Re: Re: Re: Encrypting cc_number in uc_payment_credit table.

Posts: 1300
Joined: 08/14/2007
Bug FinderEarly adopter... addicted to alphas.Getting busy with the Ubercode.

Okay, I threw the crypt / decrypt files onto my server. Check them out here:

http://shop.rifftrax.com/crypt.php
http://shop.rifftrax.com/decrypt.php

For testing values I'm using a bogus card number: 4111222233331234
This value is stored in the first line of crypt.php for the time being.

You can refresh the page and find random hashes for the card number (or whatever number you like stored in the $cc_num variable - hard coded for this test) and then plug the Base64 encode of the md5-block-cipher style encoded value (all 88 characters including the trailing periods) into the form field, and hit decrypt. Voila! You're back to the bogus card number.

(The secret is the passphrase that needs to be stored in a central location somewhere).

I can PM you the code if you want, I'm not sure I want to post it in the open forum.

Erik

UPDATE: Added the last four digits version of the card. You can paste that encoded value into the decryption form and it will return the correct value as well.

--

"Pain don't hurt." - Dalton

Mike Nelson's RiffTrax! www.rifftrax.com