From seth at animejunkie.org  Tue Apr 15 13:36:35 2008
From: seth at animejunkie.org (Seth Miller)
Date: Tue, 15 Apr 2008 15:36:35 -0500
Subject: APM: question on variable scope
Message-ID: <c109d0d40804151336n22adf13bscc919511d69e22dd@mail.gmail.com>

Hello all,

I've having some trouble with a script.  I'm trying to grab a complete
list of email accounts on the server and check the password against a
word list to find weak passwords.  The hash %data has the email
address in the key and the account password in the value.

The word list file currently just has the word 'password' for testing
but it doesn't seem to be working.  Here's the portion of the script
that's not working

#BEGIN

open (WORDLIST, "<$wordlist") or die "Can't open the wordlist: $!";

while (my $pass = <WORDLIST>) {
  while ( my ($user,$password) = each (%data) ) {
    print "$user - $password\n" if ($password =~ /$pass/);
  }
}

close WORDLIST;

#END

The while loop that iterates through the word list is working because
if write a die to spit out the value of $pass, it prints the word
password as expected.  If I change the if statement to if ($value =~
/password/) it works too.

Also if I set the value of $pass manually just before the print line,
it works.  The script just doesn't work as it looks above.  No errors
or warnings, just no output.  I'm assuming it has something to do with
the scope of the $pass variable.

Any ideas?

--seth

From msouth at gmail.com  Tue Apr 15 13:53:18 2008
From: msouth at gmail.com (Mike South)
Date: Tue, 15 Apr 2008 16:53:18 -0400
Subject: APM: question on variable scope
In-Reply-To: <c109d0d40804151336n22adf13bscc919511d69e22dd@mail.gmail.com>
References: <c109d0d40804151336n22adf13bscc919511d69e22dd@mail.gmail.com>
Message-ID: <c56d3710804151353m5e10d8a5nb0fde3f467edab@mail.gmail.com>

[Seth, sorry for the repeat, meant to replyall in the first place]

On Tue, Apr 15, 2008 at 4:36 PM, Seth Miller <seth at animejunkie.org> wrote:

> Hello all,
>
> I've having some trouble with a script.  I'm trying to grab a complete
> list of email accounts on the server and check the password against a
> word list to find weak passwords.  The hash %data has the email
> address in the key and the account password in the value.
>
> The word list file currently just has the word 'password' for testing
> but it doesn't seem to be working.  Here's the portion of the script
> that's not working
>
> #BEGIN
>
> open (WORDLIST, "<$wordlist") or die "Can't open the wordlist: $!";
>
> while (my $pass = <WORDLIST>) {


You might need a "chomp $pass;" right here.

My reasoning is that your match is being done against "password[NEWLINE]",
which is what you got from the <> on WORDLIST.

(I didn't test though.)

mike

>
>  while ( my ($user,$password) = each (%data) ) {
>    print "$user - $password\n" if ($password =~ /$pass/);
>  }
> }
>
> close WORDLIST;
>
> #END
>
> The while loop that iterates through the word list is working because
> if write a die to spit out the value of $pass, it prints the word
> password as expected.  If I change the if statement to if ($value =~
> /password/) it works too.
>
> Also if I set the value of $pass manually just before the print line,
> it works.  The script just doesn't work as it looks above.  No errors
> or warnings, just no output.  I'm assuming it has something to do with
> the scope of the $pass variable.
>
> Any ideas?
>
> --seth
> _______________________________________________
> Austin mailing list
> Austin at pm.org
> http://mail.pm.org/mailman/listinfo/austin
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.pm.org/pipermail/austin/attachments/20080415/20dfad0d/attachment.html 

From seth at animejunkie.org  Tue Apr 15 13:48:32 2008
From: seth at animejunkie.org (Seth Miller)
Date: Tue, 15 Apr 2008 15:48:32 -0500
Subject: APM: question on variable scope
In-Reply-To: <c56d3710804151340n55bbe523qee3c1aefcbfd624f@mail.gmail.com>
References: <c109d0d40804151336n22adf13bscc919511d69e22dd@mail.gmail.com>
	<c56d3710804151340n55bbe523qee3c1aefcbfd624f@mail.gmail.com>
Message-ID: <c109d0d40804151348l34589a36ucc2d79e9d63ec74a@mail.gmail.com>

Son of a..........   Thanks Mike!  That was it.  I guess I needed a
fresh set of eyes.  Thanks for the help.

--seth


On Tue, Apr 15, 2008 at 3:40 PM, Mike South <msouth at gmail.com> wrote:
> how about a:
>
> chomp $pass;
>
>
> mike

From perlpilot at gmail.com  Tue Apr 15 20:17:11 2008
From: perlpilot at gmail.com (Jonathan Scott Duff)
Date: Tue, 15 Apr 2008 22:17:11 -0500
Subject: APM: question on variable scope
In-Reply-To: <c109d0d40804151336n22adf13bscc919511d69e22dd@mail.gmail.com>
References: <c109d0d40804151336n22adf13bscc919511d69e22dd@mail.gmail.com>
Message-ID: <b762bfda0804152017v529f8feagea9501b13c1d485c@mail.gmail.com>

On Tue, Apr 15, 2008 at 3:36 PM, Seth Miller <seth at animejunkie.org> wrote:

> Hello all,
>
> I've having some trouble with a script.  I'm trying to grab a complete
> list of email accounts on the server and check the password against a
> word list to find weak passwords.  The hash %data has the email
> address in the key and the account password in the value.
>
> The word list file currently just has the word 'password' for testing
> but it doesn't seem to be working.  Here's the portion of the script
> that's not working
>
> #BEGIN
>
> open (WORDLIST, "<$wordlist") or die "Can't open the wordlist: $!";
>
> while (my $pass = <WORDLIST>) {
>  while ( my ($user,$password) = each (%data) ) {
>    print "$user - $password\n" if ($password =~ /$pass/);
>  }
> }
>
> close WORDLIST;
>
> #END


Other than the chomp, you might want to change your algorithm from O(n^2) to
O(n)-ish by using a module like Regexp::Assemble to generate a single regex
to apply against your hash.

It would look something like this:

#!/usr/bin/perl

use warnings; use strict;
use Regexp::Assemble;

# ...

my $regex = Regexp::Assemble->new( file => $wordlist);
while (my($user,$pass) = each %data) {
    print "$user - $pass\n" if $pass =~ $regex;
}
__END__

I don't know if it'll make a difference to what you're trying to do really,
but it's something you might want to try.

cheers,

-Scott

--
Jonathan Scott Duff
perlpilot at gmail.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.pm.org/pipermail/austin/attachments/20080415/4ca8e2a9/attachment.html