Lab — File Integrity Hash Check

open(path, "rb") is required. Text mode would rewrite newlines on some platforms and change the digest. Read in chunks (8192 bytes is a teaching size) so a large ISO does not need to fit in RAM: h.update(chunk) in a loop until the empty bytes sentinel. You do not hash the filename. You do not hash a path string and call it file integrity. You hash the contents. hexdigest() is the usual printable form; digest() is raw bytes if you were storing packed — you will print hex. Comparison is string equality of two hexes you recorded, or hashing file A and file B and printing MATCH / DIFFER. Do not implement your own SHA-256. Do not use md5 for this lab as a “shortcut” — MD5 is still seen in old checksums, but the teaching primitive here is SHA-256.

A matching digest means the bytes you hashed now equal the bytes you hashed then (or equal the other file). It does not mean the file is safe, signed, or from a vendor. Malware can be hashed too; the digest would just be stable. Vendor comparison only works if you fetched the published hash from a channel you already trust (the vendor’s site you typed), not from a forum next to a cracked download. This lab does not require a vendor file. It requires a file you wrote, an edit, and two hexes that differ. If they do not differ after a real edit, you hashed the wrong path or you did not save the edit.

Password cracking tries guesses through a hash function to match a stolen password hash. Rainbow tables are precomputed guesses. That is a different problem, a different ethics line, and out of this course. hashlib in this lab is the same library a cracker might call, which is why the target file is the control: sample_auth.log, integrity-a.txt, a script you wrote — YOUR files. /etc/shadow, dumped SAM files, “rockyou,” and online hash databases are not lab inputs. If a tutorial tells you to crack NTLM with Python this week, that tutorial is not this lesson. Topic 8 will talk about hashes as crypto primitives without turning you into a cracking shop.

Also out: hashing other people’s documents to “see if they leaked,” scraping paste sites for hashes to attack, and shipping a recursive hasher over a directory you do not own. You may hash every file in cyberlium-lab because you created that tree. chmod 600 the notes that list paths and digests so a shared account does not silently copy your inventory. Empty notes fail. Notes that contain password guesses or shadow lines fail ethics even if SHA-256 ran.

Create integrity-demo.txt, hash it, append a line, hash it again. Optionally hash sample_auth.log as a second file so you see two different digests for two different byte strings. Fill the notes. Do not add a password list to make it “more security.”

mkdir -p "$HOME/cyberlium-lab"
cd "$HOME/cyberlium-lab"

cat > hash_file.py << 'PY'
import hashlib
import sys

def sha256_file(path):
    h = hashlib.sha256()
    with open(path, "rb") as f:
        for chunk in iter(lambda: f.read(8192), b""):
            h.update(chunk)
    return h.hexdigest()

path = sys.argv[1] if len(sys.argv) > 1 else "integrity-demo.txt"
print(path)
print(sha256_file(path))
PY

printf '%s
' 'cyberlium integrity demo — before edit' > integrity-demo.txt
python3 hash_file.py integrity-demo.txt

printf '%s
' 'cyberlium integrity demo — AFTER edit' >> integrity-demo.txt
python3 hash_file.py integrity-demo.txt

python3 hash_file.py sample_auth.log 2>/dev/null || true

NOTES="$HOME/cyberlium-lab/hash-lab-notes.txt"
{
  echo "=== FILE INTEGRITY HASH LAB ==="
  echo "primitive: hashlib.sha256 on rb chunks — NOT a cracker"
  echo "file: $HOME/cyberlium-lab/integrity-demo.txt"
  echo "digest_before:"
  echo "digest_after:"
  echo "compare: DIFFER (expected after edit) / MATCH"
  echo "optional_second_file_digest:"
  echo "avalanche: one-byte change -> unrelated hex"
  echo "ethics: my files only; no shadow; no rainbow tables; no password lists"
} > "$NOTES"

chmod 600 "$HOME/cyberlium-lab/hash_file.py" \
          "$HOME/cyberlium-lab/integrity-demo.txt" \
          "$NOTES"

You used hashlib as a defender: fingerprint YOUR files, notice change, lock the notes. Matching hex is equality of bytes, not a safety certificate. Cracking kits stay out. Next — Quiz — Python for Security Final — twelve APPLY items across the whole topic (the subtitle still says 10-question), then Cryptography Basics (Topic 8).