Password Hashing

bcrypt and Argon2 literacy — hash passwords in YOUR repo, never crack kits on stranger dumps.

Password Hashing• Audio Walkthrough

00:00/03:31

Visual · password_hashing

Password hashing literacy. bcrypt/Argon2 named. $MY_REPO only. Original Cyberlium.

Store verification tokens, not passwords — bcrypt or Argon2 on YOUR auth code, not hashcat on stranger breaches.

Password hashing uses slow adaptive algorithms — bcrypt and Argon2 are named standards — with unique salt per user so offline cracking is expensive. Developers call library APIs (bcrypt.hash, Argon2id) in $MY_REPO auth module — never roll your own SHA1 loop. Cyberlium teaches wiring hash verify on signup/login in your toy app — not running hashcat, John, or crack kits on leaked databases you do not own. You will NOT treat breach dumps as homework material. Next: Never Plaintext.

1. Adaptive hashes with salt

bcrypt embeds cost factor; Argon2id resists GPU cracking with memory cost. Each user gets unique salt — library generates it. Store hash string only, never plaintext password column.

On $MY_REPO, implement or document signup hash and login verify using bcrypt or Argon2 library — local test users only.

Command guide

Try these commands — Adaptive hashes with salt

═══ LINUX / BASH (Network & Reconnaissance Audit) ═══

Scan target host for open ports and service version signatures

Command — copy this

nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}

DNS and WHOIS reconnaissance on authorized domain

Command — copy this

dig +short A target.local
dig +short MX target.local
whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6

Inspect HTTP headers for technology stack fingerprinting

Command — copy this

curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"

Primary tools to practice this lesson: python3, openssl. Reference sites: Password storage (https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html); Argon2 (https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#argon2id). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Literacy, not cracking sport

Understanding hashes helps you code verify() correctly — not justify running crack kits on Have I Been Pwned samples or classmate leak rumors.

Defenders detect credential stuffing; developers never store reversible 'encrypted' passwords with hardcoded AES key in source.

3. No crack-kit labs on stranger data

hashcat rules on stranger dump files is out of scope — illegal and unethical. Lab users: testuser / local password you create in $TOY_APP only.

Ship: hash algorithm name + library call note. Next: Never Plaintext.

4. What you ship: password hash implementation note for $TOY_APP

bcrypt or Argon2id named. signup hash + login verify in $MY_REPO. NEVER crack kits on stranger dumps. chmod 600.

5. What you record before the next lesson

Date. Algorithm and library. Local test user only. File t17-m05-l02-password-hashing.txt chmod 600.

6. Wrong vs right: stranger apps vs YOUR repo

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: hashcat a public breach dump 'to learn.' Store MD5(password) in $TOY_APP.
Right: Wire bcrypt or Argon2 in $TOY_APP auth. Next: Never Plaintext.

Hands-on Exercise

Mission: password hash wiring

1) Choose bcrypt or Argon2id library in $MY_REPO. 2) Hash on signup, verify on login. 3) Local test user only — no stranger dumps. Never run crack kits on leaks.

Pro Tip

Stuck? Ask Cyberlium AI Mentor

Ask Mentor about library API — not hashcat wordlist flags.

Practice QuizQuestion 1

Multiple choice

APPLY: Password storage in YOUR app should use:

Practice QuizQuestion 2

True or False

APPLY: True or False: Running hashcat on stranger breach dumps is Cyberlium homework.

Practice QuizQuestion 3

Multiple choice

APPLY: bcrypt cost factor primarily: