Ravindra BagaleCourses & study guides मराठी Track your progress

22. Password Attacks

22.1 How Passwords Are Stored

By Last updated:

Quick answer: the short, self-contained version of this lesson is the guide How to Set Up a Password Manager (Beginner Guide).

Changla system password plain text madhe thevat nahi. To ek hash thevto – ek one-way function jo password cha ek fixed output banavto, ani tyatun password parat kadhta yet nahi.

Method What it stores Safe?
Plain text The password itself Never – one leak exposes everyone
Hash (MD5, SHA1) A one-way fingerprint Weak now – fast to crack, no salt
Salted hash Hash + a unique random "salt" per user Better – stops precomputed tables
Slow hash (bcrypt, Argon2, PBKDF2) Salted hash that is deliberately slow Best – cracking becomes very expensive

A salt is a random value added to each password before hashing, so two users with the same password get different hashes, and precomputed rainbow tables stop working. A slow hash (bcrypt) is designed to take time, so an attacker can only try a few thousand guesses a second instead of billions.

On Linux, password hashes live in /etc/shadow (readable only by root); the format $6$ means SHA-512, $y$ means yescrypt. Old systems used /etc/passwd.

Ravindra Bagale's Tip

When building a web project, students use md5($password) in PHP – that is wrong in 2024! Always use password_hash($p, PASSWORD_DEFAULT) (bcrypt) and password_verify(). We did exactly this in the Chapter 16 reels app – now you will see why it was needed.

Practice task

In your notes, write the four storage methods from weakest to strongest, and one line each on why. Then check your reels app code and confirm it uses password_hash, not md5.

Storing passwords correctly in every stack

The table above shows why plain text and fast hashes fail. Here is what to use when you build apps.

Password hashing by stack

Java / Spring Security

BCrypt or Argon2 via PasswordEncoder.

passwordEncoder.encode(raw)

What you see:

$2a$10$...
ASP.NET Core

PasswordHasher<TUser> (PBKDF2 by default).

Node.js

bcrypt or argon2 packages.

await bcrypt.hash(pw, 12)
Python / Django

PBKDF2/Argon2 in the auth system by default. Do not replace it with MD5.

PHP

password_hash() / password_verify() (bcrypt/argon2).

password_hash($pw, PASSWORD_ARGON2ID)
Ruby / Rails

has_secure_password (bcrypt).

Real examples

Global: breaches that published unsalted MD5 password dumps led to huge credential-stuffing waves. Everyday: a paper note under the keyboard is plain text. A locked password manager is salted hashing for humans.

Recap

  • Never store plain text. Prefer bcrypt/scrypt/argon2/PBKDF2.
  • Use your framework's built-in hasher.

Defender's worksheet (do this today)

  1. Write the lesson title and date in your notebook.
  2. List three systems you own (VMs, personal projects, or lab apps) where this lesson applies.
  3. Run one safe command or checklist item from the lesson on a lab system only.
  4. Paste the command and its output under an Evidence heading.
  5. Write one fix you would give a teammate in two sentences.
  6. Write one mistake students make with this topic and how to avoid it.

More real-world pictures

Indian workplace (sample data)

Suppose we are a junior analyst at Tech Mahindra supporting a client SOC. After reading this lesson you add one detection or one hardening item to the team weekly checklist, with the owner name and a due date. That is how learning becomes operations.

Global practice

Public bodies such as CERT-In (India), CISA (US) and NCSC (UK) publish advisories that map to the same ideas: patch, least privilege, logging and user awareness. Bookmark one advisory feed and read it every Monday.

Home and family

Explain this lesson to a family member in four sentences without jargon. If they can repeat the main warning back to you, you understand it well enough to teach.

Connect to earlier chapters

Parts 1 to 9 built Linux, web servers, databases and cloud pieces. This lesson only makes sense when you can point to a concrete config file, package name or architecture box from those parts. If you cannot, revisit the matching earlier chapter before you practise any tool command.

Common mistakes

  • Skipping written permission just for a quick scan.
  • Practising on hostel or office Wi-Fi targets without authorisation.
  • Collecting tool output without writing the fix.
  • Copying exploit commands onto production to verify. Verification for defenders means checking versions and patches, not firing modules.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.
  • Teach one other person the warning from this lesson.