Skip to content

Instantly share code, notes, and snippets.

@B-Con
Last active December 18, 2015 07:29
Show Gist options
  • Save B-Con/5746775 to your computer and use it in GitHub Desktop.
Save B-Con/5746775 to your computer and use it in GitHub Desktop.
crypt() examples used in my article on PHP's faulty implementation of crypt().
#include <stdio.h>
#include <string.h>
#include <crypt.h>
void printCryptResult(char *szSalt)
{
if (szSalt != NULL)
puts(szSalt);
else
puts("(NULL)");
}
int main()
{
char *szSalts[3] = {"$6$1234567890123456789012345678901234567890123", // Good salt
"$6", // $ is illegal
"4 "}; // Space is illegal
char *szCryptResult = NULL;
struct crypt_data data;
puts("<code>crypt</code> - C");
for (int idx = 0; idx < 3; idx++) {
memset(&data, 0, sizeof(data));
szCryptResult = crypt_r("a", szSalts[idx], &data);
printf("crypt(\"a\", \"%s\") = ", szSalts[idx]);
printCryptResult(szCryptResult);
}
return 0;
}
<?php
$salts = array('$6$1234567890123456789012345678901234567890123', // Correct salt format
'$61234567890123456789012345678901234567890123', // Forgot the 2nd $
'$61$234567890123456789012345678901234567890123', // $ and 1 transposed
' $6$1234567890123456789012345678901234567890123', // Leading space
'$$1234567890123456789012345678901234567890123', // Omitted the hash ID
'❤☀☆☂☻♞☯'); // Just random unicode
echo "crypt - PHP (v" . phpversion() . ")<br />";
foreach ($salts as $theSalt) {
$cryptResult = crypt("a", $theSalt);
echo 'crypt("a", "' . $theSalt . '") = ';
var_dump($cryptResult);
echo "<br />";
}
?>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment