Secure › Module 5 › Lesson 2
Password Hashing
bcrypt and Argon2 literacy — hash passwords in YOUR repo, never crack kits on stranger dumps.
Visual · password_hashing
Password hashing literacy. bcrypt/Argon2 named. $MY_REPO only. Original Cyberlium.
Opening
Store verification tokens, not passwords — bcrypt or Argon2 on YOUR auth code, not hashcat on stranger breaches.
Password hashing uses slow adaptive algorithms — bcrypt and Argon2 are named standards — with unique salt per user so offline cracking is expensive. Developers call library APIs (bcrypt.hash, Argon2id) in $MY_REPO auth module — never roll your own SHA1 loop. Cyberlium teaches wiring hash verify on signup/login in your toy app — not running hashcat, John, or crack kits on leaked databases you do not own. You will NOT treat breach dumps as homework material. Next: Never Plaintext.
1. Adaptive hashes with salt
bcrypt embeds cost factor; Argon2id resists GPU cracking with memory cost. Each user gets unique salt — library generates it. Store hash string only, never plaintext password column.
On $MY_REPO, implement or document signup hash and login verify using bcrypt or Argon2 library — local test users only.
Command guide
Try these commands — Adaptive hashes with salt
═══ LINUX / BASH (Network & Reconnaissance Audit) ═══
Scan target host for open ports and service version signatures
Command — copy this
nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}DNS and WHOIS reconnaissance on authorized domain
Command — copy this
dig +short A target.local dig +short MX target.local whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6
Inspect HTTP headers for technology stack fingerprinting
Command — copy this
curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"Primary tools to practice this lesson: python3, openssl. Reference sites: Password storage (https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html); Argon2 (https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#argon2id). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Literacy, not cracking sport
Understanding hashes helps you code verify() correctly — not justify running crack kits on Have I Been Pwned samples or classmate leak rumors.
Defenders detect credential stuffing; developers never store reversible 'encrypted' passwords with hardcoded AES key in source.
3. No crack-kit labs on stranger data
hashcat rules on stranger dump files is out of scope — illegal and unethical. Lab users: testuser / local password you create in $TOY_APP only.
Ship: hash algorithm name + library call note. Next: Never Plaintext.
4. What you ship: password hash implementation note for $TOY_APP
bcrypt or Argon2id named. signup hash + login verify in $MY_REPO. NEVER crack kits on stranger dumps. chmod 600.
5. What you record before the next lesson
Date. Algorithm and library. Local test user only. File t17-m05-l02-password-hashing.txt chmod 600.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
hashcat a public breach dump 'to learn.' Store MD5(password) in $TOY_APP.
Right
Wire bcrypt or Argon2 in $TOY_APP auth. Next: Never Plaintext.
Mission: password hash wiring
1) Choose bcrypt or Argon2id library in $MY_REPO. 2) Hash on signup, verify on login. 3) Local test user only — no stranger dumps. Never run crack kits on leaks.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor about library API — not hashcat wordlist flags.
Knowledge Check
APPLY: Password storage in YOUR app should use:
Multiple choice
Knowledge Check
APPLY: True or False: Running hashcat on stranger breach dumps is Cyberlium homework.
True or False
Knowledge Check
APPLY: bcrypt cost factor primarily:
Multiple choice