TechKnowSurge
TechKnowSurge Catalog Videos DEMO: Salting Passwords
VideoSecurityFree

DEMO: Salting Passwords

Password salting is a cryptographic technique that appends unique random data to each password before hashing, rendering rainbow table attacks ineffective. It is a foundational defense for securing stored credentials in any database system.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Storing passwords as plain text in a database is a critical security failure, since anyone with database access would immediately have access to every user's credentials. Hashing passwords before storage adds a layer of protection, but hash values are still vulnerable to rainbow table attacks, in which an adversary compares captured hashes against a precomputed table of hash-to-plaintext mappings to recover the original passwords. Salting is the countermeasure designed to defeat this attack method. It works by appending or prepending a unique string of characters to a password before the hashing algorithm processes it, which produces a hash that bears no resemblance to what the unsalted password would have generated and therefore does not appear in any standard rainbow table. For salting to be effective, each user account must be assigned a different salt value. If a single salt were applied uniformly across all accounts, an attacker who discovered that salt could construct a new rainbow table tailored to it and recover passwords at scale. By ensuring each user has a unique salt, a successful lookup against one account's hash provides no advantage when attacking any other account. The salt itself does not need to be kept secret and is typically stored in the same database record as the hashed password, where it can be retrieved and reapplied whenever a user's credentials need to be verified.

What you'll learn

What's covered

Salting Passwords

Key terms

Hash Function
A mathematical algorithm that converts input data of any size into a fixed-size output value used to verify data integrity.
Rainbow Table
A precomputed lookup table used to reverse cryptographic hash functions, allowing attackers to recover plaintext passwords from stolen hashed credentials. Rainbow table attacks are defeated by adding a unique salt to each password before hashing.
Salt
A random value added to a password before it is hashed, ensuring that identical passwords produce unique hash outputs for each user. Salting defeats precomputed rainbow table attacks and forces attackers to crack each hash individually.
Brute Force Attack
An attack method that systematically tries all possible combinations of passwords or keys until the correct one is found.
Cryptography
The practice of securing information by transforming it into an unreadable format using mathematical algorithms.

Topics

Cryptography Password Salting Password Hashing Rainbow Table Attacks Credential Security Authentication

Transcript

Why we salt passwords

If an adversary has a hold of some passwords that have been hashed, they can use a rainbow table to figure out what the actual password is. But one of the ways we can stop that from happening is to salt those passwords.

Databases should never store clear text versions of the password. If they do, anyone that had access to that database could have access to the actual passwords, and we really shouldn't know other users' passwords, not even administrators. So what a database will usually do is hash those passwords so that they're more secure.

But these are susceptible to rainbow table attacks. That is, somebody could look up the hash values in a rainbow table, and if they find a match then they know what the password is. So in this case right here, the G house has found a match, and so therefore whoever is looking at this rainbow table has found the actual password that's associated with G house.

What salting does

What salting is, is that it adds a little extra flavor to our password. It adds a little extra salt to our password.

Here we have an example of a password. It's a really bad password; it's a variation of the word password, which is not good. But what we're going to do is add some salt, which will make it a little more secure. We have chosen just some different characters that we're going to add to it. We add it maybe at the beginning, maybe it's at the end, maybe it's in between, or maybe the algorithm actually takes it and does something a little different with that salt. But whatever the case may be, we're going to get a drastically different fingerprint to it, a drastically different hash out of it.

And so the hashes that now show up in our database are much different. So here's our rainbow table right here, and then here's our database. Now when somebody grabs all the hashes that are found in this database, what they have is something that is quite a bit different. So here's that password that was before and the hash that was before, but because we've added this salt to it, it's so different that now this rainbow table is not really functional at all.

A different salt for every user

One thing that is important is that we have a different salt for every single user. Let's say we use the same salt for every single user, like let's say we're using 41 AB1 for every single user. Now, whoever had this information could generate a whole new rainbow table with this; they know that this is the salt. They can do a variation of every single combination out there, create a whole new rainbow table, and now they can do a lookup with this and be able to find the password. So it's important that each one of the users has a different variation of this salt.

And that's one of the reasons why we store this usually near the user: because we have to access it when we're verifying these users for login, or whatever they're using their password for.

Seeing it on a machine

Let's get a visual of this. I'm on my Kali box and I'm going to echo this ABC, so this would be representative of the password, and we're going to just use MD5 to create a hash out of it. So there's the hash. What I have is a rainbow table, and I'm going to look up that hash in the rainbow table, and as you can see, I found it and I can find that this is ABC.

But by adding a salt to it: what I'm going to do is add a salt, and what I'm adding is an A and a B somewhere in the middle. So the little A and little B, the lowercase, is our salt, where the ABC is our actual password. So now I'm going to enter that in. And if I were to take a look at that inside of my do use GP to try to find it inside of the rainbow table, and if I hit that, now it's not going to find it. So that's just representative of how we've now altered this hash and can't find it inside our rainbow table.

We can take a look at this. If we go to /etc/shadow and hit enter, we do need to get into it with sudo. What we can see here is the hash value of the password, and we can see the salt that's being used for it. We can also see the same thing within this Cisco device. Here's the hash of this, and the salt that's being used to generate that hash.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →