Transformations

Hashing with md5, sha256, and hmac

A hash function accepts bytes and deterministically produces a fixed-length digest. The same input produces the same digest, so hashes are useful when reproducing an application’s password, token, checksum, or signature transformation. A hash is not encryption and has no decryption key.

hashlib.md5() and hashlib.sha256() create unkeyed hash objects. hexdigest() returns the digest as printable hexadecimal text. HMAC combines a secret key, a message, and a selected hash function to produce an authentication code; reproducing it requires the same key and message bytes.

import hashlib
import hmac

md5_hash = hashlib.md5(b"pass")
md5_digest = md5_hash.hexdigest()

sha256_hash = hashlib.sha256(b"pass")
sha256_digest = sha256_hash.hexdigest()

hmac_hash = hmac.new(b"key", b"msg", hashlib.sha256)
hmac_digest = hmac_hash.hexdigest()

_{Find by: hash, md5, sha1, sha256, hashlib, hmac, digest, password hash, checksum, sign}

bcrypt password hash for credential replacement

bcrypt is a password-hashing algorithm that deliberately performs configurable computational work. gensalt() creates a random salt and records the work factor. hashpw() accepts the password bytes and that salt, then returns a complete bcrypt value containing the algorithm version, work factor, salt, and digest.

The plaintext password remains available for authentication after the resulting hash is written into an application password field.

import bcrypt

def generate_bcrypt_hash(password):
    salt = bcrypt.gensalt()
    password_bytes = password.encode()
    hashed_password_bytes = bcrypt.hashpw(password_bytes, salt)
    hashed_password = hashed_password_bytes.decode()
    return hashed_password

password = "<NEW_PASSWORD>"
hashed_password = generate_bcrypt_hash(password)

password_bytes contains the encoded password required by bcrypt.hashpw(). hashed_password_bytes contains the generated bcrypt value as bytes, and hashed_password contains the decoded string suitable for a database field or request payload.

The generated salt is embedded in the returned value, so repeated calls produce different hashes for the same password. The target password-verification path must use bcrypt for the replacement hash to authenticate successfully.

_{Find by: bcrypt, gensalt, hashpw, password hash, credential replacement, database password overwrite, encode, decode, bytes, login chain}

Quote a string as a Python literal with repr()

repr() accepts a Python object and returns its developer-facing string representation. For a string, that representation includes surrounding quote characters and escapes embedded quotes, backslashes, and control characters. The result can therefore be inserted as a Python string literal inside a larger generated Python expression.

command = "cat /etc/passwd; id"
quoted_command = repr(command)
print(quoted_command)

payload = f"...__builtins__['__import__']('os').popen({quoted_command}).read()..."

quoted_command

'cat /etc/passwd; id'

_{Find by: repr, quote, string literal, escape, python payload, ssti, popen, eval, exec, command injection, embed command, quoting}