Unit 7: Logins, MFA and tokens · Lesson 2 of 7 · 22 min

Storing passwords

Salted, slow hashes turn a stolen database into a puzzle instead of a list of passwords.

mission

You are
The analyst reviewing the shop's password storage.
Situation
Engineering exported the account table into review/accounts-export.csv for you. Some accounts date back to an old system.
Goal
Find out which hashing schemes are in use and which accounts are weak.
Hand in
A list of weak accounts and a migration plan.

Password storage as a salt mill

01

Look at the export

learner@web-lab
head -n 3 accounts-export.csv
user,role,password_hash
learner,customer,pbkdf2_sha256$600000$q2Vt8k1sR9mZ$ObOoXw2Lu84Fh+C0wkMbWgSyKaZD+KLIFo3ynohSNYk=
tester,customer,pbkdf2_sha256$600000$Lw4nB7cXe2Ra$jozcELA8UNnyPOEQ469I4HjgU4B6iHZvCxBd1yiDeZc=

you should see Algorithm, iterations, salt and hash, joined with $.

02

Count schemes

learner@web-lab
cut -d, -f3 accounts-export.csv | cut -d'$' -f1 | sort | uniq -c
      3 md5
      1 password_hash
      4 pbkdf2_sha256

you should see Most accounts use PBKDF2. Three use plain MD5.

03

Find shared hashes

Without a salt, the same password gives the same hash. Duplicates give that away instantly.

learner@web-lab
cut -d, -f3 accounts-export.csv | sort | uniq -d
md5$$5f4dcc3b5aa765d61d8327deb882cf99
grep 5f4dcc3b accounts-export.csv | cut -d, -f1
old_sales
old_support

you should see One hash used by two accounts.

04

See why fast hashes fail

learner@web-lab
python3 -c "import hashlib; print(hashlib.md5(b'password').hexdigest())"
5f4dcc3b5aa765d61d8327deb882cf99

you should see The exact hash the two accounts share. Their password is password.

defender tip Never test guesses against real staff hashes outside an approved engagement. In a real review, report the scheme and the duplicates; that is evidence enough.

Two stored passwords

Old system
md5$$5f4dcc3b5aa765d61d8327deb882cf99

Fast, unsalted, identical for every user with the same password.

Current
pbkdf2_sha256$600000$q2Vt8k1sR9mZ$ObOoXw2L...

600000 rounds and a unique salt per account.

What a defender takes away

  1. 1Use a slow, salted algorithm: Argon2id, scrypt, bcrypt or PBKDF2 with high iterations.
  2. 2Rehash old accounts at their next sign-in; force a reset for ones that never return.
  3. 3Duplicate hashes are proof that salting is missing.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.