Unit 7: Logins, MFA and tokens · Lesson 2 of 7 · 22 min
Storing passwords
Salted, slow hashes turn a stolen database into a puzzle instead of a list of passwords.
mission
- You are
- The analyst reviewing the shop's password storage.
- Situation
- Engineering exported the account table into
review/accounts-export.csvfor you. Some accounts date back to an old system. - Goal
- Find out which hashing schemes are in use and which accounts are weak.
- Hand in
- A list of weak accounts and a migration plan.
Password storage as a salt mill
Look at the export
head -n 3 accounts-export.csv
user,role,password_hash
learner,customer,pbkdf2_sha256$600000$q2Vt8k1sR9mZ$ObOoXw2Lu84Fh+C0wkMbWgSyKaZD+KLIFo3ynohSNYk=
tester,customer,pbkdf2_sha256$600000$Lw4nB7cXe2Ra$jozcELA8UNnyPOEQ469I4HjgU4B6iHZvCxBd1yiDeZc=
you should see Algorithm, iterations, salt and hash, joined with $.
head- Prints the first lines of a file or of piped text. Built into Linux and macOS.
Count schemes
cut -d, -f3 accounts-export.csv | cut -d'$' -f1 | sort | uniq -c
3 md5
1 password_hash
4 pbkdf2_sha256
you should see Most accounts use PBKDF2. Three use plain MD5.
cut- Keeps only chosen columns or characters from each line. Built into Linux and macOS.
sort- Sorts lines of text. Built into Linux and macOS.
uniq- Collapses repeated neighbouring lines. With -c it counts them. Built into Linux and macOS.
Find shared hashes
Without a salt, the same password gives the same hash. Duplicates give that away instantly.
cut -d, -f3 accounts-export.csv | sort | uniq -d md5$$5f4dcc3b5aa765d61d8327deb882cf99 grep 5f4dcc3b accounts-export.csv | cut -d, -f1 old_sales old_support
you should see One hash used by two accounts.
grep- Prints the lines of text that match a pattern. Built into Linux and macOS.
See why fast hashes fail
python3 -c "import hashlib; print(hashlib.md5(b'password').hexdigest())"
5f4dcc3b5aa765d61d8327deb882cf99
you should see The exact hash the two accounts share. Their password is password.
defender tip Never test guesses against real staff hashes outside an approved engagement. In a real review, report the scheme and the duplicates; that is evidence enough.
python3- Runs Python code or a Python script. Built into most Linux systems. Otherwise from python.org.
Two stored passwords
md5$$5f4dcc3b5aa765d61d8327deb882cf99
Fast, unsalted, identical for every user with the same password.
pbkdf2_sha256$600000$q2Vt8k1sR9mZ$ObOoXw2L...
600000 rounds and a unique salt per account.
What a defender takes away
- 1Use a slow, salted algorithm: Argon2id, scrypt, bcrypt or PBKDF2 with high iterations.
- 2Rehash old accounts at their next sign-in; force a reset for ones that never return.
- 3Duplicate hashes are proof that salting is missing.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.