Giter VIP home page Giter VIP logo

collisions-club's Introduction

collisions-club

Microservice for generating strings which all produce the same Java hashCode. Note that the generated output is almost always outside the ASCII range.

Why?

¯\_(ツ)_/¯

The formula

The generator abuses the fact that in Java, String::hashCode essentially sums every character's value, multiplying by 31 at each iteration.

Knowing this, we can trivially generate colliding strings. For example, for four characters, the formula would be:

arr[0] = 2114 - a
arr[1] = a * 31 - b
arr[2] = b * 31 - c
arr[3] = c * 31

where

0 <= c <= b <= a <= 2114

The magic number 2114 is derived from 0xFFFF / 31 where 0xFFFF is the maximum value of an UTF-16 code point (Java uses UTF-16 internally!) and 31 is the multiplier used by the Java hashCode algorithm.

Try it

You can also execute this Java fiddle to see that all of the strings returned indeed have the same hashCode:

https://www.tutorialspoint.com/viewproject.php?URL=compile_java8_online.php&PID=0Bw_CjBb95KQMSWpDWVdGZHBzX3M

API Endpoints

GET /generate

Generates specified amount of strings which all produce the same hashCode in Java.

Parameter Description Type
count Amount of strings to generate. Must be inside range 1...1024 (inclusive). int32
string_length Length of strings to generate (amount of UTF-16 code units, no guarantees about the byte count of the UTF-8 output). Currently only value supported is 4. int32
seed (Optional) The seed to use for the random number generator. int64

Example

Request

GET /generate?string_length=4&count=5&seed=1245125551

Response

GET /generate?string_length=4&count=5&seed=1245125551

{
  "data": [
    "ů퀍櫶⾶",
    "U䝙䋘",
    "˅꛴徠式",
    "Ł틢뮡뉾",
    "ج㻞㝐జ"
  ]
}

GET /hashes

Gets the hashes produced by the specified string lengths.

Example

Request

GET /hashes

Response

{
  "data": [
    {
      "string_length": 4,
      "hash": 62978174
    }
  ]
}

Download

See Releases.

Running

  1. Build or download the jar.
  2. Run the jar: java -jar collisions-club-<version>.jar.

Building

  1. Download or install Apache Maven.
  2. Clone or download this repository.
  3. In the root folder, execute mvn clean package. This produces collisions-club-<version>.jar in the target folder.

License

collisions-club is licensed under the MIT License. See LICENSE.

collisions-club uses third party libraries that are distributed under their own tems. See LICENSE-3RD-PARTY.

collisions-club's People

Contributors

cxcorp avatar

Watchers

 avatar

collisions-club's Issues

项目引用了org.eclipse.jetty:jetty-server等7个开源组件,存在5个漏洞,建议升级

大佬,看你这个项目调用了org.eclipse.jetty:jetty-server等7个开源组件,存在5个安全漏洞,建议你升级下。

漏洞标题:Eclipse Jetty 安全漏洞
漏洞编号:CVE-2017-7656
漏洞描述:
Eclipse Jetty是Eclipse基金会的一个开源的、基于Java的Web服务器和Java Servlet容器。
Eclipse Jetty 9.2.x及之前版本、9.3.x版本和9.4.x版本中存在安全漏洞,该漏洞源于程序没有正确的处理HTTP/0.9版本协议。攻击者可利用该漏洞造成缓存中毒。
国家漏洞库信息:https://www.cnvd.org.cn/flaw/show/CNVD-2018-23743
影响范围:(∞, 9.3.24.v20180605)
最小修复版本:9.3.24.v20180605
引入路径:
cx.corp:[email protected]>com.sparkjava:[email protected]>org.eclipse.jetty:[email protected]

另外4个漏洞 ,信息有点多我就不贴了,你自己看下完整报告:https://www.mfsec.cn/jr?p=a918f1
你对这个issues有任何疑问可以回复我,我能看见哈。

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.