Skip to content

Pentesting reports

Notes on penetration testing journeys

PHP: permutations

Posted on 2019/01/08 - 2019/01/08 by trouble

The following function calculates the permutations of a given list (typically an array) and lets you group the results by a given number. This is useful when automatically testing login forms bypass, using the strings you can find on this post.

<?php

function permutations($pool, $r = null) {
    $n = count($pool);
    if ($r == null) $r = $n;
    if ($r > $n) return;
    $indices = range(0, $n - 1);
    $cycles = range($n, $n - $r + 1, -1);
    yield array_slice($pool, 0, $r);
    if ($n <= 0) return; while (true) { $exit_early = false; for ($i = $r;$i--;$i >= 0) {
            $cycles[$i]-= 1;
            if ($cycles[$i] == 0) {
                if ($i < count($indices)) {
                    $removed = array_splice($indices, $i, 1);
                    array_push($indices, $removed[0]);
                }
                $cycles[$i] = $n - $i;
            } else {
                $j = $cycles[$i];
                $i_val = $indices[$i];
                $neg_j_val = $indices[count($indices) - $j];
                $indices[$i] = $neg_j_val;
                $indices[count($indices) - $j] = $i_val;
                $result = [];
                $counter = 0;
                foreach ($indices as $indx) {
                    array_push($result, $pool[$indx]);
                    $counter++;
                    if ($counter == $r) break;
                }
                yield $result;
                $exit_early = true;
                break;
            }
        }
        if (!$exit_early) break;
    }
}

$result = iterator_to_array(permutations(array("a","b","c","d","e", 2));
foreach ($result as $row)
    print implode(" || ", $row) . PHP_EOL;
echo count($result);
?>

The above code will output the following:

a || b
a || c
a || d
a || e
b || a
b || c
b || d
b || e
c || a
c || b
c || d
c || e
d || a
d || b
d || c
d || e
e || a
e || b
e || c
e || d
20
Posted in Bypass login, PHP snippetsTagged permutations, php

Post navigation

PHP: upload a file with cURL
Bash one-line command: find suid executables

Music from Soundcloud

Pages

  • Manifesto
  • Get in touch

Categories

  • Arbitrary file download
  • Bash one-liners
  • Bypass login
  • PHP snippets

RSS feed: RSS Feed from Exploit DB RSS Feed from Exploit DB

  • [remote] CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE
  • [remote] PCMan 2.0.7 - Buffer Overflow
  • [webapps] Linuxfabrik monitoring_plugins_6.0.0 - SSRF
  • [webapps] Nodemailer 9.0.0 - File Read/ SSRF
  • [webapps] flyto-core 2.26.7 - Arbitrary File Write
  • [dos] NanaZip 6.5 - DoS
  • [remote] D-Link DNS_340L - OS Command Injection
  • [remote] ipTIME A3004T - Remote Code Execution
  • [webapps] Duplicati 2.2.0.3 - JWT Signing Key Leak
  • [dos] Nmap 7.99 - Extension Header Integer Underflow

RSS feed: RSS Feed from Packetstorm RSS Feed from Packetstorm

RSS feed: Rss Feed from Nist Rss Feed from Nist

Proudly powered by WordPress | Theme: micro, developed by DevriX.