> For the complete documentation index, see [llms.txt](https://ahmed-tarek.gitbook.io/security-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ahmed-tarek.gitbook.io/security-notes/owsap-top-10-2025/a04-cryptographic-failures/cryptographic-failure.md).
# Cryptographic Failure
To better understand **Cryptographic Failures**, I will walk you through the **Cryptographic Failures module** in TryHackMe’s OWASP Top 10 room. In this scenario, we will analyze a vulnerable **"Sense and Sensitivity"** website.
### **Step 1: Navigate through the login page.**
View the source code of the login page.
> The developer has **left a comment** revealing that the database is stored in the `/assets` directory.
### **Step 2: Navigate to /assets.**
> There is, in fact, a web application database (webapp.db) stored in the /assets directory. Databases stored as files are known as ‘flat-file’ databases.
### **Step 3: Inspect the database file.**
Click on the file to download it.
Determine the file type.
```bash
file webapp.db
```
> The database is a SQlite database
Dump the database
```bash
sqlite3 webapp.db
```
Dump the tables.
```sql
.tables
```
Dump users.
```sql
PRAGMA table_info(users);
SELECT * FROM users;
```
> We now have access to usernames and password hashes. Following the order, the second column contains the usernames, and the third column contains the password hashes.
```
Username:admin
Password Hash:6eea9b7ef19179a06954edd0f6c05ceb
```
### **Step 4: Crack the hash**
Crack the hash using [CrackStation](https://crackstation.net/).
> The hash has been identified as an MD5 hash and successfully cracked to reveal the plaintext password ‘**qwertyuiop**’.
### **Step 5: Login with the derived credentials.**
Navigate back to the login page and use the credentials.
```
Username: admin
Password: qwertyuiop
```
> We now have admin access and can perform actions, including adding and deleting users.
Cryptographic flaws, including the use of weak algorithms such as MD5, coupled with data exposure, can result in the compromise of sensitive information and systems.
