Hesham/pwned-search
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

pwned.sh : add padding option. (#40)

Browse Source
This commit is contained in:
Jonathan Cross 2020-06-22 13:03:26 +02:00 committed by GitHub
parent 3777e4d9bd
commit 96cd7dbac8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 24 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
pwned.sh
View File

@ -5,29 +5,46 @@
# instrument. # instrument.
# DISCLAIMER: THE WORKS ARE WITHOUT WARRANTY. # DISCLAIMER: THE WORKS ARE WITHOUT WARRANTY.
# usage examples: # Use the -p flag to 'pad' the results making it harder for attackers to
# ./pwned.sh [pw1] [pw2] ... # determine your hash prefix by looking at https traffic.
# ./pwned.sh < <file_with_passwords> # See https://www.troyhunt.com/enhancing-pwned-passwords-privacy-with-padding/
# echo pw | ./pwned.sh
# Usage:
# ./pwned.sh [-p] [pw1] [pw2] ...
# ./pwned.sh [-p] < <file_with_passwords>
# echo pw | ./pwned.sh [-p]
# Examples:
# ./pwned.sh # You will be prompted for passwords to check.
# ./pwned.sh -p passw0rd123456
# ./pwned.sh < file_with_passwords.txt
# echo passw0rd123456 | ./pwned.sh
# echo -e "passw0rd123456\nfoob@r" | ./pwned.sh -p
PWNAPI="https://api.pwnedpasswords.com/range" PWNAPI="https://api.pwnedpasswords.com/range"
lookup_pwned_api() { lookup_pwned_api() {
local pass="$1" local pass="$1"
local pwhash=$(printf "%s" "$pass" | sha1sum | cut -d" " -f1) local pwhash=$(printf "%s" "$pass" | sha1sum | cut -d" " -f1)
local curlrv=$(curl -s "$PWNAPI/${pwhash:0:5}") local curlrv=$(curl ${PADDING_HEAD} -s "$PWNAPI/${pwhash:0:5}")
[ -z "$curlrv" ] && echo "$pass could not be checked" && return [ -z "$curlrv" ] && echo "$pass could not be checked" && return
local result=$(echo "$curlrv" | grep -i "${pwhash:5:35}") local result=$(echo "$curlrv" | grep -i "${pwhash:5:35}")
if [ -n "$result" ]; then if [ -n "$result" ]; then
local occ=$(printf "%s" "${result}" | cut -d: -f2 | sed 's/[^0-9]*//g') local occ=$(printf "%s" "${result}" | cut -d: -f2 | sed 's/[^0-9]*//g')
printf "%s was found with %s occurances (hash: %s)\n" "$pass" "$occ" "$pwhash" printf "%s was found with %s occurrences (hash: %s)\n" "$pass" "$occ" "$pwhash"
else else
printf "%s was not found\n" "$pass" printf "%s was not found\n" "$pass"
fi fi
} }
if [ "$#" -lt 1 ]; then # If the first parameter is the -p flag, then ask the server to pad the results.
if [[ "$1" == "-p" ]]; then
PADDING_HEAD="-H 'Add-Padding: true'"
shift # Remove the '-p' from $@
fi
if [[ $# -eq 0 ]]; then
# read from file or stdin (one password per line) # read from file or stdin (one password per line)
while IFS=$'\r\n' read -r pw; do while IFS=$'\r\n' read -r pw; do
lookup_pwned_api "$pw" lookup_pwned_api "$pw"