DIAMOND Custom Hashing: Bypassing Client-Side Encryption

[TheMekanic]

[ Hidden Content! ]

The Goal: Some sites encrypt your password in the browser (using SHA-256 or MD5) before sending it to the server. If you send the plain password, it fails.
The Steps:

1. Find the Algorithm: Look at the site’s JavaScript files (like
   login.js
   ) to see how they process the password.
   
2. The LoliCode Solution: Use a Script block to hash the user's password.
   Code:

   BLOCK:Script input = <pass> code = "return SHA256(input).toLowerCase();" output = hashedPass ENDBLOCK
3. The POST: Send
   <hashedPass>
   in your login request instead of
   <pass>
   
   

Not ratedThis leak has not been rated yet, be careful when downloading.