Well the interesting thing is none of the md5 hashes such as user.pass or other parts of the system have been rainbow striped, what is rainbow striping. It is putting a character every so x amount of character as per the length to make it identifiable as a hash.

When is this useful. Well when you have a password say that is 32 characters and it is converted to an md5, it stays at 32 characters, if you stripe it you can detect if it is a md5 or md4 or sha1 etc, and re-assemble it.

I will add some code to the SVN for this i am not sure when this will be added to the actual system, but it would be good to see this in version 3.0

and example of this in md5 would be this I am using the word xoops

normal md5: 60d605debf95b04881279358dbfdb7e1
striped md5: 60d605-debf95b-04881-27935-8dbf-db7e1

This means you can check for a dash every x character and know it is an md5 for example.

Download a copy of the Hash Factory:

Download: xoops-rainbow.zip 2.46 Kbs

And why wouldn´t you know what kind of hash you are dealing with?
Even if a pass is 32 characters you would know the diference.
If not, then lets say my pass is:
60d605-debf95b-04881-27935-8dbf-db7e1

How would you deal with it then?

Sorry, I´m not sure if i´m understanding it right.

Quote:

Actually trabis there is no way of testing a hash and to know that it is a hash, say you had a routine that needed and md5 string and the string test was something like this:

For example with this url you can only test it this way:

Quote:




then in this example it wouldn't be possible to pass a union into the $_GET['md5'] but not all programmer test the input this means that it introduces security issues into the url so people can retrieve information with SQL Ingestion.

It also means there is a way of identifing a MD5 checksum from apart the length.. Imageing your password is something like

mypasswordisorwasownedtosomeguyisex

it is 32 chars, this means it would pass the same as:

60d605debf95b04881279358dbfdb7e1

Cause there is no way normally to test for an md5 or sha1 hashing it has no inherited checksum. The Rainbow Stripe method is used in alot of software, sometime a space sometimes a colon or a dash. It is the proper way of handling a hash.

See now if you want to see if the url contains a valid MD5 so there is no SQL Ingestion etc with the XoopsRainbow class a test of a URL passed

ie:

Quote:



Which means you have an affirmed check that it is the correct type of hash and no one is attempting to dummy rig the system.