| Author |
Message
|
| maclema |
 Posted: Mon May 07, 2007 11:47 pm Post subject: Server Scrambler |
 |
|
Site Admin
Joined: 07 May 2007
Posts: 29
|
Note: I have not tested any of this code, this is more to give a general idea of how to create a server scrambler. The next release will contain a tested ServerScrambler actionscript class.
Java Class:
| Code: |
package com.maclema.mysql.scramblers;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
public class Scrambler
{
static byte[] scrambleSeed(String password, String seed) throws NoSuchAlgorithmException
{
MessageDigest md = MessageDigest.getInstance("SHA-1");
byte[] passwordHashStage1 = md.digest(password.getBytes());
md.reset();
byte[] passwordHashStage2 = md.digest(passwordHashStage1);
md.reset();
byte[] seedAsBytes = seed.getBytes();
md.update(seedAsBytes);
md.update(passwordHashStage2);
byte[] toBeXord = md.digest();
int numToXor = toBeXord.length;
for (int i = 0; i < numToXor; i++) {
toBeXord[i] = (byte) (toBeXord[i] ^ passwordHashStage1[i]);
}
return toBeXord;
}
} |
JSP File:
| Code: |
<%@ page contentType="application/octet-stream" language="java" import="java.sql.*, com.maclema.mysql.scramblers.*" %>
<%
String seed = request.getParameter("seed");
String password = "myDbPassword";
try
{
byte[] scrambled = Scrambler.scrambleSeed(password, seed);
response.getOutputStream().print( new String(scrambled) );
}
catch ( NoSuchAlgorithmException nsae )
{
//grr
}
%> |
AS Class:
| Code: |
package com.maclema.mysql.crypto
{
import flash.net.URLVariables;
import flash.net.URLRequest;
import flash.net.URLRequestMethod;
import flash.net.URLLoader;
import flash.events.Event;
import flash.net.URLLoaderDataFormat;
import flash.utils.ByteArray;
public class ServerScrambler extends MysqlScrambler
{
private var _scramble:ByteArray;
public function ServerScrambler(password:String)
{
super();
}
override public function scrambleSeed(seed:String):void
{
var data:URLVariables = new URLVariables();
data.seed = seed;
var req:URLRequest = new URLRequest();
req.data = data;
req.method = URLRequestMethod.POST;
req.url = "scrambler.jsp";
var ldr:URLLoader = new URLLoader();
ldr.dataFormat = URLLoaderDataFormat.BINARY;
ldr.addEventListener(Event.COMPLETE, onScrambled);
ldr.load(req);
}
private function onScrambled(e:Event):void
{
var ldr:URLLoader = URLLoader(e.target);
_scramble = ldr.data;
dispatchEvent(new Event("scrambled"));
}
override public function get scramble():ByteArray
{
return _scramble;
}
}
} |
|
|
| Back to top |
|
 |
| mooska |
| Posted: Tue May 08, 2007 12:00 am Post subject: |
|
|
Joined: 07 May 2007
Posts: 3
|
Isnt server side scrambler a bit ... useless ?
If your code is opensource anyway, anyone can create his own app, connect to the serverside, scramble, and do anything with mysql server anyway ?
Or does java have any way to prevent this
and if scrambler will respond too late, you wont connect  Yeah, Im whining |
|
| Back to top |
|
|
| maclema |
| Posted: Tue May 08, 2007 12:14 am Post subject: |
|
|
Site Admin
Joined: 07 May 2007
Posts: 29
|
| Everything you say is valid. I am just providing alternatives to developers. Honestly its up to the individual developer to decide on how to protect the password. |
|
| Back to top |
|
|
| mooska |
| Posted: Tue May 08, 2007 12:19 am Post subject: |
|
|
Joined: 07 May 2007
Posts: 3
|
My way of doing this, would be not playing with client side, since its no use. I would prefere to put some work into showing how it should be done with stored procedures.
What sniffer do you use ? Ive used Wireshark, but it does not support localhost. |
|
| Back to top |
|
|
| maclema |
| Posted: Tue May 08, 2007 12:21 am Post subject: |
|
|
Site Admin
Joined: 07 May 2007
Posts: 29
|
| I have not needed a sniffer yet so I don't have a preferred choice yet. |
|
| Back to top |
|
|
| mooska |
| Posted: Tue May 08, 2007 12:28 am Post subject: |
|
|
Joined: 07 May 2007
Posts: 3
|
| Hmm, so how did you manage to implement this ? Just a plain copy from java ? |
|
| Back to top |
|
|
| maclema |
| Posted: Tue May 08, 2007 12:33 am Post subject: |
|
|
Site Admin
Joined: 07 May 2007
Posts: 29
|
|
| Back to top |
|
|
| Franklin |
| Posted: Thu Oct 16, 2008 1:32 am Post subject: |
|
|
Joined: 16 Oct 2008
Posts: 9
|
|
| Back to top |
|
|
|
|
