Add server example

Author: zzzteph

.gitattributes

@@ -0,0 +1,11 @@
+* text=auto eol=lf
+
+*.blade.php diff=html
+*.css diff=css
+*.html diff=html
+*.md diff=markdown
+*.php diff=php
+
+/.github export-ignore
+CHANGELOG.md export-ignore
+.styleci.yml export-ignore

.gitignore

@@ -0,0 +1,19 @@
+/.phpunit.cache
+/node_modules
+/public/build
+/public/hot
+/public/storage
+/storage/*.key
+/vendor
+.env
+.env.backup
+.env.production
+.phpunit.result.cache
+Homestead.json
+Homestead.yaml
+auth.json
+npm-debug.log
+yarn-error.log
+/.fleet
+/.idea
+/.vscode

README.md

@@ -1,13 +1,16 @@
-# Weakpass (JS)
+# Weakpass
 
 <p align="center">
   <img src="https://github.com/zzzteph/weakpass/blob/readme/cracker.png?raw=true"  height="250">
 </p>
 
-Here, you can find the list of tools from [weakpass.com](https://weakpass.com/) for password and hash cracking in one place.
+Here, you can find the list of tools and example of API server from [weakpass.com](https://weakpass.com/) for password and hash cracking in one place.
 
 ### 📂 Folder Structure
 
+- **server**
+  - Server demo-example for the Weakpass API. 
+
 - **tools**
   - A collection of password and hash cracking tools. **Check them out:**
     - [Kraker-js](https://zzzteph.github.io/weakpass/tools/kraker-js/dist/)
@@ -54,7 +57,7 @@ Perform secure hash lookups without submitting sensitive data to a server using
   <img src="https://github.com/zzzteph/weakpass/blob/main/tools/lookup/lookup.PNG?raw=true"  height="250">
 </p>
 
-Reveal passwords for MD5, NTLM, SHA1, or SHA256 hashes using the precomputed `weakpass4.merged.txt` file without sending your hash to the backend. The primary advantage is that all hash checks are done client-side, ensuring that your data remains secure and private.
+Reveal passwords for MD5, NTLM, SHA1, or SHA256 hashes using the precomputed wordlist without sending your hash to the backend. The primary advantage is that all hash checks are done client-side, ensuring that your data remains secure and private.
 
 Additionally, you can host and build the database for this tool locally and in-house. To do so, use one of the precomputed tables available [here](https://weakpass.com/pre-computed) and set up an API to serve hash ranges by value.
 
@@ -74,7 +77,7 @@ Online: [Passcheck](https://zzzteph.github.io/weakpass/tools/passcheck/dist/)
 </p>
 
 
-This tool checks if your password exists in the **weakpass_4.merged** wordlist using a range lookup API. 
+This tool checks if your password exists in the precomputed wordlist using a range lookup API. 
 
 **But what if someone decided to use a rule-based attack? Is your password safe for rule-based attacks?**
 Beyond that, it simulates rule-based attacks by applying "reverse" hashcat rules to identify potential candidates that could be used with the rules to crack your password.

server/.editorconfig

@@ -0,0 +1,18 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_size = 4
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{yml,yaml}]
+indent_size = 2
+
+[docker-compose.yml]
+indent_size = 4

server/.gitattributes

@@ -0,0 +1,11 @@
+* text=auto eol=lf
+
+*.blade.php diff=html
+*.css diff=css
+*.html diff=html
+*.md diff=markdown
+*.php diff=php
+
+/.github export-ignore
+CHANGELOG.md export-ignore
+.styleci.yml export-ignore

server/.gitignore

@@ -0,0 +1,28 @@
+*.log
+.DS_Store
+.env
+.env.backup
+.env.production
+.phpactor.json
+.phpunit.result.cache
+/.fleet
+/.idea
+/.nova
+/.phpunit.cache
+/.vscode
+/.zed
+/auth.json
+/node_modules
+/public/build
+/public/hot
+/public/storage
+/storage/*.key
+/storage/pail
+/vendor
+Homestead.json
+Homestead.yaml
+Thumbs.db
+
+**/caddy
+frankenphp
+frankenphp-worker.php

server/Dockerfile

@@ -0,0 +1,19 @@
+FROM dunglas/frankenphp
+
+WORKDIR /weakpass
+
+COPY . .
+
+RUN apt-get update && apt-get install -y  git zip 7zip && rm -rf /var/lib/apt/lists/*
+COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
+RUN install-php-extensions \
+    pcntl
+
+RUN composer install --no-interaction --prefer-dist --optimize-autoloader
+RUN composer require laravel/octane --no-interaction
+
+RUN php artisan key:generate \
+ && php artisan storage:link \
+&& php artisan octane:install --server=frankenphp
+
+ENTRYPOINT ["php", "artisan", "octane:frankenphp"]

server/README.md

@@ -0,0 +1,51 @@
+# Weakpass – Sample API Server
+
+<p align="center">
+  <img src="https://github.com/zzzteph/weakpass/blob/readme/cracker.png?raw=true" height="250">
+</p>
+
+This is an example server and build scripts for the Weakpass API.
+
+## Build & Run
+
+```bash
+docker build . -t weakpass_api
+docker run -p 8000:8000 weakpass_api
+```
+
+Navigate to:
+
+- API root: [http://127.0.0.1/](http://127.0.0.1/)
+- Swagger docs: [http://127.0.0.1/api/](http://127.0.0.1/api/)
+- Example API test: [http://127.0.0.1/api/v1/range/0000009?type=md5](http://127.0.0.1/api/v1/range/0000009?type=md5)
+
+## Scripts
+
+In the `/app/Console` folder, you can find scripts to build your own database or filter wordlists.
+
+### Filter Wordlist
+
+```bash
+php artisan app:filter-wordlist {input-file} {output-file} {--sort}
+```
+
+Removes junk data from a wordlist.
+
+**Arguments:**
+- `input-file` – path to the wordlist you want to filter
+- `output-file` – path where the filtered list will be saved
+- `--sort` – optional flag to sort the results alphabetically
+
+### Examples
+
+```bash
+cd /weakpass/
+php artisan app:filter-wordlist /download/rockyou.txt /download/rockyou.txt.filtered
+```
+Creates `/download/rockyou.txt.filtered` with junk data removed.
+
+```bash
+cd /weakpass/
+php artisan app:filter-wordlist /download/rockyou.txt /download/rockyou.txt.filtered --sort
+```
+Creates `/download/rockyou.txt.filtered` with junk data removed **and** sorted alphabetically.

server/app/Console/Commands/BuildLookupTree.php

@@ -0,0 +1,76 @@
+<?php
+
+namespace App\Console\Commands;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Process;
+class BuildLookupTree extends Command
+{
+    /**
+     * The name and signature of the console command.
+     *
+     * @var string
+     */
+    protected $signature = 'app:build-lookup-tree {folder} {file} {type}';
+
+    /**
+     * The console command description.
+     *
+     * @var string
+     */
+    protected $description = 'Build database for new weakpass';
+
+
+
+    public function handle()
+    {
+
+
+        
+        if(!file_exists($this->argument('folder')) || !is_dir($this->argument('folder')))
+        {
+            $this->error($this->argument('folder')." not exist");
+            die();
+        }
+
+        if(!file_exists($this->argument('file')))
+        {
+            $this->error($this->argument('file')." not exist");
+            die();
+        }
+        
+        $type=$this->argument('type');
+        $handle = fopen($this->argument('file'), "r");
+        $folder=$this->argument('folder');
+        $prefix="";
+        $prefix_file=FALSE;
+        $files=array();
+        if ($handle) {
+            while (($line = fgets($handle)) !== false) {
+                $tmp_prefix=substr($line, 0, 6);
+                if($tmp_prefix!==$prefix)
+                {
+                    
+                    if ($prefix_file) fclose($prefix_file);
+                    $folder1 = substr($tmp_prefix, 0, 2); 
+                    $folder2 = substr($tmp_prefix, 2, 2); 
+                    $file = substr($tmp_prefix, 4, 2); 
+                    if(!file_exists($folder.$folder1))mkdir($folder.$folder1);
+                    if(!file_exists($folder.$folder1."/".$folder2))mkdir($folder.$folder1."/".$folder2);
+                      
+                    $path=$folder.$folder1."/".$folder2."/".$file."_".$type;
+                    $this->info($path);
+                    $prefix_file = fopen($path, 'a+w');
+                    $prefix=$tmp_prefix;
+                }
+                fwrite($prefix_file,$line);   
+            }
+            fclose($handle);
+        }
+        if ($prefix_file) fclose($prefix_file);
+    
+         
+
+
+    }
+}