Loading
During a security audit at Sahyog Bank, the team found one employee password hash in an old backup. The password was weak, so the auditors want you to crack it the honest way: with a wordlist.
Hashing is one-way, but if the password is a common word, you can hash every word in a list and compare. That is called a dictionary attack, and it is why weak passwords are dangerous.
What you are given: the SHA-256 hash below, and a list of 30 common passwords.
What to find: the word that produces the hash. Then build the flag exactly like this: the letters MXC, an opening brace, the text cracked_, the word you found, an underscore, the 4 characters printed below, and a closing brace.
The Researcher Toolkit has a hash tool that computes SHA-256 for you.
Target hash:
8f398886c326b5f8f07b20ac250c87de6723e062474465273fe1524f2b9092fa
Wordlist (30 words):
password
qwerty
letmein
dragon
monkey
football
iloveyou
admin
welcome
login
abc123
starwars
master
hello
freedom
whatever
trustno1
superman
michael
shadow
sunshine
princess
sunflower
computer
cheese
pepper
coffee
summer
winter
tiger
The 4 characters for the flag: zfbf
This challenge only. All names, addresses and data are fictional. Do not test any real system.
Stuck? Open hints in order: a nudge, then the next step, then an explicit pointer. Costs are taken from this solve's points.
Sign in to open hints.
Sign in to submit a flag.
Sign in, then solve this challenge or give up on it to read write-ups.