Skip to content

Pentesting reports

Notes on penetration testing journeys

PHP: permutations

Posted on 2019/01/08 - 2019/01/08 by trouble

The following function calculates the permutations of a given list (typically an array) and lets you group the results by a given number. This is useful when automatically testing login forms bypass, using the strings you can find on this post.

<?php

function permutations($pool, $r = null) {
    $n = count($pool);
    if ($r == null) $r = $n;
    if ($r > $n) return;
    $indices = range(0, $n - 1);
    $cycles = range($n, $n - $r + 1, -1);
    yield array_slice($pool, 0, $r);
    if ($n <= 0) return; while (true) { $exit_early = false; for ($i = $r;$i--;$i >= 0) {
            $cycles[$i]-= 1;
            if ($cycles[$i] == 0) {
                if ($i < count($indices)) {
                    $removed = array_splice($indices, $i, 1);
                    array_push($indices, $removed[0]);
                }
                $cycles[$i] = $n - $i;
            } else {
                $j = $cycles[$i];
                $i_val = $indices[$i];
                $neg_j_val = $indices[count($indices) - $j];
                $indices[$i] = $neg_j_val;
                $indices[count($indices) - $j] = $i_val;
                $result = [];
                $counter = 0;
                foreach ($indices as $indx) {
                    array_push($result, $pool[$indx]);
                    $counter++;
                    if ($counter == $r) break;
                }
                yield $result;
                $exit_early = true;
                break;
            }
        }
        if (!$exit_early) break;
    }
}

$result = iterator_to_array(permutations(array("a","b","c","d","e", 2));
foreach ($result as $row)
    print implode(" || ", $row) . PHP_EOL;
echo count($result);
?>

The above code will output the following:

a || b
a || c
a || d
a || e
b || a
b || c
b || d
b || e
c || a
c || b
c || d
c || e
d || a
d || b
d || c
d || e
e || a
e || b
e || c
e || d
20
Posted in Bypass login, PHP snippetsTagged permutations, php

Post navigation

PHP: upload a file with cURL
Bash one-line command: find suid executables

Music from Soundcloud

Pages

  • Manifesto
  • Get in touch

Categories

  • Arbitrary file download
  • Bash one-liners
  • Bypass login
  • PHP snippets

RSS feed: RSS Feed from Exploit DB RSS Feed from Exploit DB

RSS feed: RSS Feed from Packetstorm RSS Feed from Packetstorm

RSS feed: Rss Feed from Nist Rss Feed from Nist

Proudly powered by WordPress | Theme: micro, developed by DevriX.