hp's Quick Test Professional(QTP) Practise Examples Materials Tutorials Papers: Decrypt an Encrypted Password

It is well known that recording a login sequence results in code similar to this:

Login Script    
        1
    2
3
    4
5
    with Browser("Gmail").Page("Gmail")  
    .WebEdit("Email").Set "mygmail@gmail.com"  
.WebEdit("Passwd").SetSecure "5068b16874876c920b65d2036ace62c8103fecd0bbf8b7bfc7d2"  
    .WebButton("Sign in").Click  
end with

Where QTP uses the SetSecure method for the Password field and records the encrypted string that represents our raw input password. One frequent question asked in forums is how is it possible to decrypt such a string. QTP's Crypt object cannot help us here, as the only method known to us is Encrypt.

A well known solution is by using the SetSecure method on a WebEdit of type text with the encrypted string as value. As a result, we should be able to view the decrypted password as the value of the WebEdit. This solution works, but does not fit for automation. I will suggest here a simple method to Decrypt an Encrypted string (usually a password) automatically.

First, we need to define a WebEdit on our local machine:

Decryptor WebEdit    
        1
    2
3
    4
5
    6
7
    8
9
    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">  
    <html>  
<head>  
    <title>Decrypt by Meir Bar-Tal - AdvancedQTP.com</title>  
</head>  
    <body>  
<input id="decrypt" type="text" size="128"/>  
    </body>  
</html>

For the sake of the demonstration, let us assume that we save this html file in: C:\Decryptor\Decryptor.html.

Second, we will define our Decrypt method. Recall that using SetSecure with a regular (non-password type) WebEdit reveals the original (decrypted) text. Here it goes:

Decrypt Function    
        1
    2
3
    4
5
    6
7
    8
9
    10
11
    12
    Function Decrypt(sEncryptedString)  
    dim oDecryptor, oIEApp</p>  
set oIEApp = createobject("InternetExplorer.Application")  
    oIEApp.visible = false  
oIEApp.navigate "C:\Decryptor\Decryptor.html"  
    set oDecryptor = browser("name:=Decrypt.*").Page("title:=Decrypt.*").WebEdit("html id:=Decrypt")  
oDecryptor.SetSecure sEncryptedString  
    Decrypt=oDecryptor.Object.value  
oIEApp.quit  
    set oDecryptor=nothing  
set oIEApp = nothing  
    End Function

Actually the idea is very simple. We launch an invisible Browser and navigate to our local page that includes a regular WebEdit (tag input, type text). Then, we get a reference to this WebEdit using Descriptive Programming (DP) and call its SetSecure method, passing our encrypted string. Immediately after that, we assign our function the new value of the WebEdit so that it is returned. Finally, we clean up by closing the browser and setting the variables to nothing.

Here is an example of a call to our Decrypt method using the encrypted string of "mypassword":

Using the Decrypt Function    
        1
    2
3
    4
5
    6
7
    8
9
    10
    dim rawStr, encryptedStr, decryptedStr  
      
rawStr = "mypassword"  
    encryptedStr = Crypt.Encrypt(rawStr)  
decryptedStr=Decrypt(rawStr)  
    If decryptedStr = rawStr  Then  
reporter.ReportEvent micPass, "Decrypt", decryptedStr & " is equal to " & rawStr  
    else  
reporter.ReportEvent micFail, "Decrypt", decryptedStr & " is not equal to " & rawStr  
    End If

Enjoy decrypting… automatically!

Important Notes:

The Crypt.Encrypt method gives the same result as a password type WebEdit SetSecure method.
The suggested method is not meant to encourage hacking applications. Keep in mind that passwords are confidential and should not be compromised.
The suggested method exposes what may be considered a security breach. Perhaps HP should consider filtering or blocking the SetSecure method for non-password WebEdit objects

hp's Quick Test Professional(QTP) Practise Examples Materials Tutorials Papers

Pages

Decrypt an Encrypted Password

No comments:

Download QTP and Manual Testing Materials and QTP scripts