1

There is a website that gives you a token and the unixtime to access a resource on another domain.

I can use those 2 values to access it like that:

Example: example.com/test.txt?st=[HASH]&e=[UNIXTIME]

I build a small script that generates those values and displays them in the format

[UNIXTIME] : [HASH]

http://46.101.150.244/m/serve.php (You can refresh to see new combinations.)

Observations:

  1. When I request a token and get "st" and "e" by using my remote server, I can't access the resource. -> it is bound to a specific IP, no other parameters.

  2. Also when generating 2 tokens at the same unix time from different ips, they are different -> confirmation of 1.

  3. When generating a token multiple times within a second from the same IP, the token is always the same until the unix second passes. -> Pretty sure the only dynamic factors are the IP and the time.

  4. When looking at the last character of the hash, it is always either A, Q, g or w. Their hexvalues are (same order) 41, 51, 67, 77. A,Q and g,w are exactly 0x10 apart.

  5. I assume it is base64, but it has - and _ instead of + and /. Do you think thats possible? It also has 22 characters.

I tried many different things, trying to decode base64 (often padding error), trying substrings to maybe find something useful, the IP in binary representation for example, but since the whole string completely changes every time the unix time changes, I really dont know if there is anything I can do.

Its totally possible that it is salted and I have zero chances of finding a solution, however the fact that the last letter is always one of four possibilities gave me hope.

I had a lot of fun approaching this challenge, if someone could give a hint how to approach this situation, what I should try out etc, that would be great!

  • Don't get your hopes up too much. If, for example, you do a base85 conversion, you'll typically have a few bits over at the end of your message; in your case, that's probably 2 bit, yielding 4 possibilities. If i were you, i'd write down the results from about 10 seconds of generating hashes with the same ip, in binary. If very few bits change, and most don't you can start working on that. If approx. 50% of the bits change, the web site is likely to use some salt + IP + time, and you're doomed. – Guntram Blohm Mar 7 '16 at 19:24
  • Sounds logical, I tried the following: pastebin.com/wnV8Vas8 Do you think the values have any meaning? – Alisamix Mar 7 '16 at 19:45
  • If they are not entirely silly, they'd throw in some sort of crypto somewhere in the process. – Vitaly Osipov Mar 7 '16 at 22:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.