Subversion Repositories sysadmin_scripts

/*
 * Check password for inclusion in lists maintained by 
 * https://haveibeenpwned.com/ using their API.
 * 
 * Copyright (C) [2019] by Daily Data, Inc <https://dailydata.net>
 * All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions 
 * are met:
 * 
 * 1. Redistributions of source code must retain the above copyright notice, this
 *    list of conditions and the following disclaimer.
 * 2. Attribution to Troy Hunt at https://haveibeenpwned.com/ must appear
 *    on any page which uses this set of scripts.
 * 3. Attribution to Daily Data, Inc. (https://dailydata.net) is optional
 *    but appreciated.
 * 
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL 
 * WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED 
 * WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE 
 * AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
 * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
 * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER 
 * TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 * PERFORMANCE OF THIS SOFTWARE.
 * 
 */

var pre_hash = null;
var post_hash = null;

$( document ).ready(function() {  //Once the document is ready
    $("button#lookup").click( // When the button is clicked
            function(event) {
                //Set the result div so if the request takes a while, the user will know it's working.
                $("div#result").html("Checking password against password list, please wait...");
                //And now process the query.
                processQuery($("input#password").val());
                
            });
});

async function processQuery( str ) {
  //Crypto stuff to use modern browsers SHA functions to create the hash.
  const buffer = new TextEncoder( 'utf-8' ).encode( str );
  const digest = await crypto.subtle.digest('SHA-1', buffer);

  // Convert digest to hex string
  const result = Array.from(new Uint8Array(digest)).map( x => x.toString(16).padStart(2,'0') ).join('');
  
  //Once this is done, take the result and make the AJAX call.
  pre_hash = result.substring(0,5).toUpperCase();
  post_hash = result.substring(5,result.length).toUpperCase();
  
  console.log("Full hash: " + result);
  console.log("Pre_hash: " + pre_hash);
  console.log("Post_hash: " + post_hash);
  console.log("Making AJAX call for " + pre_hash + ".");
  
  var url = "https://api.pwnedpasswords.com/range/" + pre_hash;
  $.get( url, function( data ) {
        var lines = data.split('\n');
        var found = false;
        console.log("Returned lines:");
        console.log(lines.length);
        
        //If we got here, it was successful, so check the returned lines for a match.
        for(let line of lines) {
            var tmp_line = line.split(":");
            console.log("Testing " + post_hash + " vs " + tmp_line[0]);
            if(post_hash === tmp_line[0]) {
                //Got a match!
                console.log("*** MATCH FOUND *** ");
                $("div#result").html("<b>Warning: That password was found " + tmp_line[1] + " times!</b><br />We recommend you never use this password.");
                found = true;
                break;
            }
          };
          
        if(found === false) { 
            $("div#result").html("Password was not found in any lists.<br />However, this does not guarantee it is a good password.");
        }
    });
}