-
-
Notifications
You must be signed in to change notification settings - Fork 395
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #321 from commjoen/master
Sync up
- Loading branch information
Showing
18 changed files
with
214 additions
and
31 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| # This is a basic workflow to help you get started with Actions | ||
|
|
||
| name: Dead Link Checker | ||
|
|
||
| on: | ||
| repository_dispatch: | ||
| workflow_dispatch: | ||
| push: | ||
| branches: [ master ] | ||
| pull_request: | ||
| branches: [ master ] | ||
|
|
||
| jobs: | ||
| linkChecker: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v3 | ||
|
|
||
| - name: Link Checker | ||
| id: lychee | ||
| uses: lycheeverse/lychee-action@v1.5.0 | ||
| with: | ||
| args: --exclude-all-private --exclude-file "config/.lycheeignore" -r 2 './**/*.md' './**/*.html' | ||
| fail: true | ||
|
|
||
| - name: Create Issue From File | ||
| if: steps.lychee.outputs.exit_code != 0 | ||
| uses: peter-evans/create-issue-from-file@v4 | ||
| with: | ||
| title: Link Checker Report | ||
| content-filepath: ./lychee/out.md | ||
| labels: report, automated issue |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| # Ignore all files | ||
| file://.* | ||
|
|
||
| # This is used as an example when creating a pull request | ||
| https://github.com/Your_Github_Handle.* |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
68 changes: 68 additions & 0 deletions
68
src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge18.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
| package org.owasp.wrongsecrets.challenges.docker; | ||
|
|
||
|
|
||
| import lombok.extern.slf4j.Slf4j; | ||
| import org.owasp.wrongsecrets.RuntimeEnvironment; | ||
| import org.owasp.wrongsecrets.ScoreCard; | ||
| import org.owasp.wrongsecrets.challenges.Challenge; | ||
| import org.owasp.wrongsecrets.challenges.Spoiler; | ||
| import org.springframework.beans.factory.annotation.Value; | ||
| import org.springframework.core.annotation.Order; | ||
| import org.springframework.security.crypto.codec.Hex; | ||
| import org.springframework.stereotype.Component; | ||
|
|
||
| import java.nio.charset.StandardCharsets; | ||
| import java.security.MessageDigest; | ||
| import java.security.NoSuchAlgorithmException; | ||
| import java.util.Base64; | ||
| import java.util.List; | ||
|
|
||
| import static org.owasp.wrongsecrets.RuntimeEnvironment.Environment.DOCKER; | ||
|
|
||
| @Component | ||
| @Order(18) | ||
| @Slf4j | ||
| public class Challenge18 extends Challenge { | ||
|
|
||
| private final String hashPassword; | ||
| private final String md5Hash = "MD5"; | ||
| private final String sha1Hash = "SHA1"; | ||
|
|
||
| public Challenge18(ScoreCard scoreCard, @Value("aHVudGVyMg==") String hashPassword) { | ||
| super(scoreCard); | ||
| this.hashPassword = hashPassword; | ||
| } | ||
|
|
||
| private String base64Decode(String base64) { | ||
| byte[] decodedBytes = Base64.getDecoder().decode(base64); | ||
| return new String(decodedBytes); | ||
| } | ||
|
|
||
|
|
||
| private String calculateHash(String hash, String input) { | ||
| try { | ||
| if (md5Hash.equals(hash) || sha1Hash.equals(hash)) { | ||
| var md = MessageDigest.getInstance(hash); | ||
| return new String(Hex.encode(md.digest(input.getBytes(StandardCharsets.UTF_8)))); | ||
| } | ||
| } catch (NoSuchAlgorithmException e) { | ||
| log.warn("Exception thrown when calculating hash", e); | ||
| } | ||
| return "No Hash Selected"; | ||
| } | ||
|
|
||
| @Override | ||
| public Spoiler spoiler() { | ||
| return new Spoiler(base64Decode(hashPassword)); | ||
| } | ||
|
|
||
| @Override | ||
| public boolean answerCorrect(String answer) { | ||
| return calculateHash(md5Hash, base64Decode(hashPassword)).equals(calculateHash(md5Hash, answer)) | ||
| || calculateHash(sha1Hash, base64Decode(hashPassword)).equals(calculateHash(sha1Hash, answer)); | ||
| } | ||
|
|
||
| public List<RuntimeEnvironment.Environment> supportedRuntimeEnvironments() { | ||
| return List.of(DOCKER); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| === Bad hashing | ||
|
|
||
| This developer has their password stored on their computer. They are no idiot, though, they have hashed it twice using the same systems many of the biggest companies in the world use. Just with a little less seasoning. Nobody is going to be able to crack this... | ||
|
|
||
| The first hash is `2ab96390c7dbe3439de74d0c9b0b1767` and the second hash is `F3BBBD66A63D4BF1747940578EC3D0103530E21D` | ||
|
|
||
| Despite many large companies using these hashes, is there a way beat the system? | ||
|
|
||
| Cracking either hash will give you the correct answer. As an extra challenge, try cracking both. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| This challenge is specifically looking at MD5 and SHA1 hashes without salting. Are these un-crackable? | ||
|
|
||
| You can solve this challenge using the following steps: | ||
|
|
||
| 1. For the first hash (MD5): | ||
| - Use a tool such as Hashcat: | ||
| - Install https://hashcat.net/hashcat/[Hashcat] | ||
| - Download the https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt[rockyou.txt password list] | ||
| - Run Hashcat on the hash `hashcat -m 0 "2ab96390c7dbe3439de74d0c9b0b1767" /path/to/file/rockyou.txt` | ||
| 2. For the second hash (SHA1): | ||
| - Use a tool such as Hashcat: | ||
| - Install https://hashcat.net/hashcat/[Hashcat] | ||
| - Download the https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt[rockyou.txt password list] | ||
| - Run Hashcat on the hash `hashcat -m 100 "F3BBBD66A63D4BF1747940578EC3D0103530E21D" /path/to/file/rockyou.txt` | ||
| 3. For either of the hashes: | ||
| - Use an online hash cracking service to do the heavy lifting for you: | ||
| - Visit `https://crackstation.net/` | ||
| - Enter the hash and click "Crack Hashes" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| *Why MD5 and SHA1 hashing alone are not enough.* | ||
|
|
||
| MD5 and SHA1 hash are no longer considered safe to store passwords on their own. Speed is what makes MD5 and SHA1 hashes so useful, but it is also their downfall. It only takes a few minutes to hash thousands of passwords; this also means that it only takes minutes to hash thousands of common passwords and use these hashes to compare against a hash that has been obtained. | ||
|
|
||
| Companies try different techniques to harden MD5 and SHA1 hashes, such as "salting" them. This is the process of adding additional characters to the password that only the person/company that should be decrypting knows. Unfortunately this is not enough either with the rise of GPU and ASIC based computations. Therefore, companies using these techniques can better migrate to https://en.wikipedia.org/wiki/Argon2[Argon2] or https://en.wikipedia.org/wiki/Balloon_hashing[Balloon hashing]. | ||
|
|
||
| As a user you often have no choice in how your passwords are stored; the only thing you can do in this case is try to make your password longer and more complex. A password SHA1 that is 7 characters long with upper and lowercase characters will take roughly a minute or 5 to brute force on a proper GPU, whereas one with 25 characters will take much longer. |
Oops, something went wrong.