browse Source

Added hash checking, password strength checking, made things ajax based, added leak source.

master
GRMrGecko 10 years ago
parent
commit
720cea0e45
  1. 201
      code/api.php
  2. 277
      code/index.php
  3. 3
      header.php
  4. 17
      index.php
  5. 15
      js/sha1.js
  6. 4
      js/zxcvbn-async.php
  7. 43
      js/zxcvbn.js
  8. 10
      perl/dumpPasswords.pl
  9. 79
      perl/hashPasswords.pl
  10. 32
      perl/loadPasswords.pl
  11. 77
      perl/loadSHA1.pl

201
code/api.php

@ -0,0 +1,201 @@
<?
//
// Copyright (c) 2014 Mr. Gecko's Media (James Coleman). http://mrgeckosmedia.com/
//
// Permission is hereby granted, free of charge, to any person obtaining a copy
// of this software and associated documentation files (the "Software"), to deal
// in the Software without restriction, including without limitation the rights
// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
// copies of the Software, and to permit persons to whom the Software is
// furnished to do so, subject to the following conditions:
//
// The above copyright notice and this permission notice shall be included in
// all copies or substantial portions of the Software.
//
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
// THE SOFTWARE.
//
$publickey = "";
$privatekey = "";
function matchEmails($email) {
global $_MGM;
$query = "SELECT * FROM email WHERE";
$arguments = array();
$email = strtolower($email);
preg_match("/([^@]*)@(.*)$/i", $email, $matches);
$user = $matches[1];
$domain = $matches[2];
if ($domain=="gmail.com" || $domain=="googlemail.com") {
$query .= " `email`=%s";
array_push($arguments, $user."@gmail.com");
$query .= " OR `email`=%s";
array_push($arguments, $user."@googlemail.com");
$query .= " OR `email` LIKE %s";
array_push($arguments, str_replace("%", "\\%", $user)."+%@gmail.com");
$query .= " OR `email` LIKE %s";
array_push($arguments, str_replace("%", "\\%", $user)."+%@googlemail.com");
} else if ($domain=="ymail.com" || $domain=="yahoo.com") {
$query .= " `email`=%s";
array_push($arguments, $user."@ymail.com");
$query .= " OR `email`=%s";
array_push($arguments, $user."@yahoo.com");
$query .= " OR `email` LIKE %s";
array_push($arguments, str_replace("%", "\\%", $user)."+%@ymail.com");
$query .= " OR `email` LIKE %s";
array_push($arguments, str_replace("%", "\\%", $user)."+%@yahoo.com");
} else if ($domain=="hotmail.com" || $domain=="outlook.com" || $domain=="live.com") {
$query .= " `email`=%s";
array_push($arguments, $user."@hotmail.com");
$query .= " OR `email`=%s";
array_push($arguments, $user."@outlook.com");
$query .= " OR `email`=%s";
array_push($arguments, $user."@live.com");
$query .= " OR `email` LIKE %s";
array_push($arguments, str_replace("%", "\\%", $user)."+%@hotmail.com");
$query .= " OR `email` LIKE %s";
array_push($arguments, str_replace("%", "\\%", $user)."+%@outlook.com");
$query .= " OR `email` LIKE %s";
array_push($arguments, str_replace("%", "\\%", $user)."+%@live.com");
} else {
$query .= " `email`=%s";
array_push($arguments, $user."@".$domain);
$query .= " OR `email` LIKE %s";
array_push($arguments, str_replace("%", "\\%", $user)."+%@".$domain);
}
$queryAarray = array($query);
for ($i=0; $i<count($arguments); $i++) {
array_push($queryAarray, $arguments[$i]);
}
$results = call_user_func_array('databaseQuery', $queryAarray);
return $results;
}
if ($_MGM['path'][1]=="email") {
connectToDatabase();
if (!empty($_REQUEST['email']) && $_REQUEST['sendemail']==1) {
if (!filter_var($_REQUEST['email'], FILTER_VALIDATE_EMAIL)) {
?><h3>What was entered is not an email address.</h3><?
} else {
require_once('recaptchalib.php');
$resp = recaptcha_check_answer($privatekey,
$_SERVER["REMOTE_ADDR"],
$_POST["recaptcha_challenge_field"],
$_POST["recaptcha_response_field"]);
if (!$resp->is_valid) {
?><h3>Wrong captcha value.</h3><?
} else {
$entries = matchEmails($_REQUEST['email']);
$count = 0;
$passwords = array();
while ($entry = databaseFetchAssoc($entries)) {
if (!empty($entry['password'])) {
$count++;
array_push($passwords, array($entry['password'], $entry['leak']));
}
}
if ($count) {
$to = $_REQUEST['email'];
$subject = "Password(s) requested.";
$message = "The password(s) that were found and requested by you or someone else via https://gec.im/passwords/ are listed below:\n\n";
for ($i=0; $i<count($passwords); $i++) {
$message .= $passwords[$i][0]." - ".$passwords[$i][1]."\n";
}
$message .= "\nIf any of the password(s) listed is one you currently use, make sure that you change your password as soon as possible! Hackers released the password(s) listed and are probably working on the list to try and login to websites you use.\n\nI recomemnd that you use a password database to create secure passwords: https://lastpass.com/ https://agilebits.com/onepassword http://keepass.info/\nThis is a free service provided by James Coleman at https://mrgecko.org/";
$additionalHeaders = array("Reply-To" => "James Coleman <james@coleman.io>");
$ch = curl_init();//Using custom email server which automatically deletes sent email.
curl_setopt_array($ch, array(
CURLOPT_URL => "http://127.0.0.1:28001/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query(array(
"user" => "password@birdim.com",
"from" => "password@gec.im",
"from-name" => "Password Check",
"to" => $to,
"subject" => $subject,
"message" => $message,
"headers" => json_encode($additionalHeaders)
)),
CURLOPT_HTTPHEADER, array("Content-Type: application/x-www-form-urlencoded")
));
$result = curl_exec($ch);
curl_close($ch);
$response = json_decode($result);
if ($response->success) {
?><h3 style="color: #ff0000"><?=$count?> password(s) were emailed.</h3><?
} else {
?><h3 style="color: #ff0000">Error sending email, please contact <a href="mailto:james@coleman.io">james@coleman.io</a>.</h3><?
}
} else {
?><h3>Failed as email address could not be found.</h3><?
}
}
}
} else if (!empty($_REQUEST['email'])) {
if (!filter_var($_REQUEST['email'], FILTER_VALIDATE_EMAIL)) {
?><h3>What was entered is not an email address.</h3><?
} else {
$entries = matchEmails($_REQUEST['email']);
$count = 0;
while ($entry = databaseFetchAssoc($entries)) {
if (!empty($entry['password'])) {
$count++;
}
}
if ($count) {
require_once('recaptchalib.php');
?>
<h3 style="color: #ff0000"><?=$count?> password(s) found for your email address.</h3>
<p>
<span id="recaptcha_place"></span>
<input type="hidden" name="email" value="<?=htmlspecialchars($_REQUEST['email'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?>" />
<button type="submit" class="btn btn-primary" id="email_me">Email password(s) to me</button>
</p>
<script type="text/javascript">
Recaptcha.create("<?=$publickey?>",
"recaptcha_place",
{
theme: "red",
callback: Recaptcha.focus_response_field
}
);
$("#email_me").click(function() {
$("#email_loader").load("<?=$_MGM['installPath']?>api/email", {email: $("#email_field").val(), sendemail: "1", recaptcha_challenge_field: $("#recaptcha_challenge_field").val(), recaptcha_response_field: $("#recaptcha_response_field").val()}, function(response, status, xhr) {
});
});
</script>
<?
} else {
?><h3>There were no passwords found in this database.</h3><?
}
}
}
closeDatabase();
exit();
} else if ($_MGM['path'][1]=="hash") {
connectToDatabase();
if (!empty($_REQUEST['sha1'])) {
$entries = databaseQuery("SELECT * FROM `sha1` WHERE `hash`=%s", $_REQUEST['sha1']);
$entry = databaseFetchAssoc($entries);
if ($entry!=null) {
?><h3 style="color: #ff0000">Password seems to have been leaked to hackers via <?=$entry['leak']?>.</h3><?
} else {
?><h3>No leaks known in this database.</h3><?
}
} else {
?><h3>Enter a SHA1 hash.</h3><?
}
closeDatabase();
exit();
}

277
code/index.php

@ -23,184 +23,137 @@
require_once("header.php");
$publickey = "";
$privatekey = "";
function matchEmails($email) {
$query = "SELECT * FROM users WHERE";
$arguments = array();
$email = strtolower($email);
preg_match("/([^@]*)@(.*)$/i", $email, $matches);
$user = $matches[1];
$domain = $matches[2];
if ($domain=="gmail.com" || $domain=="googlemail.com") {
$query .= " `email`=%s";
array_push($arguments, $user."@gmail.com");
$query .= " OR `email`=%s";
array_push($arguments, $user."@googlemail.com");
$query .= " OR `email` LIKE %s";
array_push($arguments, str_replace("%", "\\%", $user)."+%@gmail.com");
$query .= " OR `email` LIKE %s";
array_push($arguments, str_replace("%", "\\%", $user)."+%@googlemail.com");
} else if ($domain=="ymail.com" || $domain=="yahoo.com") {
$query .= " `email`=%s";
array_push($arguments, $user."@ymail.com");
$query .= " OR `email`=%s";
array_push($arguments, $user."@yahoo.com");
$query .= " OR `email` LIKE %s";
array_push($arguments, str_replace("%", "\\%", $user)."+%@ymail.com");
$query .= " OR `email` LIKE %s";
array_push($arguments, str_replace("%", "\\%", $user)."+%@yahoo.com");
} else if ($domain=="hotmail.com" || $domain=="outlook.com") {
$query .= " `email`=%s";
array_push($arguments, $user."@hotmail.com");
$query .= " OR `email`=%s";
array_push($arguments, $user."@outlook.com");
$query .= " OR `email` LIKE %s";
array_push($arguments, str_replace("%", "\\%", $user)."+%@hotmail.com");
$query .= " OR `email` LIKE %s";
array_push($arguments, str_replace("%", "\\%", $user)."+%@outlook.com");
} else {
$query .= " `email`=%s";
array_push($arguments, $user."@".$domain);
$query .= " OR `email` LIKE %s";
array_push($arguments, str_replace("%", "\\%", $user)."+%@".$domain);
}
$queryAarray = array($query);
for ($i=0; $i<count($arguments); $i++) {
array_push($queryAarray, $arguments[$i]);
}
$results = call_user_func_array('databaseQuery', $queryAarray);
return $results;
}
$counts = databaseQuery("SELECT value FROM settings WHERE name='passwords'");
connectToDatabase();
$counts = databaseQuery("SELECT value FROM settings WHERE name='email'");
$count = databaseFetchAssoc($counts);
?>
Total count of email and passwords in database is <?=number_format($count['value'])?>.<br />
<?
$counts = databaseQuery("SELECT value FROM settings WHERE name='hashed'");
$count = databaseFetchAssoc($counts);
?>
Total count of passwords in database is <?=number_format($count['value'])?>.<br /><br />
Total count of hashed passwords in database is <?=number_format($count['value'])?>.<br /><br />
<div class="jumbotron">
<div class="centered">
<h1>Check your email</h1>
<h2>Check your email</h2>
<p>
This checks your email address against leaks of passwords and email addresses. If a match is found, you can have my server email you the password through gmail via ssl with settings to automatically permanently delete sent emails.
</p>
<p>
<form role="form" id="search_start_form">
<div class="row">
<div class="col-lg-8">
<div class="input-group">
<input class="form-control search-query" type="text" placeholder="Email Address" id="search_start_field" name="email" value="<?=htmlspecialchars($_REQUEST['email'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?>" />
<span class="input-group-btn">
<button class="btn btn-default" type="submit">Check</button>
</span>
</div>
<div class="row">
<div class="col-lg-8">
<div class="input-group">
<input class="form-control email" type="text" placeholder="Email Address" id="email_field" name="email" value="<?=htmlspecialchars($_REQUEST['email'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?>" />
<span class="input-group-btn">
<button class="btn btn-default" id="email_check">Check</button>
</span>
</div>
</div>
</form>
</div>
</p>
<?
if (!empty($_REQUEST['email']) && $_REQUEST['sendemail']==1) {
if (!filter_var($_REQUEST['email'], FILTER_VALIDATE_EMAIL)) {
?><h3>What was entered is not an email address.</h3><?
} else {
require_once('recaptchalib.php');
$resp = recaptcha_check_answer($privatekey,
$_SERVER["REMOTE_ADDR"],
$_POST["recaptcha_challenge_field"],
$_POST["recaptcha_response_field"]);
if (!$resp->is_valid) {
?><h3>Wrong captcha value.</h3><?
} else {
$entries = matchEmails($_REQUEST['email']);
$count = 0;
$passwords = array();
while ($entry = databaseFetchAssoc($entries)) {
if (!empty($entry['password'])) {
$count++;
array_push($passwords, $entry['password']);
}
}
if ($count) {
$to = $_REQUEST['email'];
$subject = "Password(s) requested.";
$message = "The password(s) that were found and requested by you or someone else via https://gec.im/passwords/ are listed below:\n\n";
for ($i=0; $i<count($passwords); $i++) {
$message .= $passwords[$i]."\n";
}
$message .= "\nIf any of the password(s) listed is one you currently use, make sure that you change your password as soon as possible! Hackers released the password(s) listed and are probably working on the list to try and login to websites you use.\n\nI recomemnd that you use a password database to create secure passwords: https://lastpass.com/ https://agilebits.com/onepassword http://keepass.info/\nThis is a free service provided by James Coleman at https://mrgecko.org/";
$additionalHeaders = array("Reply-To" => "James Coleman <james@coleman.io>");
$ch = curl_init();//Using custom email server which automatically deletes sent email.
curl_setopt_array($ch, array(
CURLOPT_URL => "http://127.0.0.1:28001/",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query(array(
"user" => "password@birdim.com",
"from" => "password@gec.im",
"from-name" => "Password Check",
"to" => $to,
"subject" => $subject,
"message" => $message,
"headers" => json_encode($additionalHeaders)
)),
CURLOPT_HTTPHEADER, array("Content-Type: application/x-www-form-urlencoded")
));
$result = curl_exec($ch);
curl_close($ch);
$response = json_decode($result);
if ($response->success) {
?>
<h3 style="color: #ff0000"><?=$count?> password(s) were emailed.</h3>
<?
} else {
?>
<h3 style="color: #ff0000">Error sending email, please contact <a href="mailto:james@coleman.io">james@coleman.io</a>.</h3>
<?
}
} else {
?>
<h3>Failed as email address could not be found.</h3>
<?
}
}
<span id="email_loader"></span>
<script type="text/javascript">
$("#email_check").click(function() {
$("#email_loader").load("<?=$_MGM['installPath']?>api/email", {email: $("#email_field").val()}, function(response, status, xhr) {
});
});
</script>
</div>
</div>
<div class="jumbotron">
<div class="centered">
<h2>Check your password</h2>
<p>
<span style="color: #ff0000">Only enter your password on a website you trust!</span><br />If you trust me and what I say below, go ahead and enter your password.<br /><br />
This field uses <a href="https://en.wikipedia.org/wiki/JavaScript" target="_blank">JavaScript</a> to check the strength of your password. Clicking the check button will <a href="https://en.wikipedia.org/wiki/Hash_function" target="_blank">hash</a> your password using JavaScript and send the hash to my server to check against my hash database for leaked passwords.
</p>
<p>
<style>
.password {
width:;
}
} else if (!empty($_REQUEST['email'])) {
if (!filter_var($_REQUEST['email'], FILTER_VALIDATE_EMAIL)) {
?><h3>What was entered is not an email address.</h3><?
} else {
$entries = matchEmails($_REQUEST['email']);
$count = 0;
while ($entry = databaseFetchAssoc($entries)) {
if (!empty($entry['password'])) {
$count++;
}
}
if ($count) {
require_once('recaptchalib.php');
?>
<h3 style="color: #ff0000"><?=$count?> password(s) found for your email address.</h3>
<p><form action="<?=generateURL("?sendemail=1")?>" method="post">
<?=recaptcha_get_html($publickey, null, true)?>
<input type="hidden" name="email" value="<?=htmlspecialchars($_REQUEST['email'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?>" />
<button type="submit" class="btn btn-primary">Email password(s) to me</button>
</form></p>
<?
#password_score {
height: 5px;
}
.score_0 {
width: 1%;
background-color: #ff0000;
}
.score_1 {
width: 25%;
background-color: #ff7f00;
}
.score_2 {
width: 50%;
background-color: #ffff00;
}
.score_3 {
width: 75%;
background-color: #7f007f;
}
.score_4 {
width: 100%;
background-color: #00ff00;
}
</style>
<div class="row">
<div class="col-lg-8">
<div class="input-group">
<input class="form-control password" type="password" placeholder="Password" id="password_field" />
<span class="input-group-btn">
<input class="btn btn-default" type="button" id="password_show" value="Show">
</span>
</div>
<div id="password_score" class="score_0">&nbsp;</div>
<div id="password_stats"></div>
</div>
</div>
<div class="row">
<div class="col-lg-8">
<div class="input-group">
<input class="form-control sha1" type="text" placeholder="SHA1" id="sha1_field" name="sha1" value="<?=htmlspecialchars($_REQUEST['sha1'], ENT_COMPAT | ENT_HTML401, 'UTF-8', true)?>" />
<span class="input-group-btn">
<button class="btn btn-default" id="hash_check">Check</button>
</span>
</div>
</div>
</div>
<script type="text/javascript">
$("#password_show").click(function() {
if ($("#password_field").attr("type")=="password") {
$("#password_field").attr("type", "text");
$("#password_show").val("Hide");
} else {
?>
<h3>There were no passwords found.</h3>
<?
$("#password_field").attr("type", "password");
$("#password_show").val("Show");
}
}
}
?>
});
$("#password_field").bind("input paste", function(event){
var result = zxcvbn($(this).val());
$("#password_score").attr("class", "score_"+result.score);
$("#password_stats").html("Entropy: "+result.entropy+"<br />Estimated time for hackers to crack: "+result.crack_time_display+"<br />Estimated time for hackers to crack in seconds: "+result.crack_time);
$("#sha1_field").val(CryptoJS.SHA1($(this).val()).toString());
});
</script>
</p>
<span id="hash_loader"></span>
<script type="text/javascript">
$("#hash_check").click(function() {
$("#hash_loader").load("<?=$_MGM['installPath']?>api/hash", {sha1: $("#sha1_field").val()}, function(response, status, xhr) {
});
});
</script>
</div>
</div>
This is a service to check to see if your password was leaked via the leak <a href="http://lifehacker.com/5-million-gmail-passwords-leaked-check-yours-now-1632983265" target="_blank">http://lifehacker.com/5-million-gmail-passwords-leaked-check-yours-now-1632983265</a> and verify that it is a password you use. This server does not log anything and it is <a href="https://en.wikipedia.org/wiki/Transport_Layer_Security" target="_blank">ssl encrypted</a>. All that is required for you to check your password is your email address. There is no need to enter your password and also if you enter your password it will fail the search as it only wants an email address!<br /><br />
When you tell my server to email you your password, it will send an email via ssl gmail to your account. The email account which is used has a strong random password and has a filter to auto delete emails sent. If the password that you receive is one you use, quickly change it as hackers have it and are likely trying to get into your accounts now!<br /><br />
This server does not log anything and it is <a href="https://en.wikipedia.org/wiki/Transport_Layer_Security" target="_blank">ssl encrypted</a>. Any activity done on this page is safe from anyone including myself. If you don't trust me, download my source code and re-implement this on your own server.<br /><br />
If you would like to see the top 500 passwords in this database, visit <a href="https://gec.im/passwords.csv">https://gec.im/passwords.csv</a>.<br /><br />
If you find another leak of passwords, email me at <a href="mailto:james@coleman.io">james@coleman.io</a> and I will see if I can get data to import.<br /><br />
Recommended password database software to use includes: <a href="https://lastpass.com/" target="_blank">https://lastpass.com/</a> <a href="https://agilebits.com/onepassword" target="_blank">https://agilebits.com/onepassword</a> <a href="http://keepass.info/" target="_blank">http://keepass.info/</a><br /><br />
Source code for this site is at <a href="https://github.com/GRMrGecko/PasswordCheck" target="_blank">https://github.com/GRMrGecko/PasswordCheck</a>
Source code for this site is at <a href="https://github.com/GRMrGecko/PasswordCheck" target="_blank">https://github.com/GRMrGecko/PasswordCheck</a><br /><br />
External code used is <a href="https://code.google.com/p/crypto-js/" target="_blank">CryptoJS</a>, <a href="https://developers.google.com/recaptcha/docs/php" target="_blank">recaptchalib</a>, <a href="https://github.com/dropbox/zxcvbn" target="_blank">zxcvbn</a>, <a href="https://jquery.com/" target="_blnak">jQuery</a>, and <a href="http://getbootstrap.com/" target="_blank">Bootstrap</a>.
<?
require_once("footer.php");
closeDatabase();
?>

3
header.php

@ -22,6 +22,9 @@
<script type="text/javascript" src="<?=$_MGM['installPath']?>js/jquery.min.js"></script>
<script type="text/javascript" src="<?=$_MGM['installPath']?>js/bootstrap-3.1.1.min.js"></script>
<script type="text/javascript" src="<?=$_MGM['installPath']?>js/date.js"></script>
<script type="text/javascript" src="<?=$_MGM['installPath']?>js/sha1.js"></script>
<script type="text/javascript" src="<?=$_MGM['installPath']?>js/zxcvbn-async.js"></script>
<script type="text/javascript" src="https://www.google.com/recaptcha/api/js/recaptcha_ajax.js"></script>
</head>
<body>

17
index.php

@ -31,8 +31,8 @@ $_MGM['adminEmail'] = "support@gec.im";
$_MGM['DBType'] = "MYSQLPDO"; // MYSQL, POSTGRESQL, SQLITE.
$_MGM['DBPersistent'] = false;
$_MGM['DBHost'] = "localhost";
$_MGM['DBUser'] = "passwords";
$_MGM['DBPassword'] = "";
$_MGM['DBUser'] = "root";
$_MGM['DBPassword'] = "password";
$_MGM['DBName'] = "passwords"; // File location for SQLite.
$_MGM['DBPort'] = 0; // 3306 = MySQL Default, 5432 = PostgreSQL Default.
$_MGM['DBPrefix'] = "";
@ -81,13 +81,16 @@ function generateURL($path) {
return "http".($_MGM['ssl'] ? "s" : "")."://".$_MGM['domain'].(((!$_MGM['ssl'] && $_MGM['port']==80) || ($_MGM['ssl'] && $_MGM['port']==443)) ? "" : ":{$_MGM['port']}").$_MGM['installPath'].$path;
}
if ($_MGM['path'][0]=="api") {
require("code/api.php");
} else if ($_MGM['path'][0]=="js" && $_MGM['path'][1]=="zxcvbn-async.js") {// To set correct path for dynamic loading.
require("js/zxcvbn-async.php");
exit();
}
if ($_MGM['path'][0]!="") {
require("code/404.php");
}
connectToDatabase();
require("code/index.php");
closeDatabase();
?>

15
js/sha1.js

@ -0,0 +1,15 @@
/*
CryptoJS v3.1.2
code.google.com/p/crypto-js
(c) 2009-2013 by Jeff Mott. All rights reserved.
code.google.com/p/crypto-js/wiki/License
*/
var CryptoJS=CryptoJS||function(e,m){var p={},j=p.lib={},l=function(){},f=j.Base={extend:function(a){l.prototype=this;var c=new l;a&&c.mixIn(a);c.hasOwnProperty("init")||(c.init=function(){c.$super.init.apply(this,arguments)});c.init.prototype=c;c.$super=this;return c},create:function(){var a=this.extend();a.init.apply(a,arguments);return a},init:function(){},mixIn:function(a){for(var c in a)a.hasOwnProperty(c)&&(this[c]=a[c]);a.hasOwnProperty("toString")&&(this.toString=a.toString)},clone:function(){return this.init.prototype.extend(this)}},
n=j.WordArray=f.extend({init:function(a,c){a=this.words=a||[];this.sigBytes=c!=m?c:4*a.length},toString:function(a){return(a||h).stringify(this)},concat:function(a){var c=this.words,q=a.words,d=this.sigBytes;a=a.sigBytes;this.clamp();if(d%4)for(var b=0;b<a;b++)c[d+b>>>2]|=(q[b>>>2]>>>24-8*(b%4)&255)<<24-8*((d+b)%4);else if(65535<q.length)for(b=0;b<a;b+=4)c[d+b>>>2]=q[b>>>2];else c.push.apply(c,q);this.sigBytes+=a;return this},clamp:function(){var a=this.words,c=this.sigBytes;a[c>>>2]&=4294967295<<
32-8*(c%4);a.length=e.ceil(c/4)},clone:function(){var a=f.clone.call(this);a.words=this.words.slice(0);return a},random:function(a){for(var c=[],b=0;b<a;b+=4)c.push(4294967296*e.random()|0);return new n.init(c,a)}}),b=p.enc={},h=b.Hex={stringify:function(a){var c=a.words;a=a.sigBytes;for(var b=[],d=0;d<a;d++){var f=c[d>>>2]>>>24-8*(d%4)&255;b.push((f>>>4).toString(16));b.push((f&15).toString(16))}return b.join("")},parse:function(a){for(var c=a.length,b=[],d=0;d<c;d+=2)b[d>>>3]|=parseInt(a.substr(d,
2),16)<<24-4*(d%8);return new n.init(b,c/2)}},g=b.Latin1={stringify:function(a){var c=a.words;a=a.sigBytes;for(var b=[],d=0;d<a;d++)b.push(String.fromCharCode(c[d>>>2]>>>24-8*(d%4)&255));return b.join("")},parse:function(a){for(var c=a.length,b=[],d=0;d<c;d++)b[d>>>2]|=(a.charCodeAt(d)&255)<<24-8*(d%4);return new n.init(b,c)}},r=b.Utf8={stringify:function(a){try{return decodeURIComponent(escape(g.stringify(a)))}catch(c){throw Error("Malformed UTF-8 data");}},parse:function(a){return g.parse(unescape(encodeURIComponent(a)))}},
k=j.BufferedBlockAlgorithm=f.extend({reset:function(){this._data=new n.init;this._nDataBytes=0},_append:function(a){"string"==typeof a&&(a=r.parse(a));this._data.concat(a);this._nDataBytes+=a.sigBytes},_process:function(a){var c=this._data,b=c.words,d=c.sigBytes,f=this.blockSize,h=d/(4*f),h=a?e.ceil(h):e.max((h|0)-this._minBufferSize,0);a=h*f;d=e.min(4*a,d);if(a){for(var g=0;g<a;g+=f)this._doProcessBlock(b,g);g=b.splice(0,a);c.sigBytes-=d}return new n.init(g,d)},clone:function(){var a=f.clone.call(this);
a._data=this._data.clone();return a},_minBufferSize:0});j.Hasher=k.extend({cfg:f.extend(),init:function(a){this.cfg=this.cfg.extend(a);this.reset()},reset:function(){k.reset.call(this);this._doReset()},update:function(a){this._append(a);this._process();return this},finalize:function(a){a&&this._append(a);return this._doFinalize()},blockSize:16,_createHelper:function(a){return function(c,b){return(new a.init(b)).finalize(c)}},_createHmacHelper:function(a){return function(b,f){return(new s.HMAC.init(a,
f)).finalize(b)}}});var s=p.algo={};return p}(Math);
(function(){var e=CryptoJS,m=e.lib,p=m.WordArray,j=m.Hasher,l=[],m=e.algo.SHA1=j.extend({_doReset:function(){this._hash=new p.init([1732584193,4023233417,2562383102,271733878,3285377520])},_doProcessBlock:function(f,n){for(var b=this._hash.words,h=b[0],g=b[1],e=b[2],k=b[3],j=b[4],a=0;80>a;a++){if(16>a)l[a]=f[n+a]|0;else{var c=l[a-3]^l[a-8]^l[a-14]^l[a-16];l[a]=c<<1|c>>>31}c=(h<<5|h>>>27)+j+l[a];c=20>a?c+((g&e|~g&k)+1518500249):40>a?c+((g^e^k)+1859775393):60>a?c+((g&e|g&k|e&k)-1894007588):c+((g^e^
k)-899497514);j=k;k=e;e=g<<30|g>>>2;g=h;h=c}b[0]=b[0]+h|0;b[1]=b[1]+g|0;b[2]=b[2]+e|0;b[3]=b[3]+k|0;b[4]=b[4]+j|0},_doFinalize:function(){var f=this._data,e=f.words,b=8*this._nDataBytes,h=8*f.sigBytes;e[h>>>5]|=128<<24-h%32;e[(h+64>>>9<<4)+14]=Math.floor(b/4294967296);e[(h+64>>>9<<4)+15]=b;f.sigBytes=4*e.length;this._process();return this._hash},clone:function(){var e=j.clone.call(this);e._hash=this._hash.clone();return e}});e.SHA1=j._createHelper(m);e.HmacSHA1=j._createHmacHelper(m)})();

4
js/zxcvbn-async.php

@ -0,0 +1,4 @@
<?
header("Content-Type: application/x-javascript");
?>
(function(){var a;a=function(){var a,b;b=document.createElement("script");b.src="<?=$_MGM['installPath']?>js/zxcvbn.js";b.type="text/javascript";b.async=!0;a=document.getElementsByTagName("script")[0];return a.parentNode.insertBefore(b,a)};null!=window.attachEvent?window.attachEvent("onload",a):window.addEventListener("load",a,!1)}).call(this);

43
js/zxcvbn.js
File diff suppressed because it is too large
View File

10
dumpPasswords.pl → perl/dumpPasswords.pl

@ -31,6 +31,10 @@ sub trim($) {
my $string = shift;
$string =~ s/^\s+//;
$string =~ s/\s+$//;
$string =~ s/^\t+//;
$string =~ s/\t+$//;
$string =~ s/\n//g;
$string =~ s/\r//g;
return $string;
}
sub clean($) {
@ -42,9 +46,9 @@ sub clean($) {
}
$dbHost = "127.0.0.1";
$dbName = "test";
$dbName = "passwords";
$dbUser = "root";
$dbPassword = "";
$dbPassword = "password";
#print localtime(time).": Connecting to DataBase\n";
@ -52,7 +56,7 @@ $dbConnection = DBI->connect("DBI:mysql:$dbName;host=$dbHost", $dbUser, $dbPassw
open(passwords, ">/Users/grmrgecko/Desktop/passwords.csv");
my $result = $dbConnection->prepare("SELECT `password`,COUNT(`email`) AS `count` FROM users GROUP BY `password` ORDER BY `count` DESC LIMIT 500;");
my $result = $dbConnection->prepare("SELECT `id`,`password` FROM emailplaintext LIMIT 2;");
$result->execute();
while (@data = $result->fetchrow_array()) {
my $i = 0;

79
perl/hashPasswords.pl

@ -0,0 +1,79 @@
#!/usr/bin/env perl
#
# Copyright (c) 2014 Mr. Gecko's Media (James Coleman). http:#mrgeckosmedia.com/
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
# THE SOFTWARE.
#
use Digest::SHA1 qw(sha1 sha1_hex);
#DBD::mysql
use DBI;
use POSIX;
use DateTime;
sub trim($) {
my $string = shift;
$string =~ s/^\s+//;
$string =~ s/\s+$//;
$string =~ s/^\t+//;
$string =~ s/\t+$//;
$string =~ s/^\s+//;
$string =~ s/\s+$//;
$string =~ s/^\t+//;
$string =~ s/\t+$//;
$string =~ s/\n//g;
$string =~ s/\r//g;
return $string;
}
$dbHost = "127.0.0.1";
$dbName = "passwords";
$dbUser = "root";
$dbPassword = "password";
$file = "/Users/grmrgecko/Desktop/passwords.csv";
#print localtime(time).": Connecting to DataBase\n";
$dbConnection = DBI->connect("DBI:mysql:$dbName;host=$dbHost", $dbUser, $dbPassword) || die "Could not connect to database: $DBI::errstr";
open(passwords, $file);
my $i=0;
while (<passwords>) {
chomp;
$i++;
my $sha1 = sha1_hex(trim($_));
print $i.": ".$sha1."\n";
my $result = $dbConnection->prepare("SELECT * FROM `sha1` WHERE `hash`=?");
$result->execute($sha1);
my $exists = $result->fetchrow_hashref();
if ($exists!=undef) {
$result->finish();
next;
}
$result->finish();
my $result = $dbConnection->prepare("INSERT INTO `sha1` (`hash`,`leak`) VALUES (?,'Email Database')");
$result->execute($sha1);
$result->finish();
}
close(passwords);
$dbConnection->disconnect();

32
loadPasswords.pl → perl/loadPasswords.pl

@ -31,15 +31,23 @@ sub trim($) {
my $string = shift;
$string =~ s/^\s+//;
$string =~ s/\s+$//;
$string =~ s/^\t+//;
$string =~ s/\t+$//;
$string =~ s/^\s+//;
$string =~ s/\s+$//;
$string =~ s/^\t+//;
$string =~ s/\t+$//;
$string =~ s/\n//g;
$string =~ s/\r//g;
return $string;
}
$dbHost = "127.0.0.1";
$dbName = "test";
$dbName = "passwords";
$dbUser = "root";
$dbPassword = "";
$dbPassword = "password";
$file = "/Users/grmrgecko/Desktop/passwords/Gmail.txt";
$file = "/Users/grmrgecko/Desktop/passwords/Yahoo.txt";
#print localtime(time).": Connecting to DataBase\n";
@ -50,21 +58,23 @@ my $i=0;
while (<passwords>) {
chomp;
my $entry = $_;
if ($entry =~ m/([^:]+):(.*)$/) {
if ($entry =~ m/[0-9]+:([^:]+):(.*)$/) {
$i++;
my $email = $1;
my $password = $2;
$password =~ s/\n//g;
$password =~ s/\r//g;
my $email = trim($1);
my $password = trim($2);
if ($password eq "") {
next;
}
print "$i Email: $email Password: $password\n";
my $result = $dbConnection->prepare("SELECT * FROM users WHERE `email`=? AND `password`=?");
my $result = $dbConnection->prepare("SELECT * FROM `emailplaintext` WHERE `email`=? AND `password`=?");
$result->execute($email, $password);
$exists = $result->fetchrow_hashref();
my $exists = $result->fetchrow_hashref();
if ($exists!=undef) {
$result->finish();
next;
}
$result->finish();
my $result = $dbConnection->prepare("INSERT INTO `users` (`email`,`password`) VALUES (?,?)");
my $result = $dbConnection->prepare("INSERT INTO `emailplaintext` (`email`,`password`) VALUES (?,?)");
$result->execute($email, $password);
$result->finish();
}

77
perl/loadSHA1.pl

@ -0,0 +1,77 @@
#!/usr/bin/env perl
#
# Copyright (c) 2014 Mr. Gecko's Media (James Coleman). http:#mrgeckosmedia.com/
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
# THE SOFTWARE.
#
#DBD::mysql
use DBI;
use POSIX;
use DateTime;
sub trim($) {
my $string = shift;
$string =~ s/^\s+//;
$string =~ s/\s+$//;
$string =~ s/^\t+//;
$string =~ s/\t+$//;
$string =~ s/^\s+//;
$string =~ s/\s+$//;
$string =~ s/^\t+//;
$string =~ s/\t+$//;
$string =~ s/\n//g;
$string =~ s/\r//g;
return $string;
}
$dbHost = "127.0.0.1";
$dbName = "passwords";
$dbUser = "root";
$dbPassword = "password";
$file = "/Users/grmrgecko/Desktop/passwords/SHA1.txt";
#print localtime(time).": Connecting to DataBase\n";
$dbConnection = DBI->connect("DBI:mysql:$dbName;host=$dbHost", $dbUser, $dbPassword) || die "Could not connect to database: $DBI::errstr";
open(passwords, $file);
my $i=0;
while (<passwords>) {
chomp;
$i++;
my $sha1 = trim($_);
print $i.": ".$sha1."\n";
my $result = $dbConnection->prepare("SELECT * FROM `sha1` WHERE `hash`=?");
$result->execute($sha1);
my $exists = $result->fetchrow_hashref();
if ($exists!=undef) {
$result->finish();
next;
}
$result->finish();
my $result = $dbConnection->prepare("INSERT INTO `sha1` (`hash`,`leak`) VALUES (?,'LinkedIn')");
$result->execute($sha1);
$result->finish();
}
close(passwords);
$dbConnection->disconnect();
Loading…
Cancel
Save