Insecure Random Number Generator

The usage of an insecure pseudo-random number generator for security purposes is dangerous as it can make passwords, API keys, or other secrets guessable. While random number generators serve various purposes, not all generators or their usage are suitable for security.

For instance, a generator requires a strong seed for initialization; otherwise, the sequence of random numbers can be guessed.

Remediation

Use a Pseudo-Random Number Generator (PRNG) with a strong random seed.
Utilize hardware-based PRNGs.

Metadata

Severity: medium
Slug: insecure-random-number-generator

CWEs

338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
337: Predictable Seed in Pseudo-Random Number Generator (PRNG)

OWASP

A02:2021: Cryptographic Failures

Available Labs

Select a language to explore available labs for this vulnerability.

1 Lab

Artificial Intelligence Labs

Artificial Intelligence 1 lab

Explore 1 lab in Artificial Intelligence.

1 Lab

C Labs

C 1 lab

Explore 1 lab in C.

1 Lab

Csharp Labs

Csharp 1 lab

Explore 1 lab in Csharp.

1 Lab

Go Labs

Go 1 lab

Explore 1 lab in Go.

2 Labs

Java Labs

Java 2 labs

Explore 2 labs in Java.

1 Lab

Javascript Labs

Javascript 1 lab

Explore 1 lab in Javascript.

1 Lab

Ruby Labs

Ruby 1 lab

Explore 1 lab in Ruby.

1 Lab

Typescript Labs

Typescript 1 lab

Explore 1 lab in Typescript.

No matching labs found

Try adjusting your language filter.

Play AppSec WarGames

Want to skill-up in secure coding and AppSec? Try SecDim Wargames to learn how to find, hack and fix security vulnerabilities inspired by real-world incidents.

For Companies Play Now

Got a comment?

Join our secure coding and AppSec community. A discussion board to share and discuss all aspects of secure programming, AppSec, DevSecOps, fuzzing, cloudsec, AIsec code review, and more.