Passwords stored in plaintext create serious security risks, so modern systems use hashing algorithms to convert credentials into irreversible fingerprints that protect users even when storage is compromised. This content covers how password hashing works, how it is implemented on Cisco devices and Linux systems, and how hashed values are used to verify credentials without ever exposing the original password.
Password Hashing & Security
We use usernames and passwords to secure our accounts and our infrastructure and all of the devices that we have. But those passwords need to be stored somewhere, and if they're stored somewhere, that means that people can view those passwords. This is problematic. If they can view passwords, they can get into other people's accounts. They can escalate their privileges. They can do things on the systems that they normally couldn't do. So we need some way to secure these passwords, and we do that largely through hashes.
We're going to take a look at the usernames and passwords of a Cisco device. I've logged on to this switch and I'm logged on as an administrator. One of the things I can do is see the configuration, so I do a show run to see what the configuration looks like. It builds it, and what I can see here is people's usernames and passwords.
This is problematic when I can see people's usernames and passwords. You might say, well, you're the administrator of the switch, so why is it that big of a deal? Number one, these are all administrators of the switch, so I could log out and log in as somebody else onto this switch and then do something malicious, and they can never track it back to me. Another thing is that if Derek is using this password for this switch, he might use that for other accounts as well. They shouldn't be, but possibly they're using it for multiple accounts. So this is problematic, and we need to fix this situation.
What I'm going to do is get into the configuration mode here, and we're going to configure my password to not show up like this. The first thing that I'm going to do is take that instruction out, this username. So I put a no and then use this right here, and that just removes it from that configuration. Next, I am going to use a different command with this secret: rather than using the word password, I'm going to use secret. Now I'm going to take a look at this running config again and see what's changed with it.
If you look, that password that I had before is no longer there. Now it's just this series of numbers and letters and characters. This is a hash. This is a hash of the password. If I do that to all of these accounts, I can't see what these passwords are.
What we're doing is taking the passwords and hashing those passwords to put them into a form that's not really recognizable by us. You can think of a hash like a fingerprint. It's a fingerprint of data, but instead of being in the form of an actual fingerprint, it uses just a bunch of characters that are strung together. These characters then represent whatever data it is that's being hashed here.
It uses something called a hashing algorithm. In this case right here, this funnel represents our hashing algorithm. There's some sort of data that goes into this hashing algorithm, and then you get that fingerprint out, that series of characters that represents that data.
I'm on a Kali Linux box, and on this Kali Linux box we are going to hash a password. I'm going to use this command echo, and then this makes sure that there's no carriage return at the end of it. So there's no return at the end of it, it's just going to pass this off into this program right here: password one into md5sum. I'm going to hit enter with that, and what we can see is it comes up with the hash value for password one.
There are a lot of hashing algorithms out there. Here's a list of some of the hashing algorithms, and they're applied a little differently for different purposes. One of the ones that we're going to use is MD5, but MD5 is considered broken, so even though we're using this, it's just for simplicity in showing how this works.
At first glance, this can look a little like encryption, but it is not encryption. Encryption can go both ways: we can take this data and we can encrypt the data, and then if you have the right key, you can decrypt the data. The idea behind the hash is that it's a one-way function. That is, you can put this through the hashing algorithm, but you can't ever take that hash and get the data back out of it.
I like to think of the hashing algorithm as a blender. If I'm making a smoothie, I put things like apples and oranges and maybe some green stuff in there, whatever I wanted to create the smoothie out of, and then I blend it together. Once it's blended together, it's a unique flavor that's specific to what went into it, but I can't ever get those ingredients back out. I can't extract the apple and have an apple in the same way as when it went in. So it's a one-way function. A good hashing algorithm is the same way: once we put the data into this blender and create this unique flavor, this unique fingerprint, we can't ever get that data back out of it.
So by doing this to the password — we have the password going into this hashing algorithm — we get this unique set of data coming out of it, this unique set of numbers and letters.
Even a slight change in the data makes a big difference in what the fingerprint looks like. In this case right here, I used password one, and then I changed one thing for this one right here and used password two. You can see the fingerprints of these two different data sets: one that just says password one, and one that's slightly different with password two. But the result is drastically different. Very different fingerprints.
I'm back on the Kali Linux box. We can see where we did an MD5 hash on this password one and came up with the MD5 hash of it. Now I'm going to do the same thing, but we're going to change this to password two. So I'll change it to password two, and you can see that this number right here, this fingerprint, is very different than the original one. So we have a very different fingerprint based off of just a small change.
Most hashing algorithms can compile a bunch of information down into a smaller fingerprint. Because of the nature of how that works, the fact that the fingerprint is smaller than the data going into it, we could have something called a hashing collision. A good hashing algorithm has very few hashing collisions. It doesn't happen often, but it can happen. In this case, we have two sets of data that are drastically different coming up with the same result. We just need to be aware that this can happen, and we call this a hashing collision. But in a good hashing algorithm, it doesn't happen often.
It is a very bad practice to be able to see other people's passwords. Whether I'm an administrator or a developer or some user or a hacker, we don't want people to be able to see other people's passwords at all. But because we still have to store passwords, it's best practice, whenever you're storing passwords, to store them in a hashed value. Here we see a database, and it has a series of usernames and passwords, and the passwords have all been hashed.
Security wasn't always as big of a concern, so we used to not store passwords in this hashed form. I'm on a Linux box right here — in fact, it's a Debian box — and what I'm going to do is type in cat password. This is going to show us the password file. I'm going to hit enter, and what we're looking at is all the users. Here's the root user on here, and the next section right here would have normally been the password, because this is the file that stored all of the passwords. I also can look at the demo user here; that's what I'm logged in as. You can see I'm logged in as demo user, and here it used to be that the password was there, and in clear text.
What they did is they pulled it out of this file and put it in another file, and then they hashed it at the same time, so that it obfuscated and made it so that we couldn't see other people's passwords when you logged into a system. So instead of this cat password, we're going to do shadow, which is where they're kept now. And I do have to type in sudo at the beginning of this. And there we have it. Now if I look at this, we see that demo user, and then right after here is that hashed password. So now I can see the hashed password part of this. A lot of times this is what we're looking at if we're trying to hack or crack a system. This is what we're trying to hack and crack: these hashed passwords here.
One question that might come up is, if we have these hashed values, how do we verify somebody's password? Let's say somebody enters in a new password, so they've either created a new account or maybe they are changing their password, whatever the case may be. What happens is it goes into the blender, it goes into the hashing algorithm, and then gets submitted into the database like that. So it gets submitted into the database as a hash.
Now when somebody comes to verify and enters in their username and password, at some point in time that password gets hashed again. What's going to happen is you're going to have this hash value that's going to be checked against the hash value in the database. If the two line up, that means that they have used the correct password. But if they don't line up, that means that they have not used the correct password. That's going to either allow them into the system, or they're not going to have access to the system.
Password cracking is the art of trying to figure out what somebody's password is, and a big part of password cracking is really just to figure out what this hash means right here. So in some sense, password cracking is hash cracking.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →