{% extends 'core/Cryptographic Failures/cryptographic_failures.html' %}
{% load static %}

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
{% block inside-content %}
    <div class="bg-white nav-item flex-grow bg-opacity-20 backdrop-filter backdrop-blur-md w-4/5 problems-container">
        <h1 class="text-center text-white font-bold pb-5">How do I know a Cryptographic Failure?</h1>

        <p class="text-white pb-3">
            First of all, let's ask ourselves, are we using any data encryption at all? And if so, are they not
            deprecated? Some newer frameworks will have some encryption already built in, such as Django or PHP, but you
            need to do it yourself most of the time. Now let's see an example of an encrypted password with the AES
            algorithm.

        <div class="flex flex-grow pt-3 pb-3">
            <pre><code class="python rounded-lg">password = 'password123'
Cypher Mode = 'ECB'
Key size in bits = '128'
Secret Key = 'sd13dAsc2lKn8,js'
Result = 'gqLNfljVLcHC0J4mx1KEqw=='</code></pre>
        </div>
        </p>

        <p class="text-white">
            As you can see, the result of encryption is nothing like the original. For encryption, we use keys, and we
            What algorithms should you use? There are so many to pick from. It would be best if you never stayed fixated
            on one algorithm since new algorithms are created often, and old ones are being cracked. You need to be
            ready to upgrade your encryption every few years.
            <br>Some algorithms you could use are:
        <ul class="list-disc text-white pt-2 pl-5">
            <li>Advances Encryption Standard (AES)</li>
            <li>Triple Data Encryption Algorithm (3DEA)</li>
            <li>Blowfish</li>
            <li>Twofish</li>
            <li>Rivest Cipher (RC4)</li>
            <li>PBKDF2 with RSA hashing</li>
            <li>RSA-2048</li>
        </ul>
        </p>

        <p class="text-white">
            <br>And here are some you should avoid:
        <ul class="list-disc text-white pl-5">
            <li>RSA-768, -1024</li>
            <li>DSA-768, -1024</li>
            <li>DES</li>
            <li>SHA1</li>
            <li>3DES</li>
        </ul>
        </p>

        <p class="text-white pt-3">
            Let's look at how we can easily break weak or outdated algorithms such as, in this case, MD5.
        </p>

        <div class="flex flex-grow pt-3 pb-3">
            <pre><code class="python rounded-lg">import hashlib

def md5_crack(passwords, encrypted):
	for password in passwords:
		guess = hashlib.md5(password.encode('utf-8')).hexdigest()
		if guess == encrypted:
			print(f'[+] Password found: {password}')
			exit(0)
		else:
			print(f'[-] Guess: {password} incorrect... {guess}')
	print(f'Password not found in wordlist...')

def main():
	encrypted = 'ac58b1e8c4d2d0dc8b69b553d36c2758'

	with open('passwords.txt') as f:
		passwords = f.read().splitlines()

	md5_crack(passwords, encrypted)

if __name__ == '__main__':
	main()</code></pre>
        </div>

        <p class="text-white pb-3">
            As you can see, this is a very simple function that cycles through a list of strings (passwords from a text
            file) and encrypts them. Then it compares the output to the one provided by the user, which should be an
            already hashed password obtained by unspecified means. It counts on the fact
            that the user knows what algorithm was used for hashing.<br>
            For this reason, you should always implement newer algorithms combined with hashing, salting, or other
            security measures to ensure
            maximum web application security.
        </p>

        <div class="bg-gray-900 flex-grow pt-5 pb-5 px-4 rounded-xl" style="background-color: #2b2b2b">
            <img class="rounded-xl mx-auto" src="/static/img/md5.png" alt=""/>
            <p class="text-white pt-3 text-center">
                Output of the MD5 cracker.
            </p>
        </div>

        <h1 class="text-white font-bold pb-3 pt-3">File Download:</h1>

        <p class="text-white pb-3">
            Feel free to try it out and play around with it yourself.<br>
            For correct functionality, you need both files.
        </p>

        <div class="bg-gray-700 hover:bg-gray-900 text-white font-bold py-2 px-4 rounded-full inline-flex items-center font-medium">
            <svg class="w-6 h-6 text-white" fill="none" stroke="currentColor" viewBox="0 0 24 24"
                 xmlns="http://www.w3.org/2000/svg">
                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
                      d="M9 13.5l3 3m0 0l3-3m-3 3v-6m1.06-4.19l-2.12-2.12a1.5 1.5 0 00-1.061-.44H4.5A2.25 2.25 0 002.25 6v12a2.25 2.25 0 002.25 2.25h15A2.25 2.25 0 0021.75 18V9a2.25 2.25 0 00-2.25-2.25h-5.379a1.5 1.5 0 01-1.06-.44z"></path>
            </svg>
            <button type="submit" class="pl-3"
                    onclick="location.href='{% url 'download_passwords' %}'" name='download'>
                Passwords
            </button>

        </div>

        <div class="bg-gray-700 hover:bg-gray-900 text-white font-bold py-2 px-4 rounded-full inline-flex items-center font-medium">
            <svg class="w-6 h-6 text-white" fill="none" stroke="currentColor" viewBox="0 0 24 24"
                 xmlns="http://www.w3.org/2000/svg">
                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
                      d="M9 13.5l3 3m0 0l3-3m-3 3v-6m1.06-4.19l-2.12-2.12a1.5 1.5 0 00-1.061-.44H4.5A2.25 2.25 0 002.25 6v12a2.25 2.25 0 002.25 2.25h15A2.25 2.25 0 0021.75 18V9a2.25 2.25 0 00-2.25-2.25h-5.379a1.5 1.5 0 01-1.06-.44z"></path>
            </svg>
            <button type="submit" class="pl-3"
                    onclick="location.href='{% url 'download_script_ia' %}'" name='download'>
                Script
            </button>
        </div>

    </div>
{% endblock %}
</html>