Lab — Hash Cracking Basics

You encode each candidate as UTF-8 bytes, hashlib.sha256(...).hexdigest(), compare to the target hex you produced from the same toy. No salt in this demo on purpose: Lesson 3 already showed that a unique salt means the naive loop must hash salt+word per row, and a slow KDF makes each guess expensive. Here the hash is fast and unsalted so eight comparisons finish before you blink. That is the uncomfortable lesson. Include password in the list even if your toy is something else: separately hash the literal b"password" and look it up so you see a famous short word is instantly findable IN THEIR LIST — not on the internet, not in a downloaded corpus. The list is five to ten words (eight is the target). You wrote every line. If the toy is missing from the list, the script should print that it was not found — that is a successful negative, not a reason to fetch rockyou.

hexdigest() is lowercase hex; if you paste a target, strip and lower it so comparison is not a case trap. Do not use MD5 for the main path “because it is shorter” — you may print MD5 of the same toy as a sidebar to remember Lesson 2 retired it for security, but the lookup you record is SHA-256. Do not call an online hash-lookup API. Do not install hashcat. Do not use hashlib to attack a login. The target variable is a hex you just printed from a word you chose. If a tutorial says paste hashes from a breach, that tutorial is not this lab.

Password cracking as an industry practice against stolen hashes is a different problem, a different authorization boundary, and out of this course. Rainbow tables are precomputed guess maps; you will not download them. /etc/shadow holds real account verifiers on a Unix system; you will not hash it, copy it, or point the script at it. HaveIBeenPwned and other dump sites are other people’s data; you will not import them to “make the lab realistic.” hashcat against those materials is forbidden here even as “just seeing how it works.” Coworker mailbox passwords, classmate hashes, and hexes from a paste site are forbidden. The only ethical target is a digest you created from a toy you put in a list you authored, on a machine you own, in cyberlium-lab.

Notes can mention the toy word because you invented it for class — still chmod 600 so a shared account does not read your lab tree, and still never reuse that toy as a real password. Do not put banking passwords in the list “so it is realistic.” Do not email the notes. If you cannot explain the lab without a dump, you have not met the mission. Topic 7 already used hashlib for integrity; this lab uses the same library to show a storage failure mode. Same function, opposite ethics if you aim it at victims. Aim it at your eight words.

Create wordlist.txt with eight lines you typed (include your toy and password). Run the script to print the toy’s SHA-256, then scan the list. Confirm the toy is found. Confirm a word you did not include is not found if you add a second target. Hash password and confirm it is found because it is in the list. Fill the notes. chmod 600 everything. Do not add a ninth million words from the internet.

mkdir -p "$HOME/cyberlium-lab"
cd "$HOME/cyberlium-lab"

cat > wordlist.txt << 'EOF'
password
admin
maple-toy
letmein
cyberlium
summerlab
guest
welcome
EOF

cat > hash_lookup_lab.py << 'PY'
import hashlib
from pathlib import Path

lab = Path.home() / "cyberlium-lab"
words = [
    line.strip()
    for line in (lab / "wordlist.txt").read_text(encoding="utf-8").splitlines()
    if line.strip()
]
if not 5 <= len(words) <= 10:
    raise SystemExit("wordlist must be 5–10 words you wrote (8 is the target)")

toy = "maple-toy"  # must appear in wordlist.txt — change both together
target = hashlib.sha256(toy.encode("utf-8")).hexdigest()
print("toy:", toy)
print("unsalted SHA-256:", target)

found = None
for word in words:
    digest = hashlib.sha256(word.encode("utf-8")).hexdigest()
    if digest == target:
        found = word
        break
print("lookup in MY list:", found if found else "not in this tiny list")

# Famous short word — instantly findable IN THIS LIST because you included it.
pw_hex = hashlib.sha256(b"password").hexdigest()
pw_hit = "password" in words and hashlib.sha256(b"password").hexdigest() == pw_hex
print("sha256(password) in MY list:", pw_hit)
print("ethics: my toy, my list; no dumps; no shadow; no hashcat")
PY

python3 hash_lookup_lab.py || python hash_lookup_lab.py

NOTES="$HOME/cyberlium-lab/hash-crack-lab-notes.txt"
{
  echo "=== HASH LOOKUP LAB (MY digest, MY 8-word list) ==="
  echo "toy_word: (I chose this; not a live password)"
  echo "toy_sha256:"
  echo "found_in_my_list: yes (toy was one of 8 words I wrote)"
  echo "sha256_of_literal_password_found_in_my_list: yes — short word, fast unsalted hash"
  echo "why: unsalted MD5/SHA-256 of short words is guessable against even a tiny list"
  echo "not_this_lab: hashcat, rainbow tables, /etc/shadow, HIBP dumps, other people's hashes"
  echo "storage_fix_from_L03: unique salt + bcrypt/Argon2/scrypt via a library"
} > "$NOTES"

chmod 600 "$HOME/cyberlium-lab/hash_lookup_lab.py" \
          "$HOME/cyberlium-lab/wordlist.txt" \
          "$NOTES"

You felt the storage failure on a digest you own: eight unsalted SHA-256 comparisons found a short toy because the toy was in a list you wrote, and password was findable for the same reason. That is why Lesson 3 demanded unique salts and slow KDFs — not why you download a dump. Integrity hashing (Topic 7, Lessons 1–2) and password storage stay different jobs. Next — Quiz — Hashing — ten APPLY items on properties, MD5/SHA-1/SHA-256, salt and slow hashes, and this lab’s ethics line. Then Module 2 opens Symmetric Encryption (AES). Still not a cracking shop.