GSEC · Question #297
How can an adversary utilize a stolen database of unsalted password hashes?
The correct answer is B. Compare the hashed output of guessed passwords with them. Without a salt, identical plaintext passwords always produce identical hashes, enabling offline comparison attacks using precomputed hash lists or on-the-fly guessing.
Question
How can an adversary utilize a stolen database of unsalted password hashes?
Options
- ADecrypt them to find the dear text passwords
- BCompare the hashed output of guessed passwords with them
- CAuthenticate with the service associated with the on-line database
- DReverse engineer them to find the encryption key
How the community answered
(32 responses)- A3% (1)
- B72% (23)
- C9% (3)
- D16% (5)
Why each option
Without a salt, identical plaintext passwords always produce identical hashes, enabling offline comparison attacks using precomputed hash lists or on-the-fly guessing.
Hashing is a one-way function, not encryption - there is no algorithm or key that can reverse a hash back to plaintext.
Because unsalted hashes are deterministic, an attacker can hash a large dictionary of candidate passwords and compare each result against the stolen database. Any match reveals the original plaintext. This technique is the basis for dictionary attacks and rainbow table lookups against unsalted hash stores.
A hash value cannot be submitted in place of a password to authenticate, because the service re-hashes the submitted credential and compares results, requiring the actual plaintext.
Hashing does not use an encryption key, so there is nothing to reverse-engineer from the hash output.
Concept tested: Offline dictionary attack against unsalted password hashes
Source: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
Topics
Community Discussion
No community discussion yet for this question.