⚠ Sandboxed environment — This is an intentionally vulnerable application running inside an isolated Docker container with fake data. Nothing you do here can harm the host machine or other users.

A04 – Cryptographic Failures

OWASP A04:2025 CWE-327 CWE-759 CWE-330

Cryptographic failures are usually not broken algorithms — they're misuse of crypto. Each tab picks a different misuse pattern from the A04 family.

CWE-327 Broken Algorithm CWE-759 Unsalted Hash CWE-330 Weak Random
CWE-759 Use of a One-Way Hash without a Salt

Even with a slow hash, no salt means two users with the same password produce the SAME hash. Crack one → crack everyone who reused that password.

Vulnerable code:
def store(user, pw):
    db.insert(user, hashlib.sha256(pw.encode()).hexdigest())  # no salt!

Try it yourself

Register two users with the same password

Submit alice and bob both with password hunter2.

Compare the hashes

They're byte-for-byte identical. Crack one → both compromised.