⚠ Sandboxed environment — This is an intentionally vulnerable application running inside an isolated Docker container with fake data. Nothing you do here can harm the host machine or other users.

A04 – Cryptographic Failures

OWASP A04:2025 CWE-327 CWE-759 CWE-330

Cryptographic failures are usually not broken algorithms — they're misuse of crypto. Each tab picks a different misuse pattern from the A04 family.

CWE-327 Broken Algorithm CWE-759 Unsalted Hash CWE-330 Weak Random
CWE-330 Use of Insufficiently Random Values

Python's random is fast and statistically good — but predictable. Given the seed (or ~624 outputs) an attacker reproduces every future value.

Vulnerable code: 
def reset_token():
    random.seed(int(time.time()))
    return ''.join(str(random.randint(0,9)) for _ in range(8))

Try it yourself

Generate tokens

Click below. Tokens look random.

Replay

Same seed → identical sequence. Anyone who guesses the seed recovers every token.