Scanning the Dump

in #ruby6 years ago (edited)

So I was minding my own business reading my feed and I noticed that @matt-a posted:

PSA: NEW HUGE PASSWORD DUMP. Are You One Of The 501,636,842 Earth Dwellers That Have Been Pwn3d?! You Might Want To Find Out. READ ME.

Now I have to write a ruby script to comb this 29 GB file of hashes. But I have a lot of things to check. I got one of the files over torrent, and extracted it (pwned-passwords-2.0.txt).

Here's what I'm using to check it:

Gemfile

source 'https://rubygems.org'
gem 'highline'

check.rb

require 'rubygems'
require 'bundler/setup'
require 'digest'

Bundler.require

filename = 'pwned-passwords-2.0.txt'
cli = HighLine.new
answers = []

loop do
  answer = cli.ask 'What do you want to check?  Empty line to start check.' do |q|
    q.echo = '*'
  end

  break if answer == ''
  answers << answer
end

shas = answers.map do |answer|
  Digest::SHA1.hexdigest(answer).upcase
end

File.open(filename, 'r') do |f|
  f.each_line do |line|
    exit if shas.empty?

    if line =~ /(#{shas.join('|')})/
      puts line
      sha = line.split(':').first
      shas.delete(sha)
    end
  end
end

Enjoy.

Sort:  

Thank you for this article. I'll be using this to send to people asking me the exact same questions.

Learn some new from your post. Love to read it.

OMG....
that's way, you have need long time for the ready of ruby script.
its a great work....
thanks for the share

Hey @inertia, great post! I enjoyed your content. Keep up the good work! It's always nice to see good content here on Steemit! Cheers :)

Good post my friend
You have provided information to me and other steemit friends thank you @inertia

Is this passwords from Bitcoin or just anywhere?

Love the look of Ruby by the way, the syntax is very clean. Do you work with it a lot?

Cg

This is so advanced for me... are we being hacked?
Because am so worried. Those scripts are not in human language

77.png

Help me @inertia for setting up of drotto
getting this error after run rake
are you on discord?
Thank you

I recommend rvm to manage ruby if the system version is giving you trouble:

https://rvm.io/

Ok thank you i will do the same

Hum Very interesting Coding ! Some this is really gone be awesome Hehe

@inertia
Do you have any article on how to do with rvm to manage ruby?
I am new to this so just need help
Thank you...

If you refuse to read the documentation on https://rvm.io/, you can usually just get up and running by blindly entering these commands into your terminal:

$ gpg --keyserver hkp://keys.gnupg.net --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3
$ curl -sSL https://get.rvm.io | bash -s stable
$ source ~/.rvm/scripts/rvm
$ rvm install ruby-head
$ rvm use ruby-head --create
$ gem install bundler

This also not worked for me...

well its amazing nd new

so you are going to consume your lot of time

I like you,,, nice to meet you

I am going to look into it also ..

Cool! Do you plan on attacking this with a SHA-1 dictionary?

Na, I just wanted a way to dump passwords into it without having to worry about them showing up on the screen. I also wanted to check efficiently, so it does a regex on all of the passwords at once. It's almost exactly the same as doing it with grep, except the passwords don't get saved to .bash_history.

What was this all about? I don't understand anything.

1.jpg

Says the Queen, not the princess. I just thought it was funny that you felt the need to inform me that you don't understand anything.

I was merely asking what was this all about. Maybe, just maybe, you could answer a newbie because you're the author. But if you don't feel like answering, so be it. No hard feelings anyway.

What did you figure out when you clicked on the link in the original article?