UPDATE:So, I didn’t know it when this was posted, but LastPass put up a site to check your LinkedIn password, and another one for the eHarmony breach.

@0xabad1dea
Attention universe, change your LinkedIn password and any other account that uses it. Just do it. 8:59AM

So unless you’ve been sleeping under a digital rock for the last twelve hours, by now you know LinkedIn had at least 6million password hashes snatched right out from under their noses.

There are plenty of places on the net where people smarter than I am will walk you through exactly what this means, and even more (arguably) smart people will try to scare the crap out of you, so if that’s what you’re looking for, you can go somewhere else.

@moxie
If LinkedIn hasn’t been able to confirm the breach, they havent fixed it either. You can change your PW, but attackers can just get it again 1:13PM

I decided to post this because while I thought I’d find myself once again checking a hash list to see how likely it was that my password had been compromised, instead I found that I was suddenly unable to remember my LinkedIn password in the first place! To be more accurate, I knew I’d be able to get it within 3 or 4 tries, as I use the now (in)famous ‘Correct Horse Battery Staple‘ method. Nevertheless, with the how often these dumps hit the internet, and how often they seem to be for sites I frequent, I found myself taking my own advice:

If you’re going to do something more than once,script it!

And I came up with this:

#!/bin/bash
#check hashlist for password
echo "usage: pw algorithm hashlist"
echo "eg ./checkfor Password123$ md5 ./hashlist.txt"
case $2 in
	"md5")
	md5hash=`echo -n $1|md5sum`
    md5hash=${md5hash:0:32}
	echo "Checking for $2 hash of $1 ($md5hash) in $3..."
	awk "/$md5hash/" $3
	;;
	"sha1")
	sha1hash=`echo -n $1|sha1sum`
	sha1hash=${sha1hash:0:40}
	echo "Checking for $2 hash of $1 ($sha1hash) in $3..."
	awk "/$sha1hash/" $3
	;;
esac

Of course, I then realized that despite my best efforts, not only would many people I know never bother to check or change their passwords, they may even be tempted to plug them into one of the phishing sites claiming to check their passwords for them which will undoubtedly pop up pretty soon, if they haven’t already. So I compiled a quick list of common passwords I know are in use by friends & family (yes, I can probably guess your password, get over it), polished up that script up there to handle a wordlist…

#!/bin/bash
#check password list against hashlist
if [ -z "$3" ]         # VERY quick & dirty input checking
then
     echo "usage: checkfor ./pwlist.txt (md5|sha1) ./hashlist.txt"
     exit
fi
if [ "$1" == "?" ] #copy & past makes for easy redundancy!
then
     echo "usage: checkfor ./pwlist.txt (md5|sha1) ./hashlist.txt"
     exit
fi
while read line;
do 
if [ "$2" == md5 ]; then
     md5hash=`echo -n $line|md5sum`
     md5hash=${md5hash:0:32}
     echo "Checking for $2 hash of $line ($md5hash) in $3..."
     echo "$line" `awk "/$md5hash/{n++}; END { print n+0 }" $3`  >> ./rawresults.txt
     awk '$2 != "0"' ./rawresults.txt >> ./cleanresults.txt
     rm ./rawresults.txt
fi
if [ "$2" == sha1 ]; then
     sha1hash=`echo -n $line|sha1sum`
     sha1hash=${sha1hash:0:40}
     echo "Checking for $2 hash of $line ($sha1hash) in $3..." 
     echo "$line" `awk "/$sha1hash/{n++}; END { print n+0 }" $3`  >> ./rawresults.txt
     awk '$2 != "0"' ./rawresults.txt >> ./cleanresults.txt
     rm ./rawresults.txt
fi
done < $1

…and let it run. Thankfully, I only ended up matching some common passwords that I fully expected to match, given that they’re probably used by lots of people. (eg the sha1 of linkedinpassword is d2ffdbdb71a0e55324fa51949a145dc001ed53dc, and yes, it’s in there)

So if I don’t know you in real life, and you run linux, snatch a copy of the hashdump, and run the above script against it using your password. Or you could take even less time and just change your password. 😉

Happy scripting!

imgurdl 1.0

Partially working crap is fine for home use, but serving it up for public consumption bugged me.

#!/bin/bash
if [ -z "$2" ]
then
echo "Usage: imgurdl (album address) (savedir)"
exit
else
SEQ=/usr/bin/seq
albumaddy=$1
rawlist=$(curl -s $albumaddy | awk 'BEGIN {RS = ","} /\"hash\":"/ {print substr($0,RSTART+10,5)}')
touch ~/cookie.txt
wget --cookies=on --keep-session-cookies --save-cookies=~/cookie.txt $albumaddy
echo "$rawlist"
alist=( $(echo $rawlist) )
echo "alist1 = ${alist[1]}"
echo "alist5 = ${alist[5]}"
#5 to 9
echo " Number of files to download is $(( ${#alist[@]} ))"
echo " Continue?"
read dl
case "$dl" in
"n"*|"N"*)
exit
;;
"y"*|"Y"*)
cd $2
for i in $($SEQ 0 $((${#alist[@]} - 1)))
do
#echo "alist $i = "${alist[$i]}
#newlist[$i]=${alist[$i]:4:(${#alist[$i]}-6)}
echo "Remote filename = "${alist[$i]}".jpg"
echo "Local filename = "$i"."${alist[$i]}".jpg"
# echo ${newlist[$i]}
wget --referer=$albumaddy --cookies=on --load-cookies=~/cookie.txt --keep-session-cookies --save-cookies=cookie.txt -r --tries=10 -q --limit-rate=968k -w 3 --random-wait -nd -U "Firefox" http://i.imgur.com/"${alist[$i]}".jpg -P $2 -O $i.${alist[$i]}.jpg
# len=${#alist[$i]}
#working newlist[$i]=${alist[$i]:4:(${#alist[$i]}-6)}
# {newlist[$i]}=$(${alist[$i]:5:(${#alist[$i]}-2)})
#echo "newlist $i = "${newlist[$i]}
done

;;
*)
exit
esac
fi


 

imgurdl 0.5

NINJA EDIT: Apparently this form only works with certain imgur album layouts, probably due to the ridiculous awk nonsense I did to get my source urls. I don’t care right now, if I try to download an album and it doesn’t work, maybe then I’ll fix it.
Revisions are welcome in the comments

Sorted.

 

Unsatisfied with the flexibility of other options, I hacked this together the other day to download a large wallpaper archive, and thought it might be useful. It’s uncommented save for the usage text, but really, if you need an explanation for this, then I suggest you start here.

Relative paths don’t work properly in $2, which is obviously a quoting issue, but it met my needs, so I expect all work on this to cease for now.

#!/bin/bash
if [ -z "$2" ]
then
echo "Usage: imgurdl (album address) (savedir)"
exit
else
SEQ=/usr/bin/seq
albumaddy=$1
rawlist=$(curl $albumaddy | awk '/image" id="/ {print $3}')
alist=( $(echo $rawlist) )
echo " Number of files to download is $(( ${#alist[@]} ))"
echo " Continue?"
read dl
case "$dl" in
"n"*|"N"*)
exit
;;
"y"*|"Y"*)
for i in $($SEQ 0 $((${#alist[@]} - 1)))
do
#echo "alist $i = "${alist[$i]}
newlist[$i]=${alist[$i]:4:(${#alist[$i]}-6)}
echo "Remote filename = "${newlist[$i]}".jpg"
echo "Local filename = "$i"."${newlist[$i]}".jpg"
wget -r --tries=10 -q --limit-rate=968k -w 3 --random-wait -nd -U "Firefox" http://i.imgur.com/"${newlist[$i]}".jpg -P $2 -O $i.${newlist[$i]}.jpg
# len=${#alist[$i]}
done

;;
*)
exit
esac
fi

hist2bin v0.5

So as well as it passed my quick QA testing the other day, that last version failed in some major ways:

1. It didn’t work as a cron job
2. It only worked locally

So I addressed those issues, but to get the full effect I highly recommend you share your history across all terminals by adding this to your .bashrc:

PROMPT_COMMAND="history -a; history -n"

hist2bin v0.2

The other night I decided to throw together a script that would bring to life a little thought I first had over on reddit.

The thought was that for hard to remember commands you’ll use more than once, to automatically save them before wiping your command history.

Right now it’s sloppy but it:

1. extracts the commands you want
2. creates files containing those commands, one per file
3. names them per your comment when you ran the command
4. handles whitespace in the data and filename
5. cleans up after itself
6. reports the filenames on exit
7. drastically reduces the chances of a duplicate-named file issue

The code is after the jump