Question: Assignment Description You are asked to develop a password brute-force tool that targets a web app. This web app uses hashing (SHA-256) and salt (an

Assignment Description You are asked to develop a password brute-force tool that targets a web app. This web app uses hashing (SHA-256) and salt (an alphanumeric string of length 5) to protect passwords. We also know that only [A-Z], [a-z], [0-9], [#$!&] characters are allowed in the passwords, but the web app does not check passwords' lengths upon user signup; thus, some users might have short passwords. Upon signup, a random salt value of length 5 is generated for each user and stored (in plaintext) along user id and the SHA-256 hash of the user's password+salt. You have hacked the user data file of this web app that includes the hash of user passwords and their plaintext salts, but plaintext passwords are nowhere in the data. Thus, you need to use brute force (because hash functions are irreversible) to recover the original password. Example of hacked user data: user_id, user_password_hash, user_salt 1458451, cdd0cdba5a676747d11f5c17cf2e156fdfcb66ecf1cabd003c7d0cf544c73bf2, a567c 1785634, 7f68eb242ccd959f4337a71119608f8154a6a7a5e912b27dd6ecf371a77344d1, 5ctyk 5246513, aea84d8ef0c273f4ea22c3c4ebb0a29aca381898b6bc73808f29053e3d44b513, yc9za We want to build an offline password brute-force software in python to recover users' passwords in this dataset. We only want to recover passwords of up to length 8. Your program receives a dataset of user data as a file where the file includes n lines of text, and each line corresponds to one user: Example of input file content: 1458451, cdd0cdba5a676747d11f5c17cf2e156fdfcb66ecf1cabd003c7d0cf544c73bf2, a567c 1785634, 7f68eb242ccd959f4337a71119608f8154a6a7a5e912b27dd6ecf371a77344d1, 5ctyk 5246513, aea84d8ef0c273f4ea22c3c4ebb0a29aca381898b6bc73808f29053e3d44b513, yc9za Your program should be called as follows: > python3 main.py Links to an external site.input.txt where input.txt is the input file passed to the program as an argument. Receiving this input, your program needs to generate all passwords of lengths 1 to at least 8 and try them against each user. The output of your program is the list of user IDs, where for each user ID, you either print the successfully recovered password or "????" if the password was not recovered

Example of program output: 1458451, denver1 1785634, hello2 5246513, ????

Step by Step Solution

There are 3 Steps involved in it

1 Expert Approved Answer
Step: 1 Unlock blur-text-image
Question Has Been Solved by an Expert!

Get step-by-step solutions from verified subject matter experts

Step: 2 Unlock
Step: 3 Unlock

Students Have Also Explored These Related Databases Questions!