Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- <?
- /* So I wrote a password entropy guessing algorithm today.
- * It looks for common patterns and weaknesses in the keyspace of the password (repeat characters, repeats
- * of the same character type, etc.) by analyzing different chunks of the password.
- *
- * This is probably not the most efficient way to do this...
- */
- function getEntropy($p) {
- # Estimates the average entropy per segment of the password :)
- $l = strlen($p);
- $estimates = array();
- for($i = 0; $i <= $l/2; $i++) {
- $chnk = str_split($p, $i+1);
- $estimates[$i] = 0;
- $prevchunk = '';
- foreach($chnk as $c) {
- # Look for really weak patterns in different segments of the string!
- if($prevchunk == $c) continue;
- if(preg_match("/(.)\\1{".($i-1)."}/", $c, $m)) {
- # No entropy gain for repeated characters.
- if(preg_match('/^[0-9]+$/', $m[1])) {
- $estimates[$i] += 3.3219281;
- } elseif(preg_match('/^[0-9]$/', $m[1])) {
- $estimates[$i] += 3.3219281;
- } elseif(preg_match('/^[a-z]$/', $m[1]) || preg_match('/^[A-Z]$/', $m[1])) {
- $estimates[$i] += 4.7004397;
- } elseif(preg_match('/^[^a-zA-Z0-9]$/', $m[1])) {
- $estimates[$i] += 5.4262648;
- } else {
- # Best case
- $estimates[$i] += 6.5698556;
- }
- } elseif(preg_match('/^[0-9]+$/', $c)) {
- $estimates[$i] += ($i+1)*3.3219281;
- } elseif(preg_match('/^[a-z]+$/', $c) || preg_match('/^[A-Z]+$/', $c)) {
- $estimates[$i] += ($i+1)*4.7004397;
- } elseif(preg_match('/^[A-Za-z]+$/', $c)) {
- $estimates[$i] += ($i+1)*5.7004397;
- } elseif(preg_match('/^[^a-zA-Z0-9]+$/', $c)) {
- $estimates[$i] += ($i+1)*5.4262648;
- } elseif(preg_match('/^([A-Z]+)([a-z]+)([0-9]*)$/', $c, $m)) {
- $estimates[$i] += strlen($m[1])*4.7004397;
- $estimates[$i] += strlen($m[2])*4.7004397;
- $estimates[$i] += strlen($m[3])*3.3219281;
- } else {
- # Best case
- $estimates[$i] += ($i+1)*6.5698556;
- }
- $prevchunk = $c;
- }
- if($estimates[$i] == 0) unset($estimates[$i]);
- }
- if(empty($estimates)) return 0;
- return min($estimates); // Yes!
- }
- ?>
- <h1>Entropy Estimate</h1>
- <form>Enter Password:<input type="text" style="width: 1000px;" name="password" value="<?=empty($_GET['password'])?'':stripXSS($_GET['password']); ?>" /> <input type="submit" value="Go" /></form>
- <hr />
- <?
- if(!empty($_GET['password'])) {
- $p = $_GET['password'];
- $l = strlen($p);
- if($l < 4) {
- echo "Password too short!";
- exit;
- }
- $E = getEntropy($p);
- echo "Maximum entropy: ".number_format($E, 2)." bits of entropy.<br />\n";
- $N = bcpow('2', $E);
- echo "There are approximately ".number_format($N)." passwords in this keyspace.<br />\n";
- echo "At 900 Quadrillion passwords per second, it would take approximately ";
- $T = bcdiv($N, '900000000000000000');
- if($T < 60) {
- echo $T." seconds";
- } elseif($T < 3600) {
- echo bcdiv($T, 60)." minutes, ".bcmod($T, 60)." seconds";
- } elseif($T < 86400) {
- echo bcdiv($T, 3600)." hours, ".floor(bcdiv(bcmod($T, 3600), 60))." minutes, ".bcmod($T, 60)." seconds";
- } elseif($T < 31556736) {
- echo bcdiv(bcmod($T, 86400), 3600)." hours, ".bcdiv(bcmod($T, 3600), 60)." minutes, ".floor(bcmod($T, 60))." seconds";
- } else {
- echo number_format(bcdiv($T, 31556736))." years, ".floor(bcdiv(bcmod($T, 31556736), 86400))." days, ".floor(bcdiv(bcmod($T, 86400), 3600)." hours, ".bcdiv(bcmod($T, 3600), 60))." minutes, ".floor(bcmod($T, 60))." seconds";
- }
- echo " to guess your password.";
- }
- ?>
Advertisement
Add Comment
Please, Sign In to add comment