Cryptographic Failures

Cryptographic Failures (OWASP A02)

Purpose

Provide detection patterns for cryptographic vulnerabilities including weak algorithms, hardcoded secrets, insufficient key lengths, and insecure random number generation.

OWASP Top 10 Mapping

Category: A02 - Cryptographic Failures

CWEs:

• CWE-326: Inadequate Encryption Strength
• CWE-327: Use of Broken or Risky Crypto Algorithm
• CWE-328: Reversible One-Way Hash
• CWE-330: Use of Insufficiently Random Values
• CWE-338: Use of Cryptographically Weak PRNG
• CWE-798: Use of Hardcoded Credentials

When to Use

Activate this skill when:

• Reviewing password hashing implementations
• Checking encryption algorithm usage
• Looking for hardcoded secrets/API keys
• Auditing random number generation
• Verifying key management practices

---

Weak Hash Algorithms

Detection Patterns

# MD5 usage (broken for security)
grep -rniE "md5\(|MD5\.|hashlib\.md5|MessageDigest.*MD5|crypto\.MD5" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# SHA1 usage (deprecated for security)
grep -rniE "sha1\(|SHA1\.|hashlib\.sha1|MessageDigest.*SHA-1|crypto\.SHA1" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

# Password hashing with weak algorithms
grep -rniE "password.*md5|password.*sha1|hash.*password.*md5" --include="*.go" --include="*.py" --include="*.java" --include="*.ts" --include="*.php"

Language-Specific Patterns

Python

# Weak hashing
grep -rniE "hashlib\.md5|hashlib\.sha1" --include="*.py"

# Should use: bcrypt, argon2, scrypt
grep -rniE "bcrypt|argon2|scrypt" --include="*.py"

Vulnerable:

# VULNERABLE: MD5 for passwords
password_hash = hashlib.md5(password.encode()).hexdigest()

Secure:

# SAFE: bcrypt for passwords
password_hash = bcrypt.hashpw(password.encode(), bcrypt.gensalt())

Java

# Weak MessageDigest
grep -rniE "MessageDigest\.getInstance.*MD5|MessageDigest\.getInstance.*SHA-1" --include="*.java"

# Should use: BCrypt, Argon2, PBKDF2
grep -rniE "BCrypt|Argon2|PBKDF2|SecretKeyFactory" --include="*.java"