Strength and weaknesses of this JavaScript charCodeAt based login script

Question

I know of a company on their website who are using this very basic password login page written in JavaScript. This doesn't seem very secure at all, because in the html source code it shows where the script comes from: http://www.dynamicdrive.com/dynamicindex9/password.htm and also you can see how it works as it's JavaScript and you can just view the source in a browser.

It seem pretty simple, it takes a value entered in an input field by a user works out the char unicode interger value of each character in the passcode and then times this value by the previous value and loops this until it has done this for each character in the passcode. It then compares this with an answer value saved in JavaScript which the user has already converted from the right answer in the same manner using the tool on http://www.dynamicdrive.com/dynamicindex9/password.htm and then if these two match the JavaScript redirects you to the secret page which is a html file with the same name of the clear text password.

My question is knowing how this method works to convert what the user inputs into a charcode value, how can you reverse this process to find out what the original plain text password was? I have changed the usercode and passcode value below to what is featured on this companys website.

I have thought of two methods to change 16978476480 back to plain text. One possibility I guess would to get a word list of common passwords, convert each to a number value using the same method and then seeing if any match 16978476480. The other similar method would be to pick random characters to form a string between 4 and 8 characters in length, the usual password lengths, times all the unicode values to together and then keep looping until we get lucky and hit a match for 16978476480. Can anyone think of any better of faster ways?

The script is as follows:

//Encrypted Password script- By Rob Heslop //Script featured on Dynamic Drive //Visit http://www.dynamicdrive.com

function submitentry(){
password = document.password1.password2.value.toLowerCase()
username = document.password1.username2.value.toLowerCase()
passcode = 1
usercode = 1
for(i = 0; i < password.length; i++) {
passcode *= password.charCodeAt(i);
}
for(x = 0; x < username.length; x++) {
usercode *= username.charCodeAt(x);
}
//CHANGE THE NUMBERS BELOW TO REFLECT YOUR USERNAME/PASSWORD
if(usercode==12211815000&&passcode==16978476480)
//CHANGE THE NUMBERS ABOVE TO REFLECT YOUR USERNAME/PASSWORD
{
window.location=password+".html"}
else{
alert("password/username combination wrong")}
}


<form name="password1">
<strong>Enter username:</strong>
<input type="text" name="username2" size="15">
<br>
<strong>Enter password: </strong>
<input type="password" name="password2" size="15">

<input type="button" value="Submit" onClick="submitentry()">
</form>

Answer 1

You don't need to brute force it. Since the passcode is the product of all its character codes, you can just find all prime factors of the passcode. I used an online tool which yields $2^6\cdot 3\cdot 5\cdot 7^2\cdot 61^2\cdot 97$. It looks like an ASCII passcode of length 5.

This doesn't get you anywhere since this is just a check for a web page to open. Now you need to "brute force" all possible combinations of $2^6\cdot 3\cdot 5\cdot 7^2\cdot 61^2$ ($97$ is more of less fixed to be a) and then try for each combination all permutations. You can further filter a little since only lowercase letters are used. For each permutation you would need to download the password+'.html' file. When you finally get an HTTP 200 code you're done.

Of course if you assume that every letter is lowercase then you can assume that $2\cdot 61$ is z. Now the question is to find a 5 letter word with letter zza in it.... The other prime factors will get you p and i.

Note that you only need to do this for passcode, usercode is not used.

Answer 2

I had a go at writing a PHP script to do the brute force attempt. Using a common list of passwords dictionary file it found the password in 8 seconds.

$target = 16978476480;

function utf8_to_unicode($str) {

    $unicode = array();        
        $values = array();
    $lookingFor = 1;

    for ($i = 0; $i < strlen( $str ); $i++ ) {

        $thisValue = ord( $str[ $i ] );

        if ( $thisValue < 128 ) $unicode[] = $thisValue;
        else {

            if ( count( $values ) == 0 ) $lookingFor = ( $thisValue < 224 ) ? 2 : 3;

            $values[] = $thisValue;

            if ( count( $values ) == $lookingFor ) {

                $number = ( $lookingFor == 3 ) ?
                    ( ( $values[0] % 16 ) * 4096 ) + ( ( $values[1] % 64 ) * 64 ) + ( $values[2] % 64 ):
    					( ( $values[0] % 32 ) * 64 ) + ( $values[1] % 64 );

                $unicode[] = $number;
                $values = array();
    				$lookingFor = 1;

            }

        }

    }

    return $unicode;

}

$passwordList = file_get_contents('passwords.txt');

$passwordListArray = explode("\n", $passwordList);

foreach ($passwordListArray as $potentialPassword) {

    $stringLength = strlen($potentialPassword);

    $unicodeVal = 0;

    for ($i = 0; $i < $stringLength; $i++) {

        $char = $potentialPassword[$i];

        $utf8char = utf8_to_unicode($char);

        if ($unicodeVal == 0) {

            $unicodeVal = (int)$utf8char[0];

        } else {

            $unicodeVal = $unicodeVal * (int)$utf8char[0];

        }
    }


    echo "\r\n";

    echo 'Trying: '.$potentialPassword."\r\n";

    echo 'Encodes to: '.$unicodeVal."\r\n";

    if ($unicodeVal == $target) {

        break;

    }

}

echo 'Target: '.$target."\r\n";

echo 'Last number found: '.$unicodeVal."\r\n";

echo 'The password is: '.$potentialPassword."\r\n";