Enhance Cryptographic failures module by aashpis · Pull Request #596 · SasanLabs/VulnerableApp

aashpis · 2026-04-24T00:46:47Z

Reordered and added new levels, now 1-11, to the Cryptographic failures module according to issue 523.

Additional methods have been added to PasswordHashingUtils for new levels

EncryptionUtils was created as part of the internal.utility package and contains methods related to encryption.

Descriptions for new levels were added to message.properties

New Level Order:

plaintext storage
Base64 encoding is not encryption
Caesar Cipher
Security By Obscurity/Custom logic
MD4 Hash
MD5 Hash
SHA-1 Hash
LM Hash
Unsalted SHA-256
AES with weak key
Secure example: Bcrypt

…odule

…ption

Level-10

# Conflicts: # src/main/java/org/sasanlabs/service/vulnerability/cryptographicFailures/CryptographicFailuresVulnerability.java

codecov-commenter · 2026-04-24T02:34:52Z

Codecov Report

❌ Patch coverage is 0.82645% with 120 lines in your changes missing coverage. Please review.
✅ Project coverage is 49.59%. Comparing base (e3e88be) to head (5bf2e7b).
⚠️ Report is 4 commits behind head on master.

Files with missing lines	Patch %	Lines
...icFailures/CryptographicFailuresVulnerability.java	0.00%	60 Missing ⚠️
...sanlabs/internal/utility/PasswordHashingUtils.java	2.85%	34 Missing ⚠️
...rg/sasanlabs/internal/utility/EncryptionUtils.java	0.00%	26 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master     #596      +/-   ##
============================================
- Coverage     51.21%   49.59%   -1.63%     
- Complexity      465      466       +1     
============================================
  Files            70       71       +1     
  Lines          2718     2809      +91     
  Branches        287      301      +14     
============================================
+ Hits           1392     1393       +1     
- Misses         1195     1285      +90     
  Partials        131      131

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

preetkaran20 · 2026-04-28T00:21:44Z

-            LEVEL5_HASH = bytesToHex(hash);
-        } catch (NoSuchAlgorithmException e) {
-            throw new RuntimeException("SHA-256 not available", e);
+    private static final String LEVEL1_SECRET = "letmein";


I think we should create a table and insert secrets in the table and let user find it out by looking at the table. The challenge should not say what is the secret like in our case level 1 is showing the password. Look at Authentication Vulnerability, we just want to tell user to find out the secret by looking at database. Example:

preetkaran20 · 2026-04-28T00:22:42Z

+            // Vulnerable: password is exposed in plaintext in the API response
+            return new ResponseEntity<>(
+                    new GenericVulnerabilityResponseBean<>(
+                            "CHALLENGE: The system stores passwords in plaintext."


This challenge should be that password is stored as plain text, look at database to findout what is the password and crack it.

preetkaran20 · 2026-04-28T00:25:05Z

+        if (password == null || password.isEmpty()) {
+            return new ResponseEntity<>(
+                    new GenericVulnerabilityResponseBean<>(
+                            "CHALLENGE: The system 'encrypts' passwords using Base64 encoding."


dont tell it is base64 encoded, let user find it out. The hint should tell it is base64 encoded. i.e.

preetkaran20 · 2026-04-28T00:27:04Z

+        if (password == null || password.isEmpty()) {
+            return new ResponseEntity<>(
+                    new GenericVulnerabilityResponseBean<>(
+                            "CHALLENGE: A user's password is encrypted with a Caesar cipher:"


Dont tell it is caesar cipher in challenge. Challenge is finding out password. Hint should tell it is Caesar cipher

preetkaran20 · 2026-04-28T00:28:04Z

+    private static final String LEVEL2_ENCODED =
+            Base64.getEncoder().encodeToString(LEVEL2_SECRET.getBytes());
+
+    private static final String LEVEL3_SECRET = "helloworld";


Is it possible to make the secrets little more complex ?

preetkaran20 · 2026-04-28T00:29:00Z

+    private static final String LEVEL3_ENCRYPTED =
+            EncryptionUtils.caesarCipher(LEVEL3_SECRET, LEVEL3_CHAR_SHIFT);
+
+    private static final String LEVEL4_SECRET = "obscuredpassword";


make it a bit complex

preetkaran20 · 2026-04-28T00:29:45Z

+        if (password == null || password.isEmpty()) {
+            return new ResponseEntity<>(
+                    new GenericVulnerabilityResponseBean<>(
+                            "CHALLENGE: A user's password is stored using custom logic: "


This is great !!! we need challenge for user.

preetkaran20 · 2026-04-28T00:30:01Z

+        if (password == null || password.isEmpty()) {
+            return new ResponseEntity<>(
+                    new GenericVulnerabilityResponseBean<>(
+                            "CHALLENGE: A user's password is stored as MD4 hash: "


preetkaran20 · 2026-04-28T00:30:31Z

+    private static final String LEVEL4_SECRET = "obscuredpassword";
+    private static final String LEVEL4_ENCRYPTED = EncryptionUtils.customCipher(LEVEL4_SECRET);
+
+    private static final String LEVEL5_SECRET = "password123";


make secret really strong in this case.

preetkaran20 · 2026-04-28T00:31:09Z

+    private static final String LEVEL5_SECRET = "password123";
+    private static final String LEVEL5_HASH = PasswordHashingUtils.md4Hash(LEVEL5_SECRET);
+
+    private static final String LEVEL6_SECRET = "password123";


Each level password should be different from other levels.

preetkaran20 · 2026-04-28T00:32:29Z

-                                    + LEVEL3_SECRET
-                                    + " — Enter it below to authenticate!",
-                            false),
+                            "SECURE: This password is hashed with LM. Hash: "


Should be CHALLENGE not SECURE

preetkaran20 · 2026-04-28T00:33:02Z

+    private static final String LEVEL7_SECRET = "admin";
+    private static final String LEVEL7_HASH = DigestUtils.sha1Hex(LEVEL7_SECRET);
+
+    private static final String LEVEL8_SECRET = "admin123";


make it little complex secret

preetkaran20 · 2026-04-28T00:34:03Z

+    private static final String LEVEL8_SECRET = "admin123";
+    private static final String LEVEL8_HASH = PasswordHashingUtils.lmHash(LEVEL8_SECRET);
+
+    private static final String LEVEL9_SECRET = "qwertyuiop";


add few numbers too as that adds complexity.

preetkaran20 · 2026-04-28T00:37:15Z

+            return new ResponseEntity<>(
+                    new GenericVulnerabilityResponseBean<>(
+                            "Incorrect. Hint: Think of common passwords '"
+                                    + LEVEL_10_SECRET


we should not return secret.

Secret should not be told to user on failure.

preetkaran20 · 2026-04-28T00:37:51Z

+            EncryptionUtils.encrypt(
+                    LEVEL_10_SECRET, EncryptionUtils.getKeyFromPassword(LEVEL_10_SECRET));
+
+    private static final String LEVEL11_SECRET = "uncrackablePassword";


make this passwrod random generated on each run as this is very secure and we want to tell that no one can guess this.

preetkaran20 · 2026-04-28T00:41:53Z

+        } else {
+            return new ResponseEntity<>(
+                    new GenericVulnerabilityResponseBean<>(
+                            "Incorrect. Hint: Base64 is not encryption — try decoding '"


Just tell it is incorrect. let user user hint section to find out that base64 is used.

preetkaran20 · 2026-04-28T00:42:29Z

+            return new ResponseEntity<>(
+                    new GenericVulnerabilityResponseBean<>(
+                            "Incorrect. The password has been shifted "
+                                    + LEVEL3_CHAR_SHIFT


dont tell the shift size. let user find it out using hint. just tell that the password is incorrect.

preetkaran20 · 2026-04-28T00:43:16Z

+        } else {
+            return new ResponseEntity<>(
+                    new GenericVulnerabilityResponseBean<>(
+                            "Incorrect. "


This is good hiding. Api should return just this.

preetkaran20 · 2026-04-28T00:44:00Z

+            return new ResponseEntity<>(
+                    new GenericVulnerabilityResponseBean<>(
+                            "Incorrect. Your input hashed to: "
+                                    + guessHash


great !!!! telling guessHash is good as user gets some information using this.

preetkaran20

Overall PR looks great. Just some small comments.

aashpis and others added 30 commits March 31, 2026 20:36

reorder levels

b641ac9

add new Cryptographic Failures Vulnerabilities

0468ffb

reordered levels. added new level 3 and 4

5912073

add level 3 - Caesar cipher encryption

2b9635c

updated CRYPTOGRAPHIC_FAILURES_SECURITY_BY_OBSCURTY description

99c8359

add level 4 - security through obscurity

9630009

Merge branch 'SasanLabs:master' into Enhance-Cryptographic-failures-m…

cc76a76

…odule

add md4 and caesarCipher methods

cfa54f7

made bytesToHex public

e1a862a

refactor level_3 logic

0aa0d05

refactor bytesToHex to be called from PasswordHashingUtils

b766ff1

add md4 hashing logic for level 4

c982fc2

move bytesToHex to PasswordHashingUtils

c7da509

add bcrypt description

8080225

add bcrypt hashing and validating functions

26504fa

Level-10 is complete, uses a weak key and one iteration for AES encry…

a30121a

…ption

Merge pull request #1 from aashpis/feature/Level-10

bf0c253

Level-10

Merge branch 'SasanLabs:master' into master

ccd745f

add lm hashing methdos

2b11e8f

add lm hashing description

9840847

add level 8 - lm hashing

7726f38

removed unused imports

8104e12

Merge branch 'Enhance-Cryptographic-failures-module'

a7ce5cd

# Conflicts: # src/main/java/org/sasanlabs/service/vulnerability/cryptographicFailures/CryptographicFailuresVulnerability.java

refactored encryption methods in class

bc0aa7d

add insecure AES-128 description

f11961c

move caesarCipher to EncryptionUtils

12a06e5

reordering levels

5746c51

Merge branch 'SasanLabs:master' into master

0db76f0

Added level 9

49c818d

Merge branch 'SasanLabs:master' into master

6da2d7d

aashpis added 7 commits April 23, 2026 18:02

Merge branch 'Level-9-fast-vs-slow-hash'

bad8914

formatting

cf0101d

formatting

27e1a68

added customCipher

9947bb9

formatting

a117a98

formatting

ab4a32d

spotlessApply foramtting

a962826

syntax correction

5bf2e7b

preetkaran20 reviewed Apr 28, 2026

View reviewed changes

Uh oh!

Conversation

aashpis commented Apr 24, 2026

Uh oh!

codecov-commenter commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

preetkaran20 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

codecov-commenter commented Apr 24, 2026 •

edited

Loading