Cryptography is used to ensure secure storage and transmission of data. However, there are a number of best practices that must be followed to ensure the cryptography in use remains secure and does not result in the exposure of sensitive data. A lack of salt in the application's cryptographic hash means that there is no unique randomness added to the hash. This significantly reduces the complexity of an attacker being able to guess the hash value, or perform rainbow table or brute force attacks.
This vulnerability can lead to reputational damage of the company through the impact to customers’ trust, and the ability of an attacker to view data. The severity of the impact to the business is dependent on the sensitivity of the accessible data being transmitted by the application.
- Enable a HTTP interception proxy, such as Burp Suite or OWASP ZAP
- Setup {{software}} to intercept and log requests
- Use a browser to navigate to: {{URL}}
- {{action}} to view unencrypted requests
The screenshot below demonstrates the lack of salt:
{{screenshot}}