You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Search on google the list of passwords called "rockyou" and generate the hash to find the password that corresponds to the leaked hash!
683
683
684
684
Hint: you can use python to generate hashes. The hashing algorithm is SHA2.
685
-
686
-
===== Practical example
687
-
688
-
689
-
To use cryptography in real life, you should never use your own implementations. To begin, we will demonstrate how to encrypt a file, without any knowledge in cryptography. Go to the picoCTF webshell at:
690
-
691
-
https://webshell.picoctf.org/
692
-
693
-
When you are there, create a file called 'my_name.txt' containing your name. You could use the 'nano' editor, but in linux it is possible to do the following trick: If your name was 'samuel', you would run the following command to create the text file:
694
-
695
-
[source, txt]
696
-
echo "samuel" > my_name.txt
697
-
698
-
The 'echo' command simply outputs a string, and we are redirecting that output to a file. For example, if we just run
699
-
700
-
[source, txt]
701
-
echo "samuel"
702
-
703
-
You will simple see 'samuel' printed on the screen. Now run:
704
-
705
-
[source, txt]
706
-
ls
707
-
708
-
and you will see the file you created:
709
-
710
-
[source, txt]
711
-
ls
712
-
my_name.txt
713
-
714
-
If you run the command:
715
-
716
-
[source, txt]
717
-
cat my_name.txt
718
-
719
-
you will see the content:
720
-
721
-
[source, txt]
722
-
cat my_name.txt
723
-
samuel
724
-
725
-
726
-
Now, create another file with your last name called 'my_lastname.txt'. You can use the same technique to create 'my_lastname.txt':
727
-
728
-
[source, txt]
729
-
echo "pardo" > my_lastname.txt
730
-
731
-
732
-
We will move both files to a new folder, then compress that folder, and then encrypt it! Compressing a folder just makes several files or folders to appear a single file, and they would take less space on disk, but compressing does not provide any security. Anyone would be able to simply decompress it and see the original content. However, encryption will do prevent obtaining the original content without the key. To do that experiment, create a directory called my info:
733
-
734
-
[source, txt]
735
-
mkdir my_info
736
-
737
-
And move both files inside using the command mv (mv means move):
738
-
739
-
[source, txt]
740
-
mv my_name.txt my_info/
741
-
mv my_lastname.txt my_info/
742
-
743
-
Navigate to the folder 'my_info' and make sure that it contains the files. Now, come back outside my_info folder, and compress the folder into a zip file by running:
744
-
745
-
[source, txt]
746
-
zip -r my_info.zip my_info/
747
-
748
-
Note that my_info.zip is the name we chose for our compressed file, and '-r' means recursively, which in this case means that we want to compress everything inside the folder. If you run
749
-
750
-
[source, txt]
751
-
ls
752
-
753
-
You should see the folder and the compressed file:
754
-
755
-
[source, txt]
756
-
ls
757
-
my_info my_info.zip
758
-
759
-
Now remove the folder running:
760
-
761
-
[source, txt]
762
-
rm -r my_info
763
-
764
-
'rm' means remove, and '-r' means recursively and indicates we want to remove everything in the folder:
765
-
766
-
[source, txt]
767
-
rm -r my_info
768
-
769
-
Now, if you run
770
-
771
-
[source, txt]
772
-
ls
773
-
774
-
you should see only your compressed file:
775
-
776
-
[source, txt]
777
-
ls
778
-
my_info.zip
779
-
780
-
781
-
You could easily uncompress the folder by running:
782
-
783
-
[source, txt]
784
-
unzip my_info.zip
785
-
786
-
And obtain the original folder:
787
-
788
-
[source, txt]
789
-
ls
790
-
my_info my_info.zip
791
-
792
-
793
-
Now, let's create a zip file protected with encryption, so it cannot be uncompressed without a key. In this context, the words 'key' and 'password' are synonyms.
794
-
795
-
Let's remove first the .zip file we already created by running:
796
-
797
-
[source, txt]
798
-
rm my_info.zip
799
-
800
-
Now, let's create our encrypted zip, by using a password, with the following command:
801
-
802
-
[source, txt]
803
-
zip --encrypt -r my_protected_info.zip my_info/
804
-
805
-
You will be asked to input a password and verify it, remember the password you use to be able to decrypt it later:
806
-
807
-
[source, txt]
808
-
zip --encrypt -r my_protected_info.zip my_info/
809
-
Enter password:
810
-
Verify password:
811
-
adding: my_info/ (stored 0%)
812
-
adding: my_info/my_name.txt (stored 0%)
813
-
adding: my_info/my_lastname.txt (stored 0%)
814
-
815
-
If you run:
816
-
817
-
[source, txt]
818
-
unzip my_protected_info.zip
819
-
820
-
It will ask for the password, and only if you input the correct password, you will get back the original content!
It is not possible to obtain the original content without the password, because such a password is used to do operations with the content to obtain the encrypted file.
830
-
831
-
Note that a compressed file, to the human eye, might look similar as if it was encrypted. You can print the contents of a file with 'cat'. If it is not text, you would not understand. Run cat on both files. For the non-encrypted zip, you will see something similar to:
832
-
833
-
834
-
[source, txt]
835
-
cat my_info.zip
836
-
PK
837
-
,� my_info/UT #[�^���^ux
838
-
839
-
840
-
PK
841
-
,�P��� my_info/my_name.txtUT #[�^a\�^ux
842
-
843
-
844
-
samuel
845
-
PK
846
-
,�Pg�� my_info/my_lastname.txtUT #[�^a\�^ux
847
-
848
-
849
-
pardo
850
-
PK
851
-
,��Amy_info/UT#[�^ux
852
-
853
-
854
-
PK
855
-
,�P�����Bmy_info/my_name.txtUT#[�^ux
856
-
857
-
858
-
PK
859
-
,�Pg�����my_info/my_lastname.txtUT#[�^ux
860
-
861
-
862
-
PK�
863
-
864
-
If you 'cat' the encrypted file, you will see something like this:
865
-
866
-
[source, txt]
867
-
cat my_protected_info.zip
868
-
PK
869
-
,� my_info/UT #[�^�ߜ^ux
870
-
871
-
872
-
PK
873
-
,�P��� my_info/my_name.txtUT #[�^a\�^ux
874
-
875
-
876
-
q1�TVi�V�@�+w -��P���PK
877
-
,�Pg�� my_info/my_lastname.txtUT #[�^a\�^ux
878
-
879
-
880
-
��k�����AbK>B�RB�Pg��PK
881
-
,��Amy_info/UT#[�^ux
882
-
883
-
884
-
PK
885
-
,�P�����Bmy_info/my_name.txtUT#[�^ux
886
-
887
-
888
-
PK
889
-
,�Pg�����my_info/my_lastname.txtUT#[�^ux
890
-
891
-
892
-
PK%
893
-
894
-
895
-
896
-
Note that in the non-encrypted zip, it is possible to spot the name 'samuel' and the lastname 'pardo', in contrast with the encrypted one. However, you can see the path of the files in both cases. Sometimes is necessary you also hide this on a zip file. That can be achieved in several ways. One of them, is encrypting the encrypted file again. Generally, encrypting something twice does not provide more security. In this particular case it does, because the file paths were not encrypted at all.
897
-
898
-
Beware that sometimes files seem to be encrypted, but they are not, and you can recover the original content by running an algorithm without a key. For example, there are compression algorithms that make data smaller, which means they compress the data for real. Previously we called putting a file on zip compression, but you can have a zip file with or without compression. To be precise, compression is only when you make data smaller. We ran the zip command without compression. When data is compressed, it looks as encrypted because if you 'cat' it, you could not understand the contents. However, by simply running the compression algorithm without any key you can get the original content, which is obviously not secure because anyone can run it without knowing any key.
899
-
900
-
At this point you might have no idea of what happened on the inside while doing encryption. There are many algorithms for encryption, that were created since the Ancient Rome. Old ways of encrypting data are easily broken nowadays. Even relatively new ways of encrypting data are broken easily today. Some of them are considered unbreakable right now, but will be broken in the future. Let's begin to understand how encryption work!
0 commit comments