I've created a competition for a few friends of mine that wanted to learn the basics of penetration testing. In said competition, there is one section in which there's a log file you need to check out to find and submit the flag. Since I don't want the players simply looking at the source code and getting the password, and I won't obfuscate the code (I could, I just don't really want to. Not out of laziness, but to not confuse any n00bs). So what I did was encrypted the password with a different site in SHA512 and made it so if you guess a password, it will encrypt it in SHA512 and check whether it's correct or not. Source code for JavaScript is on http://vulnerablesite.freecluster.eu/BoooogityBooogityBOOOO.js Entire WarGame (CTF Hacking Challenge that's 24/7): vulnerablesite.freecluster.eu


This might work for a game, but it's by no means secure. Use Scrypt or Argon2 for a secure password hashing function. SHA-512 is a general-purpose hash function, it's very fast and uses little memory. For password hashing you want tuneable performance (to slow down brute force) in both time and memory. You also need a unique salt for each password. In your case it sounds like there's only one password, so a salt is less useful, but it's better to get in the habit of doing things properly.

  • $\begingroup$ A salt would also protect against a dictionary lookup, aside from the presumably compromised database. One can argue it is still very useful. $\endgroup$ – Ruben De Smet Sep 15 '17 at 7:47
  • $\begingroup$ Thanks, but why'd my question get down voted so much? $\endgroup$ – The Gamer King Sep 15 '17 at 13:33
  • $\begingroup$ Perhaps the downvotes are due not understanding password security, that no simple hash is sufficient secure as a password verifier. $\endgroup$ – zaph Sep 15 '17 at 14:55
  • $\begingroup$ I think it's mostly due to not understanding the difference between encryption, encoding and hashing (which is the key to your question!), and thinking that Javascript has anything to do with it. $\endgroup$ – Ruben De Smet Sep 15 '17 at 15:39
  • $\begingroup$ @RubenDeSmet and true but isn't learning what stack exchange is about, not chastising for asking questions. It may be the basics of password security, but I'm still learning. i also created that site to learn about the basics of cyber security, not to be secure. $\endgroup$ – The Gamer King Sep 18 '17 at 17:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.