[Serious_Cheese]

I got frustrated trying out different passwords, so I looked at the source code.

The username is "anne.kingston". I found the password hash, but not sure how to go back to get the password itself.

Password hash: (hashy == "3880" && saltedhashy == "2425")

The hash is computed in a loop as: `prehash += (s[i].charCodeAt() * (i+1));`

I'm not sure how to go reverse this. Maybe someone can help?

Here's a tuple of passwords tried and their hash and salthash:

(Password, Hash, Salthash)

(daniel, 8221, 2197)

(hello, 7004, 3970)

(password, 3970, 1268)

(123, 302, 4415)

(something, 4814, 2749)

[GekkePrutser]

Yeah the JS gives some snide comments about this being the 'creative' way. But this is what I like about pentesting. There is no good or bad way. If you get stuck, try something else. Any way you can break the system is a good one.

[umvi]

just brute force it. With a hash that small there's bound to be tonnes of collisions