Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Save RaminMammadzada/7b24707d692ce628ec886e60e4afba3b to your computer and use it in GitHub Desktop.
Save RaminMammadzada/7b24707d692ce628ec886e60e4afba3b to your computer and use it in GitHub Desktop.
Timing Attack for 4 digits password
"""
The function check_password(password) is used by a safe with 4-digits passwords, and is
susceptible to timing attacks. More specifically, it takes it around 0.1 seconds to check
one digit – so brute-forcing all the possible combinations will take around 1,500 hours.
Can you implement a way to crack its password in less than a minute?
"""
import time
import sys # ignore
sys.path.insert(0,'.') # ignore
from pswd import real_password
def check_password(password): # Don't change it
if len(password) != len(real_password):
return False
for x, y in zip(password, real_password):
time.sleep(0.1) # Simulates the wait time of the safe's mechanism
if int(x) != int(y):
return False
return True
def crack_password():
password = ""
inp = ""
# loop for every element in the password, in this case there are 4 elements in the password
# before running this cracking code, we need to find how many elements does the password composed of
for turn in range(4):
print("- - -" + str(turn) + "- - -" )
# loop for finding the correct char
for char in "0123456789":
inp = password + char
inp += "0"*(4-len(inp))
print(inp)
t1 = int(round(time.time() * 1000))
if (not check_password(inp)):
# this will work for every char for each turn of the password untill the last turn of the loop inside the check_password() function
t2 = int(round(time.time() * 1000))
elapsedTime = round((t2 - t1)/100) * 100 # in order to get round milliseconds elapsed
if( elapsedTime > 100*(turn+1) ):
print(str(turn+1) + " th digit: " + char + ">>>" +str(elapsedTime))
password += char
break
else:
# This else work when the last correct char is found. Therefore, last char will be added here and break the for loop
password += char
print("All password: " + password)
break
inp = ""
return password
# this function is not used, I used times (*) functionaly istead of this, for example: "0"*(4-len(inp))
def printCustomNumberOfChar(char, count):
var = ""
for e in range(count):
var += char
return var
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment