Web › Module 4 › Lesson 2
Hashing Passwords vs Encrypting Secrets
A04: hash YOUR toy string; curl -sv http://192.168.0.1/ — never crack.
Visual · hash_vs_encrypt_passwords
Hash passwords (slow salted KDF). with curl -sv. No hashcat. No hydra.
Opening
“Passwords encrypted with SHA-256” is a finding written by someone who failed this lesson.
Under OWASP Top 10:2025 A04, storing passwords as reversible ciphertext or as fast unsalted hashes is a cryptographic failure. Password storage wants a one-way slow salted hash (named literacy: Argon2, bcrypt, scrypt). Encryption is a lockbox for secrets you must retrieve (API keys at rest with a KMS story). Attackers want a dump they can offline-guess or decrypt. This is ORIGINAL Cyberlium teaching.
1. Hashing for passwords: verifier, not ciphertext
A password hash should be one-way, salted uniquely per user, and slow enough to frustrate guessing. Fast SHA-256(password) without salt is not modern storage. Encryption would imply a key that returns the password — usually the wrong design for login verifiers. MFA is a second factor, not a hash and not encryption.
Command guide
A04 Crypto — Hashing for passwords
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
python3 - << PY
import hashlib
msg = b"cyberlium-local-demo-string"
print("sha256", hashlib.sha256(msg).hexdigest())
print("this is a fingerprint of YOUR bytes — not password storage")
print("password storage: slow salted KDF (bcrypt/argon2/scrypt) — do not invert")
PYCommand — copy this
python3 - << 'PY'
import hashlib
print("sha256", hashlib.sha256(b"cyberlium-lab-only").hexdigest())
print("hash != encrypt; do not invert dumps")
PY2. Encryption for secrets that must come back
API keys, tokens, and fields you must display/decrypt need encryption with key management — not a hash. Losing the key loses the secret; that is expected. Do not “encrypt” passwords with AES so support can read them. Do not call SHA-256 encryption in reports.
Command guide
A04 Crypto — Encryption for secrets that must come back
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
SAFE="http://127.0.0.1:8771"
Command — copy this
curl -sS -m 3 -I "$SAFE/" | head -n 12
3. Attacker goals and why dumps are out of this course
Attackers steal tables of verifiers and guess offline. Your lab is: identify DEMO, understand the verbs, hash YOUR toy string. Public breach dumps are still other people’s secrets. Hashcat/John/Hydra against them — or against a LAN router — are refused here even when blogs title them “A04 practice.”
4. What you demonstrate: hashlib of YOUR string + curl -sv identify
168.0.1/ — if router, STOP. Print SHA-256 of a known toy string to feel fingerprints — then write that password storage still needs a slow salted KDF, not raw SHA-256 alone. Optional: note “I would name Argon2/bcrypt in a design.” Do not invert the hex.
5. What you record
Date (UTC). Identify banner. Hashing ≠ encryption. Password storage = slow salted KDF. Secrets that return = encryption + keys. Ethics refuse hashcat/dumps/hydra LAN. Path: $HOME/cyberlium-lab/a04-hash-encrypt-notes.txt, chmod 600. Legal: original Cyberlium — not official OWASP certification.
6. Wrong vs right: cracking shop vs verb hygiene
Worked failure — same hashlib, opposite job.
Wrong
Call SHA-256 encryption. hashcat a dump. Hydra 192.168.0.1. Hash /etc/shadow. Store reversible passwords for “support.”
Right
curl -sv DEMO (STOP if router); hash YOUR toy string; write KDF vs encryption sentences; lock notes. Next: TLS Mistakes You Can Name.
Run identify, then the toy hash script. Do not add wordlists.
Mission: a04-hash-encrypt-notes.txt (mode 600)
1) curl -sv http://192.168.0.1/ —2) Hash a toy string YOU chose; write hashing ≠ encryption and slow-KDF sentences. 3) Fill $HOME/cyberlium-lab/a04-hash-encrypt-notes.txt, chmod 600. No hashcat/dumps.
Stuck? Ask Cyberlium AI Mentor
If “crypto means hashcat” still feels true, ask for a hint — not a wordlist. Try: "Hint only: why password storage is a slow salted hash, why curl -sv of a router means STOP, and where locked a04-hash-encrypt-notes.txt lives?"
You keep hashing and encryption apart under A04 — passwords as slow salted verifiers, secrets as lockboxes — with locked notes and no cracking shop. Original Cyberlium — not official OWASP certification. Next — TLS Mistakes You Can Name.
Knowledge Check
APPLY: A report says “passwords encrypted with SHA-256.” What is wrong, and what should storage be?
Multiple choice
Knowledge Check
APPLY: True or False: HaveIBeenPwned pastes are ethical hashcat homework for A04.
True or False
Knowledge Check
APPLY: curl -sv http://192.168.0.1/ is a Netgear router login. What do you do?
Multiple choice