Sensitive Data Exposure — SQLite & Hash Cracking

If you have never thought about how websites store your password, you are in exactly the right place. This lesson introduces one of the most common security failures in real applications — and you will exploit it hands-on.

What happens when you create an account?

When you sign up to a website, the site has to remember your password so it can verify you the next time you log in. But storing your actual password — the word itself — would be catastrophic if an attacker ever broke into the server. So instead, websites store a hash of your password.

A hash is the output of a mathematical function that takes your password and produces a fixed-length string of characters. The same input always produces the same output, but there is no direct way to reverse it. When you log in, the site hashes whatever you typed and compares it to the stored hash.

The hashes look random, but they are completely deterministic — given the same input, you always get the same output.

The problem: not all hashing algorithms are equal

MD5 is one of the oldest hashing algorithms. It was designed in 1991 for verifying file integrity — not for protecting passwords. The fatal flaw: it is extremely fast. A modern graphics card can compute ten billion MD5 hashes per second.

That speed means an attacker who steals a database of MD5-hashed passwords can attempt every word in a dictionary, every common password, and every variation — and finish in minutes.

Even worse: because MD5 is deterministic and universally known, people have precomputed the hashes of millions of common passwords and published them in searchable databases called rainbow tables. If your password is in those tables, your hash can be reversed in milliseconds — no computation required.

What makes it an exposure problem?

The vulnerability in this lesson combines two separate failures:

• The database was exposed — A backup file was left at a publicly accessible URL, with no authentication required to download it.
• Passwords were hashed with MD5, without a salt — Once the attacker has the hash, cracking common passwords is trivial.

Either failure alone would be serious. Together they are catastrophic.

What you will do in this lesson

The application on the right is MedRecords Corp — a fictional patient portal with a misconfigured backup endpoint. Your goal:

• Discover the exposed database backup URL
• Open the database and find the administrator's password hash
• Use Crackstation to reverse the MD5 hash into its original password
• Log into the admin portal with that password and retrieve the challenge flag

Everything happens in your browser. No tools to install, no command line required.