Skip to content
KitploitKITPLOIT
도구블로그
제출
도구블로그
제출

해킹, 침투 테스트 및 사이버 보안 도구를 당신의 보안 무기고에!

Kitploit은 해킹, 사이버 보안 및 침투 테스트 도구 디렉토리입니다. 최신 프로젝트 업데이트를 발견하여 취약점을 찾고, 시스템을 분석하고, 테스트를 자동화하고, 보안을 강화하세요.

··피드·문의·개인정보·© 2026 Kitploit

도구 디렉토리

카테고리

모든 카테고리 보기
Loading categories
xbootEncodePwd — github xboot-x encode password | Kitploit
도구/GitHubGitHub/jas502n/xbootencodepwd
Encryption/Decryption ToolsHash AnalysisCryptographyUtilities & FrameworksLearning & Education
GitHubjas502n/xbootencodepwd

xbootEncodePwd

github xboot-x encode password

저장소 보기
234년 전아직 검토되지 않음

인기

모두 보기 →

커뮤니티에서 가장 많이 사용되는 도구를 찾아보세요.

모든 도구 탐색

도구 컬렉션을 둘러보세요

모든 도구 보기 →
공유

xbootEncodePwd

root@kitploit:~
xboot-activiti-1.0-SNAPSHOT  xboot-cms-1.0-SNAPSHOT       xboot-generator-1.0-SNAPSHOT
xboot-app-1.0-SNAPSHOT       xboot-core-1.0-SNAPSHOT      xboot-open-1.0-SNAPSHOT
xboot-autochat-1.0-SNAPSHOT  xboot-docking-1.0-SNAPSHOT   xboot-quartz-1.0-SNAPSHOT
xboot-base-1.0-SNAPSHOT      xboot-ems-1.0-SNAPSHOT       xboot-social-1.0-SNAPSHOT
xboot-bbs-1.0-SNAPSHOT       xboot-file-1.0-SNAPSHOT      xboot-your-1.0-SNAPSHOT

디컴파일하여 키워드 $2a$10을 검색하면 핵심 코드를 발견할 수 있습니다

root@kitploit:~
IlabXV2LoginController.class

String hashPass = bcryptPasswordEncoder.encode("123456");
boolean flag = bcryptPasswordEncoder.matches("123456", "$2a$10$zHF74Qh4w1csYc/Di49Wf.3ITtCBw.7yc84Cc9NRi3

MemberController.class
if (!bCryptPasswordEncoder.matches(truePassword, user.getPassword())) {
if (!bCryptPasswordEncoder.matches(truePassword, user.getPassword())) {

BCryptPasswordEncoder() 메서드를 추적하여 spring-security-core-5.3.6.RELEASE.jar/org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder에 도달했습니다

mvn pom.xml

root@kitploit:~
<!-- https://mvnrepository.com/artifact/org.springframework.security/spring-security-core -->
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-core</artifactId>
    <version>5.3.6.RELEASE</version>
</dependency>

xbootPwdEncode.java

root@kitploit:~
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.security.crypto.bcrypt.BCrypt;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

import java.security.SecureRandom;
import java.util.regex.Matcher;
import java.util.regex.Pattern;


public class xbootPwdEncode implements PasswordEncoder {
    private Pattern BCRYPT_PATTERN;
    private final Log logger;
    private final int strength;
    private final BCryptPasswordEncoder.BCryptVersion version;
    private final SecureRandom random;

    public xbootPwdEncode() {
        this(-1);
    }

    public xbootPwdEncode(int strength) {
        this(strength, (SecureRandom) null);
    }

    public xbootPwdEncode(BCryptPasswordEncoder.BCryptVersion version) {
        this(version, (SecureRandom) null);
    }

    public xbootPwdEncode(BCryptPasswordEncoder.BCryptVersion version, SecureRandom random) {
        this(version, -1, random);
    }

    public xbootPwdEncode(int strength, SecureRandom random) {
        this(BCryptPasswordEncoder.BCryptVersion.$2A, strength, random);
    }

    public xbootPwdEncode(BCryptPasswordEncoder.BCryptVersion version, int strength) {
        this(version, strength, (SecureRandom) null);
    }

    public xbootPwdEncode(BCryptPasswordEncoder.BCryptVersion version, int strength, SecureRandom random) {
        this.BCRYPT_PATTERN = Pattern.compile("\\A\\$2(a|y|b)?\\$(\\d\\d)\\$[./0-9A-Za-z]{53}");
        this.logger = LogFactory.getLog(this.getClass());
        if (strength == -1 || strength >= 4 && strength <= 31) {
            this.version = version;
            this.strength = strength == -1 ? 10 : strength;
            this.random = random;
        } else {
            throw new IllegalArgumentException("Bad strength");
        }
    }

    @Override
    public String encode(CharSequence rawPassword) {
        if (rawPassword == null) {
            throw new IllegalArgumentException("rawPassword cannot be null");
        } else {
            String salt;
            if (this.random != null) {
                salt = BCrypt.gensalt(this.version.getVersion(), this.strength, this.random);
            } else {
                salt = BCrypt.gensalt(this.version.getVersion(), this.strength);
            }

            return BCrypt.hashpw(rawPassword.toString(), salt);
        }
    }

    @Override
    public boolean matches(CharSequence rawPassword, String encodedPassword) {
        if (rawPassword == null) {
            throw new IllegalArgumentException("rawPassword cannot be null");
        } else if (encodedPassword != null && encodedPassword.length() != 0) {
            if (!this.BCRYPT_PATTERN.matcher(encodedPassword).matches()) {
                this.logger.warn("Encoded password does not look like BCrypt");
                return false;
            } else {
                return BCrypt.checkpw(rawPassword.toString(), encodedPassword);
            }
        } else {
            this.logger.warn("Empty encoded password");
            return false;
        }
    }

    @Override
    public boolean upgradeEncoding(String encodedPassword) {
        if (encodedPassword != null && encodedPassword.length() != 0) {
            Matcher matcher = this.BCRYPT_PATTERN.matcher(encodedPassword);
            if (!matcher.matches()) {
                throw new IllegalArgumentException("Encoded password does not look like BCrypt: " + encodedPassword);
            } else {
                int strength = Integer.parseInt(matcher.group(2));
                return strength < this.strength;
            }
        } else {
            this.logger.warn("Empty encoded password");
            return false;
        }
    }

    public static enum BCryptVersion {
        $2A("$2a"),
        $2Y("$2y"),
        $2B("$2b");

        private final String version;

        private BCryptVersion(String version) {
            this.version = version;
        }

        public String getVersion() {
            return this.version;
        }
    }

    public static void main(String[] args) {
        // 단일 비밀번호 암호화, 예: $2a$10$ClRDFgxsGy78DcSi5kE8Zeu.jAfOlxxsqixMd7bsoP4enr.Msd1MC
        System.out.println(new xbootPwdEncode().encode("123456"));
        // 현재 암호화된 비밀번호가 평문 비밀번호와 일치하는지 확인하여 부울 타입 값 true를 출력
        System.out.println(new xbootPwdEncode().matches("123456", "$2a$10$7PocfErZodpsp8rK7j8nv.RK1Hn783EyU2YIowuTZkPQdjatp9riK"));


    }
}

image

root@kitploit:~
$2a$10$7PocfErZodpsp8rK7j8nv.RK1Hn783EyU2YIowuTZkPQdjatp9riK
\__/\/ \____________________/\_____________________________/
Alg Cost      Salt                        Hash
root@kitploit:~

>>> "$2a$10$7PocfErZodpsp8rK7j8nv.RK1Hn783EyU2YIowuTZkPQdjatp9riK"[0:3]
'$2a'
>>> "$2a$10$7PocfErZodpsp8rK7j8nv.RK1Hn783EyU2YIowuTZkPQdjatp9riK"[3:6]
'$10'
>>> "$2a$10$7PocfErZodpsp8rK7j8nv.RK1Hn783EyU2YIowuTZkPQdjatp9riK"[6:29]
'$7PocfErZodpsp8rK7j8nv.'
>>> "$2a$10$7PocfErZodpsp8rK7j8nv.RK1Hn783EyU2YIowuTZkPQdjatp9riK"[29:60]
'RK1Hn783EyU2YIowuTZkPQdjatp9riK'
>>>

참고 링크: https://en.wikipedia.org/wiki/Bcrypt

root@kitploit:~
$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
\__/\/ \____________________/\_____________________________/
Alg Cost      Salt                        Hash
도구 다운로드