Access, Credentials, and Why Hashes Matter

Guessing, as this course uses the word, is trying candidate secrets against an authentication prompt: a login form, an SSH password prompt, a local account unlock. Each try is visible to the defender if logging is on. Rate limits, lockouts, and CAPTCHAs exist because online guessing is noisy. That noise is the point of the distinction. A lab that “practices guessing” against a café portal, a school SSO, or a neighbor's mail is unauthorized access, not homework. If you need to feel a prompt, you use an account YOU created on a machine YOU own — and even then this lesson does not give you a spray list, a hydra command, or a credential-stuffing script. The literacy is: guessing is try-secret-at-the-door. It is not stealthy. It is not a hash file. It is not MFA.

Credential stuffing is a sibling of guessing: reused passwords from some other breach, tried at a new door. Unique passwords kill that path for the accounts you control. A password manager is how humans keep unique secrets without a sticky note. Writing “password123” in five places is how stuffing works even when none of those sites “cracked cryptography.” The failure is reuse, not a missing exploit. You already practiced unique secrets as hygiene in earlier topics. Module 6 only needs you to put that hygiene next to the exam word “gaining access” and refuse the movie version where one guessed string opens the planet.

cat >> "$NOTES" << 'EOF'
online_guess: many tries at a live login — still needs authorization
refuse: hydra 192.168.0.1, cafe portal, campus login
this_lesson: define the idea; do not spray
EOF

A password hash stored by a system is a verifier: given a candidate password, the system hashes it (with salt and a slow KDF if the designers were not asleep) and compares. Topic 8: the digest is one-way. There is no key that turns SHA-256 hex back into the passphrase. “Matching a hash” means a candidate produced the same digest as the stored verifier. That is equality of inputs under a function, not decryption, and not “cracking the internet.” Fast unsalted hashes of short common words are guessable offline if someone already stole the table — that is why unique salts and slow password hashes exist. Slow salted storage raises the cost of each guess. It does not make theft legal. It does not make this course a cracking shop.

The stolen-file story and the guessing-at-the-prompt story part ways here. Offline work against a stolen verifier does not hit lockout on the live login — which is exactly why defenders assume dumps happen and design storage for that day. Cyberlium still does not hand you a dump, a shadow file, or a GPU cracker. You may hash a toy word YOU invented, on YOUR machine, to remember one-way (the code block does that and nothing else). You may not import HaveIBeenPwned. You may not read /etc/shadow “to see real hashes.” You may not point a cracker at a classmate's export. Matching your own toy digest is literacy. Matching other people's verifiers is an attack.

sudo apt install python3

brew install python3

python3 - << 'PY'
from pathlib import Path
import hashlib
p = Path.home() / 'cyberlium-lab' / 'toy-password-standin.txt'
h = hashlib.sha256(p.read_bytes()).hexdigest()
print('sha256', h)
print('meaning: fingerprint of MY bytes — not reversible, not hashcat, not a dump')
PY

Multi-factor authentication asks for a second category: something you have (a phone prompt, a hardware key, a TOTP app you control) or something you are (a platform biometric tied to that device), in addition to something you know. A stolen or guessed password then fails to finish the login if the second factor is still in the owner's hands. MFA is not a password replacement. It is not a bypass recipe. It is not “SMS is perfect.” It is a control that turns “I know the secret” into “I know the secret and I can prove the second factor.” Phishing-resistant factors (hardware keys, platform authenticators) beat emailed codes when you can turn them on. The lesson is to enable MFA on accounts YOU control — mail, cloud console, banking, Git hosts — not to design an MFA bypass against someone else.

A useful failure: a classmate says “hashes don't matter if MFA is on, so we can skip unique passwords.” Wrong. MFA can fail (fatigue, recovered sessions, a factor you enrolled on a lost phone, an account that never had MFA). Unique passwords still stop stuffing when MFA is missing or skipped. A password manager still stops reuse. Slow salted hashes still matter when a database leaks. Defenders stack controls. Exam language that lists “system hacking” as a phase is not a license to peel those controls in a lab on strangers. Your stack on YOUR accounts is the homework: unique secret, manager, MFA, and a hash story you can explain without a cracker.

A credential note is boring on purpose. Date (UTC). Three definitions in your words: guessing vs stolen verifier file vs MFA. Topic 8 carry: hash is one-way; matching is not cracking the internet. Defender lines: unique passwords, password manager, MFA on accounts you control. Ethics: no cracker, no shadow, no dump, no stuffing a neighbor. Empty files fail. Files that contain other people's hashes fail even if you “only looked.” chmod 600 under $HOME/cyberlium-lab so another local account does not read your lab tree — same hygiene as Topics 2, 7, 8 and Modules 2–5.

If you skip the toy hashlib line and only fill definitions, the lesson still holds — the Python is a reminder, not a trophy. If you feel the lesson is “too small” without a wordlist against a leak, that feeling is how people graduate into unauthorized cracking. The skill is stopping. Next lesson will make another stop: user is not admin just because a password worked.

On a computer you own, create cyberlium-lab if needed. Fill the notes. Optionally run the toy hashlib — it hashes a string you set in the file, prints the hex, and reminds you the function is one-way. It refuses to read a path. It is not a cracker. chmod 600. Do not add a dump “to make it real.”

You now keep three access stories uncollapsed: guessing at a prompt, a stolen verifier file, and MFA as a second door. A hash stays one-way; matching your own toy digest is not a planetary crack. Unique passwords, a manager, and MFA are the stack on accounts you control. Notes are locked in cyberlium-lab. This is original Cyberlium teaching mapped to a CEH v13 domain — not official EC-Council training, not a cert, not exam dumps. Next — Privilege Levels Without Exploit Recipes — user vs admin as a control, not a kernel walkthrough.