Cryptography › Module 1 › Lesson 4
Lab — Hash Cracking Basics
Practice ethical hash lookup on sample digests you create yourself—never real victim hashes
Opening
Crack only what you hashed
This lab shows why weak/unsalted fast hashes fall to dictionary attacks. Create your own digest from a short lab password, then recover it from a tiny wordlist. Do not use hashes from breaches or other people’s accounts.
1. Step 1 — Create a lab hash
Make a SHA-256 of a known lab passwordpython -c "import hashlib; print(hashlib.sha256(b'summer2024').hexdigest())"
python -c "import hashlib; print(hashlib.sha256(b'summer2024').hexdigest())"
2. Step 2 — Tiny wordlist attack (your hash only)
crack_lab.py — copy and runimport hashlib target = input("Paste your lab SHA-256 hex: ").strip().lower() wordlist = ["password", "admin", "summer2024", "letmein", "cyberlium"] for word in wordlist: digest = hashlib.sha256(word.encode()).hexdigest() if digest == target: print("Found:", word) break else: print("Not in this tiny list")
import hashlib
target = input("Paste your lab SHA-256 hex: ").strip().lower()
wordlist = ["password", "admin", "summer2024", "letmein", "cyberlium"]
for word in wordlist:
digest = hashlib.sha256(word.encode()).hexdigest()
if digest == target:
print("Found:", word)
break
else:
print("Not in this tiny list")3. What You Should Notice
A short common password falls instantly against even a five-word list when the hash is fast and unsalted. Real attackers use huge lists and GPUs—this is why slow salted password hashes matter. Challenge: add a salt to your hashing and see how the naive wordlist script must change.
Complete hash cracking basics lab
Generate a SHA-256 of a lab password you chose, run crack_lab.py against it with the sample wordlist, and confirm recovery works only for words in the list.
Knowledge Check
This lab is ethical when you:
Multiple choice
Knowledge Check
True or False: Fast unsalted hashes of common passwords are easy to recover with dictionaries.
True or False