#!/usr/bin/env python3
"""Show that a masked token is not anonymous once the salt is known.

The tool hardcodes its salt in source, so treat it as known. HMAC is one-way
with respect to the key, but the input space (IPv4) is only 2^32, so we can
enumerate it forward until a candidate IP reproduces the target token.
"""
import hmac
import hashlib
import ipaddress
import time

SALT = b"enterprise-siem-secret-salt-2026"   # hardcoded in the tool's file/stdin path
TARGET = "2dd80147"                            # pub-ip token from the sanitized output


def tok(ip):
    return hmac.new(SALT, ip.encode(), hashlib.sha256).hexdigest()[:8]


# 1) Targeted recovery: scan one /24 and recover the real IP behind the token.
t0 = time.time()
hit = None
for host in ipaddress.ip_network("185.220.101.0/24"):
    if tok(str(host)) == TARGET:
        hit = str(host)
        break
print(f"[recovery] token pub-ip:{TARGET}  ->  {hit}   ({time.time() - t0:.3f}s over a /24)")

# 2) Throughput: time 1,000,000 HMACs to extrapolate the full-IPv4 cost honestly.
n = 1_000_000
t0 = time.time()
for i in range(n):
    tok(f"10.0.{(i >> 8) & 255}.{i & 255}")
rate = n / (time.time() - t0)
full = 2 ** 32 / rate
print(f"[throughput] {rate:,.0f} HMAC/s single-thread  ->  full 2^32 IPv4 space ~{full / 60:.1f} min")