dynamic's valid is too permissive
Open
@AlekseyCherepanov is already working on this.
Since Jan 30, 2022.
bug
- Dominant language
- C
- Stars
- 13.6k
- Forks
- 2.6k
- PR merge metrics
- No merged PRs in 30d
Description
Working on #5031 for PHPS that relies on pDynamic_6->methods.valid, I found that dynamic's valid is quite permissive.
It does not reject garbage after $HEX$:
$dynamic_6$612f95cf86c4e196f6b627bab3f01b62$HEX$$$$$$$
Is it ok?
I tried to make samples expecting that salt is HEX$$$$$$$ or salt is empty. I could not crack them.
It affects PHPS format allowing it to load such hashes while it should not (its salt is 3 chars exactly).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.