Collaborate Disseminate
How do different secret-key algorithms generate the same data?
In the snippet below, I use PBEWithMD5AndDES to produce one key, and PBEWithHmacSHA256AndAES_256 to produce another key, but with the same password. How is backwards compatibil… Continue reading How do different secret-key algorithms generate the same data?
I have developed an Excel spreadsheet to compare lists of SHA-512 hashes from two separate drives. One drive is the source data drive on a Windows machine. The other is a backup of that drive, connected to a Linux machine. I obtain the has… Continue reading Hash-Based Technique to Detect Ransomware Corruption on the Fly?
I’m working with some middleware that requires username/password authentication. The middleware uses MD5 hash for the password. The MD5 hash, of course, is not fit for the purpose of storing passwords. We need to address this.
We tried mod… Continue reading Is it safe to store a password using a secure hash followed by an insecure hash?
I am currently generating a salted SHA 256 passwords in the below format
$hash = "{SHA256}".base64_encode(hash(‘sha256’, $password . $salt) . $salt) .
Using the below libraries of Java classes to generate.
java.security.MessageD… Continue reading How different ldap implementations are generating random salt?
I have a SSHA256 hashed password. Below is the plaintext and hashed password for it.
PlainText -p@ssw0rd
Encrypted -{SSHA256}LGkJJV6e7wPDKEr3BKSg0K0XDllewz9tvSNSaslDmIfPFmyuI5blUK/QsTXjvgFKLlMQm1jPC7K7z/KaD4zoHQ==
How can I extract salt f… Continue reading How can I extract salt from encoded base64 Salted SHA 256 hashed password
I’m pentesting a system (call it X) which uses an internal secret key. Due to weaknesses in the crypto, I can determine:
The SHA1 hash of the key (stored as a checksum)
With high probability, the value of any byte of the key
The len of t… Continue reading Using John or hashcat when password stub is leaked by weak crypto
This is a cryptographic challenge I was given:
I have a list of 1000 hashed email addresses where I know the domain name for them (eg. "@gmail.com").
According to hashes.com:
Possible algorithms:
SHA1, SHA1(UTF16-LE($plaintext))… Continue reading Find pre-images of hashed email addresses
I’m relatively new to the CTF scene and I’m stuck on this one. I need to get access to a file named "top_secret" and the only helpful info I got was:
15.12.1993: BUG: all changes are only temporary … will fix this after x-mas
… Continue reading How to create Filenames with hash collisions? [closed]
I am building an web service where I handle user data and security is the top and main concern. To store my passwords, I have decided on a algorithm which takes a little longer at runtime than I want. I am using AWS Lightsail for hosting m… Continue reading Should I isolate my password hashing algorithms in another server to decrease CPU stress?
This is just a thought experiment. I am trying to get an understanding on when we need password hashing functions and when they don’t bring any benefits (eg. to save on calculation cost).
I know that password-hashing-functions are to be us… Continue reading What is the best way to store the verifyer for posession of a high entropy secret?