Cryptography Fundamentals

Cryptography underlies almost all security: passwords (hashing), communications (TLS), tokens (JWT), certificates (PKI). You don’t need to be a mathematician, but you do need to understand what each primitive guarantees, when it’s misused, and how weak implementations are attacked. In pentesting, broken crypto is rarely the algorithm —it’s almost always how it’s used.

The three families

Hashing (one-way): turns data into a fixed, irreversible fingerprint. MD5, SHA-1 (broken), SHA-256, and for passwords bcrypt/scrypt/argon2 (deliberately slow).
Symmetric encryption (one key): encrypts and decrypts with the same key. AES is the standard. Fast; the challenge is sharing the key.
Asymmetric encryption (key pair): public key encrypts, private decrypts (and signs). RSA, ECC. Basis of TLS and PKI.

Hashing and passwords (the most exploited)

Passwords are never stored in the clear: their hash is stored. An attacker who steals hashes tries to crack them:

# identify the hash
hashid '$2b$...'   # bcrypt
# crack
hashcat -m 0 hashes.txt rockyou.txt       # MD5
hashcat -m 1000 hashes.txt rockyou.txt     # NTLM (Windows)
hashcat -m 3200 hashes.txt rockyou.txt     # bcrypt
john --wordlist=rockyou.txt hashes.txt

Key concepts: salt (prevents rainbow tables and identical hashes for equal passwords), pepper, and why MD5/SHA-1 without salt are indefensible for passwords.

Where it fails in practice (not the algorithm)

Weak or unsalted hashes for passwords → fast cracking.
ECB mode in block ciphers → visible patterns (the “ECB penguin”).
Reused keys/IVs, repeated nonces.
Hardcoded secrets in code or repos (see Git for Hacking/Code Repository OSINT).
JWT: alg: none, weak HMAC key, algorithm confusion (see JWT attacks).
Padding oracle, length extension on badly built MACs.
Predictable randomness (non-cryptographic PRNG for tokens/sessions).

TLS, certificates, and PKI

TLS encrypts communications and authenticates the server with a certificate signed by a CA. In pentesting it matters: weak versions/ciphers (SSLv3, RC4), expired/self-signed certificates, and the corporate PKI (AD CS) as an escalation path (see AD CS (Active Directory Certificate Services)).

# audit a service's TLS
sslscan target:443 ; testssl.sh target
openssl s_client -connect target:443

Encoding ≠ encryption (frequent mistake)

Base64, hex, URL-encoding do NOT encrypt: they only represent data. A “token” in Base64 decodes trivially. Recognize and decode them:

echo "dGVzdA==" | base64 -d        # base64
echo -n "test" | xxd               # hex

Why it matters in security

Cracking dumped hashes (SAM, NTDS, /etc/shadow) is pure post-exploitation. Recognizing misused crypto (insecure JWT, ECB, hardcoded secrets, weak TLS) is an audit finding. And understanding hashing/salt lets you explain to the client why their password storage is (or isn’t) defensible. It’s cross-cutting to almost every area.

What each thing guarantees (services)

Don’t confuse the services: it’s the root of most usage flaws.

Confidentiality   that no one reads the data   -> encryption (AES, RSA/ECC)
Integrity         that it isn't altered        -> hash, MAC
Authenticity      that it comes from who it claims -> MAC (HMAC), digital signature
Non-repudiation   that they can't deny it      -> digital signature (asymmetric)

Encryption does not give integrity (that’s why AEAD exists: AES-GCM); a hash does not give authenticity (that’s why HMAC exists, not hash(key+message)). Choosing the primitive by the service you actually need avoids 90% of errors.

Cryptography area map (where each topic goes deeper)

crypto-basics   concepts and the implementation-flaw catalog
crypto-sym      symmetric vs asymmetric and modes (ECB/CBC/CTR/GCM)
crypto-hash     hashing, cracking, length extension, collisions
crypto-pki      asymmetric, certificates, chain of trust, JWT
crypto-tls      TLS/handshake, PFS, historical attacks (Heartbleed, POODLE...)
crypto-padding  padding oracle (decrypt without the key)
crypto-rng      weak randomness (predictable tokens/keys)
crypto-stego    steganography (hide instead of encrypt)

This card is the cross-cutting overview; each block has its own card with by-hand exploitation and defense.

Mastery checklist

I distinguish hashing, symmetric, and asymmetric encryption
I can explain salt, pepper, and why MD5/SHA-1 fail for passwords
I identify and crack hashes with hashcat/john (common modes)
I recognize usage flaws: ECB, reused IV/nonce, insecure JWT
I distinguish encoding (base64/hex) from encryption and decode them
I do basic TLS auditing (sslscan/testssl) and recognize weak crypto
I understand certificates/PKI and their relation to AD CS