admin/SecLists
1
0
Fork 0
mirror of https://github.com/danielmiessler/SecLists.git synced 2025-06-08 14:07:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #12 from spaze/patch-2

Browse Source 
Update README.md
This commit is contained in:
Mo Langning 2024-02-17 02:45:44 +08:00 committed by GitHub
commit f534524cdb
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
Passwords/php-hashes/README.md
View File

@ -1,6 +1,6 @@
# PHP magic hashes
PHP has some unique features which makes hash collisions more easier when using the `==` to compare.
PHP has some unique features which makes hash "collisions" more easier when using the `==` to compare.
The raw text are taken directly from [spaze/hashes](https://github.com/spaze/hashes/)
@ -10,9 +10,9 @@ The raw text are taken directly from [spaze/hashes](https://github.com/spaze/has
Any strings that starts with any numbers of `0`, followed by `e` then ends with only numbers will be treated as zero. An example of such strings are `0e123456` and `00e123456`. [Example code](https://3v4l.org/n8iOp)
This behavior can be extended to numbers, like `'0' == '000`. [Example code](https://3v4l.org/K9QRb)
This behavior can be extended to numbers, like `'0' == '000'`. [Example code](https://3v4l.org/K9QRb)
With loose comparison, these two example strings will equate to each other as both of them are treated as a zero in the backend.
With loose comparison `==`, these two example strings will equate to each other as both of them are treated as a zero in the backend.
Sometimes, hashes of specific strings will result in those special strings as an result. Those hashes are called `magic hashes`
@ -40,8 +40,10 @@ Descrypt have similar behavior to bcrypt, but passwords are instead truncated to
<!--- Modified from https://github.com/spaze/hashes?tab%253Dreadme-ov-file#pbkdf2-hmac-sha1-pbkdf2-hmac-sha224-pbkdf2-hmac-sha256-->
These are a different kind of magic hashes, they don't need the loose comparison operator `==` and work even with strict comparison `===`.
If you use a password longer than 64 bytes and hash it with PBKDF2-HMAC-SHA1, it is first pre-hashed with SHA1.
For example, `PBKDF2-HMAC-SHA1(password1) === PBKDF2-HMAC-SHA1(password2)` as `sha1(password1) === bin2hex(password2)`.
This behavior can also be seen in `PBKDF2-HMAC-SHA224` and `PBKDF2-HMAC-SHA256`.
This behavior can also be seen in `PBKDF2-HMAC-SHA224` and `PBKDF2-HMAC-SHA256`.