Terminal labUnit 4 · Topic 4.2
Hashing and salting in a real terminal
Hash and salt passwords in a real terminal and compare the results.
New to this? Read the topic first: 4.2 Authentication.
Simulation · Hashing lab [4.2.A.1, 4.2.A.3, 4.2.A.6]
Hashing lab: what the server really stores
An analyst checks how a sign-in server stores passwords. These are real SHA-256 hashes, exactly what the sha256sum command prints. Change one character and the whole hash changes; the same input always gives the same hash; the length never changes.
analyst@auth-srv:~$ printf '%s' 'Falcon2024!' | sha256sum 78d620584d220d6e9f5e4f42b3c44d6b313f981db0b87f17c75dc467a16ac80b - analyst@auth-srv:~$ printf '%s' 'falcon2024!' | sha256sum f9ce6df32ca3cbfcc0d11985fcc56ecb024b83dfbf4ecb323a5548b83c340d59 - analyst@auth-srv:~$ printf '%s' 'Falcon2024!!' | sha256sum 20f6c23c5e45efad026877166b7aec2f01c56eb920086e4f88a80eb0593000a3 - analyst@auth-srv:~$ printf '%s' 'Falcon2024!' | sha256sum 78d620584d220d6e9f5e4f42b3c44d6b313f981db0b87f17c75dc467a16ac80b -
- at the end means sha256sum read standard input (here, the pipe from printf), not a file.Same password, different salt
analyst@auth-srv:~$ sqlite3 auth.db "SELECT user, salt, hash FROM logins;" ana|9f2c|b1449d960d8090b4b01948d9f0489c2c6164048579e0ec2b9ae5c9dc8007f5bb ben|71d0|aed5eb90031ad877bf338be3c8f10175f690816c0d79c8e3480d44258df32f72 # ana signs in: the server hashes her stored salt + the password she typed analyst@auth-srv:~$ printf '%s' '9f2cFalcon2024!' | sha256sum b1449d960d8090b4b01948d9f0489c2c6164048579e0ec2b9ae5c9dc8007f5bb -
Try it yourself
Type anything in the terminal (never a real password). The hash updates as you type.
you@lockincs:~$ printf '%s' '' | sha256sum
Waiting for input...
Go to the topic: 4.2 Authentication