Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New Task: Added Hashcat Command Validation #672

Open
wants to merge 7 commits into
base: master
Choose a base branch
from

Conversation

shivanraptor
Copy link

When creating a new task, the hashcat command is parsed and validated by Optparse.js and Optparse Hashtopolis plugin.

The task name is marked as required as well, and the total length of the command is checked (now limited to 200) to avoid database field truncation.

When creating new task, the hashcat command is parsed and validated by Optparse.js and Optparse Hashtopolis plugin. Task name is marked as required as well.
Added support of Combinator Attack validation
@shivanraptor
Copy link
Author

Added Optparse Hashtopolis Plugin version to 0.2 to add support of Combinator attack command validation.

@shivanraptor
Copy link
Author

Modified the display of "Estimated time" to display a number of years if days are over 365 days.

Also updated Hashtopolis plugin version to v1.1.1
@s3inlc
Copy link
Member

s3inlc commented Dec 19, 2020

Thanks for the contribution!
There are a few points on these changes.

  • First, it should distinguish if a user selected hashcat or another cracker program and only be active if hashcat was selected.
  • Ideally, as there are so many things possible with hashcat and it's maybe not always possible to keep up-to-date with all hashcat options, it would be good to have this feature as option in the server config (If you are not sure about this, I can do that after the merge, just let me know how I best should deactivate the functionality).
  • Hashcat now has a new attack mode (-a 9), any plans of having it in the validation as well?
  • And last but not least, remote files are a no-go. There are users not having their machines connected to the internet and also dynamically loading code from a third-party source would be suspect to quite some users. These files should be included locally.

Please let me know if there is anything not clear or if you are not sure how you should change some parts, I will try to help with that, or implement it afterwards.

@shivanraptor
Copy link
Author

Agree with your points and concerns.

  1. Yes, the changes will detect whether hashcat cracker is being used or not. If hashcat is not used, the validation should not be implemented.
  2. Yes, it could be implemented as an option as server config.
  3. I am looking into hashcat v6.1.1, and I only see the following attack modes: 0, 1, 3, 6, 7
  4. The validation JS files can be bundled or marked as an optional dependency of your next release.

I will try to work on the first 2 points. Hope I can help you to improve Hashtopolis.

@s3inlc
Copy link
Member

s3inlc commented Dec 22, 2020

Thanks for looking into it.

Regarding the new attack mode. As far as I remember correctly, in 6.1.1 release this was not implemented, it was added since and is available on the master branch on the repository.

@SherlockNL
Copy link
Contributor

Correct me if I am wrong, but it seems the parser does not correctly parse attack commands that have multiple consecutive spaces in it. Hashcat does accept such commands.
This is simply fixed by applying replace(/\s+/g, ' ')

SherlockNL added a commit to SherlockNL/hashtopolis that referenced this pull request Mar 16, 2021
Show estimated total runtime of a supertask, allowing the user to interactively size a supertask by adding or removing subtasks
* Allow adding and removing subtasks to supertask
* Parse hashcat command to compute runtime per subtask. Gratefully uses the code submitted by shivanraptor in hashtopolis#672
* Save line count of dictionary files and rule files in database
* Compute runtime per subtask of supertask, depending on benchmark values entered by the user
* Works for -a0 and -a3 hashcat attacks. Adds 'Unknown' to runtime estimate when not every subtask runtime could be estimated
* Feature includes custom charsets for masks in -a3 attacks
if($days > 365.25) { // taken leap year into consideration
$years = floor($days / 365.25);
$days = $days % 365.25;
$return = number_format($years) . "y " . $days . "d ";
Copy link
Contributor

@0xVavaldi 0xVavaldi Apr 6, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would this not yield the same results?

if ($seconds >= 86400*365.25) {
    return .= gmdate("Y", $seconds)."y ";
}
if ($seconds >= 86400) {
    return .= gmdate("d", $seconds)."d ";
}
return $return.gmdate("H:i:s", $seconds);

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are typos. In both lines within the if clause, the return should be $return instead. No offence, but your suggested code works exactly the same as my code, isn't it?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A lot less math is involved and it's in line with other code, using the same functions

@@ -382,4 +383,37 @@ <h2>New task</h2>
</div>
</div>
</form>
<script src="https://cdn.jsdelivr.net/gh/shivanraptor/optparse-js@1.1.1/lib/optparse.js"></script>
<script src="https://cdn.jsdelivr.net/gh/shivanraptor/optparse-js@1.1.1/lib/optparse.hashtopolis.js"></script>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

external library might need to be made internal?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right, the author said so too. I'm going to update the pull request.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added the changes at commit 5e4b955

Fixed also some HTML minor problems
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants