11-04-2017, 08:25 AM
Rats, I was hoping to leverage my GPU to make this easier, haha! Understandable as this case is fairly specific.
The situation often occurs in web development. Specifically - protecting a set of variables which are present as plain-text in the URL field of the browser.
Example URL:
https://mysite.com/purchase/?item=25&price=50.00&hashvalue=56722d7e851770c6661770c8a64a88ee6b864a8f
Normally a user would be able to manipulate the URL variables, but the addition of a hashvalue which is calculated by taking the URL variables and appending a secret-key (which is then SHA1 encrypted) prevents a user from tampering with them. The server-side script runs the same operation to compare if the hashvalue(s) match. If they don't - it means that a variable was changed in the URL so an error message is thrown.
In the above example I used the secret-key: mySecret
So hashvalue = encrypt_with_SHA1(?item=25&price=50.00mySecret)
> 56722d7e851770c6661770c8a64a88ee6b864a8f
As always, the secret-key (mySecret) is unknown to us, that's what I'm trying to find.
I have successfully tested this with a variable string < 256 chars.
The situation often occurs in web development. Specifically - protecting a set of variables which are present as plain-text in the URL field of the browser.
Example URL:
https://mysite.com/purchase/?item=25&price=50.00&hashvalue=56722d7e851770c6661770c8a64a88ee6b864a8f
Normally a user would be able to manipulate the URL variables, but the addition of a hashvalue which is calculated by taking the URL variables and appending a secret-key (which is then SHA1 encrypted) prevents a user from tampering with them. The server-side script runs the same operation to compare if the hashvalue(s) match. If they don't - it means that a variable was changed in the URL so an error message is thrown.
In the above example I used the secret-key: mySecret
So hashvalue = encrypt_with_SHA1(?item=25&price=50.00mySecret)
> 56722d7e851770c6661770c8a64a88ee6b864a8f
As always, the secret-key (mySecret) is unknown to us, that's what I'm trying to find.
I have successfully tested this with a variable string < 256 chars.