[CHALLENGE] - Hashing without a salt about damnvulnerablecryptoapp HOT 3 CLOSED

For this example, and to make it look like a real attack/vulnerability, you could make it like a DB dump full of hashes and have 5 users with the same password, including the Admin. To make it easier, the admin password should be 123456.

This makes the exercise simple and manageable. You only need to notice the same hash on several users and know what are the most common passwords.

from damnvulnerablecryptoapp.

@AVBC-Sec sounds good.
We already have a similar scenario in the weak hashing challenge, a DB dump with some hashed credentials.
So I would recommend having a similar case but witha PHPmyadmin like system, where you can query some tables and eventually see the user hashes. Just to try to make it a little bit different.

Also the action to submit the solution to the challenge could be logging into that system as admin

from damnvulnerablecryptoapp.

Will not implement this for now...

Weak hashing doesn't use salt either, and as an easy and reliable challenge we should not use

from damnvulnerablecryptoapp.