John and hashcat: password hashes and storage security
How passwords are stored, weak hashes, policy and slow hashing.
Level 201 · 16 lessons · 15 practice labs
Lessons
How passwords are stored
- How passwords are stored: plaintext, hashes, salts: You will understand the difference between storing passwords as plaintext, as hashes and with salts, and which one is safe.
- Recognising hash types with hashid and hashcat: You will recognise common hash types and learn how to weed out the old, weak ones from your systems.
- Salts and peppers: You will understand what salts and peppers are for, where they are kept, and what they add to password protection.
- hashcat and slow hashing: bcrypt, scrypt, argon2: You will learn why slow hashing such as bcrypt, scrypt and argon2 protects passwords better, and how to choose well.
- Short task: identify the type and resilience of five hash samples
Auditing password strength
- Auditing the password hashes on your own system with John (lab): You will audit the password hashes on your own lab system and report weak passwords and weak storage methods.
- Measuring password strength with John and fixing the policy: You will learn ways to measure password strength and fix the password policy based on the results.
- hashcat: common password lists and why user passwords are weak: You will understand why common password lists work and why users pick guessable passwords, and take steps against it.
- hashcat rules: blocking predictable password patterns by policy: You will see with hashcat rules why patterns like adding a year or an exclamation mark are easy to guess, and update your policy.
- Organisation-specific word lists and password ban lists with CeWL: You will build a word list from your organisation’s website with CeWL and add it to a ban list to block guessable passwords.
- Reporting password audit results without exposing individuals
- Short task: audit the password hashes of the lab directory and write a policy recommendation
Afterwards
- After a breach: forcing password resets: You will plan how to inform users and force password resets when a password database has leaked.
- Password managers and multi-factor authentication: You will see how password managers and multi-factor authentication give employees a safe and easy routine.
- Recovering a forgotten-password archive with authorisation: zip2john: With written permission, you will extract a forgotten company archive’s hash with zip2john, recover it with John and document the process.
- Capstone: a password storage review with John and hashcat: In the capstone you will review how a fictional company stores passwords and report the weak points and recommended fixes.
Practice labs
- Identify the type and resilience of five hashes: Identify the algorithm of five sample hashes in the lab and mark each as weak, medium or strong for password storage.
- List the password hash algorithms on this server: Work out which account uses which algorithm in the lab server's shadow file and report accounts still on an old algorithm.
- Determine how an application database stores passwords: Inspect the password column in Göktaşı Yazılım's lab database, determine the algorithm and whether a salt is used, and write it up as a finding.
- Measure the effect of the bcrypt cost setting: Time hash generation at different cost values and write the recommended value for the lab app with your reasoning.
- Tune Argon2 parameters to the server's capacity: Try memory, time and parallelism settings on the lab server, pick the strongest setting that keeps login time reasonable and apply it.
- Migrate legacy hashes to a strong algorithm at login: Change the lab app so legacy fast hashes are upgraded to a strong algorithm as users log in, and measure the share of migrated accounts.
- Measure whether passwords on your own lab system meet policy: Test the lab server's password hashes with John under an authorised audit and calculate the share of accounts guessed quickly.
- Report the share of accounts that fall to a common-password list: Measure Kuzeyyıldızı Kargo's lab hashes against a common-password list and report the result as a percentage without naming anyone.
- Audit the password hashes and write a policy proposal: Audit the hashes in the lab directory, group the root causes of weakness and prepare a policy change proposal backed by the measurements.
- Count passwords that follow a season-and-year pattern: Find the share of passwords made of a season name and year in the audit results and add the pattern to the banned list.
- Build a banned list from company-specific words: Collect company words from Ilgıntepe Tekstil's lab website, turn them into a banned list and verify it is enforced.
- Block the patterns that guessing rules catch through policy: Identify the top five patterns caught by rule-based measurement, write a policy rule for each, apply them and repeat the measurement to show the change.
- Force a reset on accounts affected by a leak: Identify lab accounts on the leak list, require a password change at next login and verify the status.
- Recover a forgotten archive password with the owner's consent: Recover the password of Erguvan Sigorta's encrypted lab archive under written consent, log the time taken and write an archive encryption recommendation.
- Run an end-to-end password storage audit and report it: Measure algorithm, cost, salt and password quality on the lab system, apply fixes and deliver a before-and-after report.
About this course
How passwords are stored, weak hashes, policy and slow hashing.
What you will learn
- How passwords are stored
- Auditing password strength
- Afterwards
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.