Weak Hashing Algorithm

MD5 and SHA1 are weak hashing algorithms and open to collision attacks. They are not suitable for cryptographic signature.

Remediation

At the time of writing, SHA3 is recommended. Best to use a slow hashing algorithm like `bcrypt`.
Ensure that the design allows one hashing algorithm to be replaced with another.

Metadata

Severity: low
Slug: weak-hashing-algorithm

CWEs

916: Use of Password Hash With Insufficient Computational Effort
327: Use of a Broken or Risky Cryptographic Algorithm
328: Use of Weak Hash

OWASP

A02:2021: Cryptographic Failures

Available Labs

Select a language to explore available labs for this vulnerability.

1 Lab

Java Labs

Java 1 lab

Explore 1 lab in Java.

1 Lab

Javascript Labs

Javascript 1 lab

Explore 1 lab in Javascript.

1 Lab

Python Labs

Python 1 lab

Explore 1 lab in Python.

No matching labs found

Try adjusting your language filter.

Play AppSec WarGames

Want to skill-up in secure coding and AppSec? Try SecDim Wargames to learn how to find, hack and fix security vulnerabilities inspired by real-world incidents.

For Companies Play Now

Got a comment?

Join our secure coding and AppSec community. A discussion board to share and discuss all aspects of secure programming, AppSec, DevSecOps, fuzzing, cloudsec, AIsec code review, and more.