-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy pathBreachCheckAPI.java
More file actions
243 lines (215 loc) · 8.26 KB
/
Copy pathBreachCheckAPI.java
File metadata and controls
243 lines (215 loc) · 8.26 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
import org.apache.commons.codec.digest.DigestUtils;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.net.URL;
import java.net.URLConnection;
/**
* @author jet kai
* @version 4_24042021 - JDK 1.8
*/
public class BreachCheckAPI {
private String password = ""; //CHANGE ME
private String hashType = "SHA-1"; //MD5, SHA-1, SHA-256, SHA-512 & PLAIN-TEXT
private boolean usingHttps = true; //true = HTTPS, false = HTTP
private final String apiUrl = "api.rsps.tools/jetkai/breachcheck"; //DO NOT CHANGE
private final String token = "39439e74fa27c09a4"; //DO NOT CHANGE
private String returnedJson = ""; //Data that is returned from the api
/**
* Main void (if running from IDE or shell for testing)
* @param args - Can parse password as args[0] and hashType as args[1]
*/
public static void main(String[] args) {
BreachCheckAPI bca = new BreachCheckAPI();
if(args.length > 0)
bca.setPassword(args[0]);
if(args.length > 1)
bca.setHashType(args[1]);
if(args.length > 2)
bca.setUsingHttps(Boolean.parseBoolean(args[2]));
bca.initExample();
}
/**
* This is an example of how you can call the methods for checking if your password is breached
*
* You can also call (from another class):
* BreachCheckAPI bca = new BreachCheckAPI();
* bca.setPassword("password123");
* bca.setHashType("SHA-256");
* boolean breached = isBreached();
*/
public void initExample() {
String checkField = checkFields();
if (checkField.length() > 0) { //Checks if password or token field is empty
System.err.println(checkField);
return;
}
//setPassword("password123"); <-- You can set from another class, before calling isBreached()
//setHashType("SHA-1"); <-- You can set from another class, before calling isBreached()
//setUsingHttps(false); <-- You can set from another class, before calling isBreached()
boolean isBreached = isBreached();
boolean hasReturnedJson = getReturnedJson().length() > 0;
if(isBreached && hasReturnedJson)
System.err.println("You have been breached : " + getReturnedJson()); //Outputs JSON to console
else if(!isBreached && hasReturnedJson)
System.out.println("You have not been breached : " + getReturnedJson()); //Outputs JSON to console
}
/**
* Sends HTTP Request to return data
* @return The data from HTTP Request and checks if it contains "breached":true
*/
public boolean isBreached() {
connect();
return getReturnedJson().contains("\"breached\":true"); //Extremely basic check, use JSON Parser if needed
}
/**
* Sends HTTP Request to the API, setting the returnedJson string with returned JSON data
*
* URL Request Example:
* https://api.rsps.tools/jetkai/breachcheck?token=39439e74fa27c09a4&hash=ed8779a2222dc578f2cffbf308411b41381a94ef25801f9dfbe04746ea0944cd
*
* Returned JSON Data Example:
* {
* "token": "39439e74fa27c09a4",
* "hash": "ed8779a2222dc578f2cffbf308411b41381a94ef25801f9dfbe04746ea0944cd",
* "hashPos": 2,
* "severity": "Top 100 Common Passwords",
* "databaseBreach": "Stoned 2021 ~800K Unique Passwords (15+ RSPS Databases)",
* "hashType": "SHA-256",
* "breached": true
* }
*/
public void connect() {
try {
URL url = new URL(
(isUsingHttps() ? "https://" : "http://") +
getApiUrl() +
"?token=" + getToken() +
"&" + getHashOrPassword() + "=" + getHashedPassword());
URLConnection con = url.openConnection();
con.setConnectTimeout(3000);
con.setReadTimeout(3000);
con.setRequestProperty("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0");
InputStream ins = con.getInputStream();
InputStreamReader isr = new InputStreamReader(ins);
BufferedReader bin = new BufferedReader(isr);
setReturnedJson(bin.readLine());
bin.close();
} catch (IOException io) {
System.err.println(io.getMessage());
}
}
/**
* Hex's the plain-text password, either using:
* MD5, SHA-1, SHA256
* @return The hexed password, fallsback to plain-text if an incorrect hashType is set
*/
private String getHashedPassword() {
switch (getHashType().toUpperCase()) {
case "MD5":
return DigestUtils.md5Hex(getPassword());
case "SHA-1":
return DigestUtils.sha1Hex(getPassword());
case "SHA-256":
return DigestUtils.sha256Hex(getPassword());
case "SHA-512":
return DigestUtils.sha512Hex(getPassword());
}
return getPassword(); //PLAIN-TEXT
}
/**
* This is checking the hashType and returning as string
* @return Either "hash" or "password", depending if the password is plain-text or hexed
*/
private String getHashOrPassword() {
String[] hashTypes = new String[]{"MD5", "SHA-1", "SHA-256", "SHA-512"};
for(String hashType : hashTypes) {
if(hashType.equalsIgnoreCase(getHashType()))
return "hash"; //Used for MD5, SHA-1, SHA-256 & SHA-512
}
return "password"; //Used for PLAIN-TEXT
}
/**
* Checks Fields
* @return The string output if the password /or token field is null/empty
*/
private String checkFields() {
if(getPassword() == null || getPassword().length() == 0)
return "Password field can't be empty";
else if(getToken() == null || getToken().length() == 0)
return "Token field can't be empty";
return "";
}
/**
* Sets the password or hash that would be checked, before isBreached() is called
* @param password - password123 : cbfdac6008f9cab4083784cbd1874f76618d2a97
*/
public void setPassword(String password) {
this.password = password;
}
/**
* Sets the hashType that is needed for the HTTP Request to either request:
* /breachcheck?hash= (for MD5, SHA-1, SHA-256 & SHA-512) or /breachcheck?password= (for plain-text)
* @param hashType - MD5, SHA-1, SHA-256, SHA-512 PLAIN-TEXT
*/
public void setHashType(String hashType) {
this.hashType = hashType;
}
/**
* Sets the returnedJson string, used in connect() - BufferReader
* @param returnedJson - Expecting a JSON string, will return black if failed to gather data
*/
public void setReturnedJson(String returnedJson) {
this.returnedJson = returnedJson;
}
/**
* Sets usingHttps, used in connect() - Establish connection
* @param usingHttps - Set as true or false, depending if you want to establish a https:// (as true) or http:// (as false) protocol
*/
public void setUsingHttps(boolean usingHttps) {
this.usingHttps = usingHttps;
}
/**
* Gets the password as string
* @return The hash or password
*/
public String getPassword() {
return password;
}
/**
* Gets the token as string
* @return The token used for the API request
*/
public String getToken() {
return token;
}
/**
* Gets the API Url as string
* @return The URL before params are added - https://api.rsps.tools/jetkai/breachcheck
*/
public String getApiUrl() {
return apiUrl;
}
/**
* Gets the hashType as string
* @return MD5, SHA-1, SHA-256, SHA-512 or PLAIN-TEXT - depending on the data inside getPassword()
*/
public String getHashType() {
return hashType;
}
/**
* Gets the returnedJson as a string, used in isBreached()
* @return The data that was obtained from connect()
*/
public String getReturnedJson() {
return returnedJson;
}
/**
* Gets the usingHttps as a boolean
* @return true or false, depending if the user wants to use HTTPS for connect();
*/
public boolean isUsingHttps() {
return usingHttps;
}
}