⚠ Sandboxed environment — This is an intentionally vulnerable application running inside an isolated Docker container with fake data. Nothing you do here can harm the host machine or other users.

A04 – Cryptographic Failures

OWASP A04:2025 CWE-327 CWE-759 CWE-330

Cryptographic failures are usually not broken algorithms — they're misuse of crypto. Each tab picks a different misuse pattern from the A04 family.

CWE-327 Broken Algorithm CWE-759 Unsalted Hash CWE-330 Weak Random
CWE-327 Use of a Broken or Risky Crypto Algorithm

MD5 was designed as a fast checksum (~25 billion hashes/sec per GPU). Using it to store passwords means any DB leak becomes plaintext within hours.

Vulnerable code: 
def hash_password(pw):
    return hashlib.md5(pw.encode()).hexdigest()

Try it yourself

Register

Use any common password — password, 123456, admin.

Crack the hash

Paste the MD5 into crackstation.net — plaintext returned in milliseconds.

→ Dump the user database

⚠ Database dump
User table dump: (empty) Every hash above is one Google search away from plaintext.
What just happened? Your password went through MD5 unchanged — no salt, no work factor. Reversible via public rainbow tables.

Fix: bcrypt.hashpw(pw.encode(), bcrypt.gensalt()) — ~100 ms per hash, salted, billions of times harder to brute force.