Categories: Kali Linux

Token Reverser : Word List Generator To Crack Security Tokens

Token Reverser is a word list generator to crack security tokens.

Example Use Case

  • You are testing reset password function
  • Reset password token was sent to your email box (e.g. 582431d4c7b57cb4a3570041ffeb7e10)
  • You suppose, it is a md5 hash of the data you provided during registration process
  • You remember that on registration you entered the following data:
    • First name: Foo
    • Last name: Bar
    • Email: foo.bar@example.com
    • Birth date: 1985-05-23
    • Phone: 202-555-0185
    • Address: 3634 Forest Drive
  • In addition, you have an access to the following extra data:
    • Application user ID: 74824
    • Date of the reset password HTTP request (“Date” response header): Tue, 10 Mar 2020 17:12:59 GMT
  • You use Token Reverser to generate word list from the known data:

./token-reverser.py –date “Tue, 10 Mar 2020 17:12:59 GMT” Foo Bar foo.bar@example.com 1985-05-23 202-555-0185 “3634 Forest Drive” 74824 > words

  • You use hashcat to crack reset password token:

hashcat64.exe -m 0 582431d4c7b57cb4a3570041ffeb7e10 words
hashcat (v5.1.0) starting…
[…]
582431d4c7b57cb4a3570041ffeb7e10:74824!Foo!Bar!foo.bar@example.com!1583860379
Session……….: hashcat
Status………..: Cracked
Hash.Type……..: MD5
Hash.Target……: 582431d4c7b57cb4a3570041ffeb7e10
[…]

  • Now you know that reset password tokens are generated as follow:

md5(user ID!first name!last name!email!current timestamp)

Also Read – Pickl3 : Windows Active User Credential Phishing Tool

Usage

usage: token-reverser.py [-h] [-d DATE] [-o TIMESTAMP_OFFSET] [-s SEPARATORS]
data [data …]

Word list generator to crack security tokens v1.1

Positional arguments:
data data chunks

Optional arguments:
-h, –help show this help message and exit
-d DATE, –date DATE timestamp from this date will be used as an additional data chunk, example: Tue, 10 Mar 2020 14:06:36 GMT
-o TIMESTAMP_OFFSET, –timestamp-offset TIMESTAMP_OFFSET
how many previous (to timestamp from date) timestamps
should be used as an additional data chunk, default: 1
-s SEPARATORS, –separators SEPARATORS data chunks separators to check, default: ~`!@#$%^&*()_+-={}|[]\:”;'<>?,./ \t

R K

Recent Posts

Shadow-rs : Harnessing Rust’s Power For Kernel-Level Security Research

shadow-rs is a Windows kernel rootkit written in Rust, demonstrating advanced techniques for kernel manipulation…

1 week ago

ExecutePeFromPngViaLNK – Advanced Execution Of Embedded PE Files via PNG And LNK

Extract and execute a PE embedded within a PNG file using an LNK file. The…

2 weeks ago

Red Team Certification – A Comprehensive Guide To Advancing In Cybersecurity Operations

Embark on the journey of becoming a certified Red Team professional with our definitive guide.…

2 weeks ago

CVE-2024-5836 / CVE-2024-6778 : Chromium Sandbox Escape via Extension Exploits

This repository contains proof of concept exploits for CVE-2024-5836 and CVE-2024-6778, which are vulnerabilities within…

3 weeks ago

Rust BOFs – Unlocking New Potentials In Cobalt Strike

This took me like 4 days (+2 days for an update), but I got it…

3 weeks ago

MaLDAPtive – Pioneering LDAP SearchFilter Parsing And Security Framework

MaLDAPtive is a framework for LDAP SearchFilter parsing, obfuscation, deobfuscation and detection. Its foundation is…

3 weeks ago