Imagine if you will that you and I are cooking a steak and we are given two identical steaks
to cook. And we are given the identical set of instructions of cooking to medium rare.
Nothing else. So both of us using identical pots and pans and burners and all this other stuff,
take our steaks, put them in the skillets and cook them to medium rare. Both steaks are cooked
exactly the same and should come out exactly the same. Well, the difference being that not
everybody wants a steak and not everybody wants a steak medium rare. They may want some seasoning
added to it. And that's where salting comes in. So I have the skillet with the steak that's going
to be cooked to medium rare with nothing on it and nothing in it. And you have the steak that's
going to be put on the skillet added with some seasoning. And even if that steak is also cooked
to medium rare, our two steaks are going to be completely different because mine is just a
regular steak that's cooked to medium rare with nothing on it. And yours has a lot of seasoning
added to it and it's going to taste completely different than the one that I just cooked.
And that's password salting. Now, in POSIX-based systems, we have passwords that are hashed to a
specific algorithm based on the preferences and defaults of that particular POSIX-based system.
Kali has their preference. Umutu has their preference, et cetera, et cetera. The difference
being that you may have multiple different passwords on that system, multiple users.
We're going to add a little bit of salt to each user. So that way, not all passwords are
done exactly the same. Because in hashing, you can generally take a hash in a known
hashing algorithm, take the actual hash of it, reverse it, and get the actual phrase from it
with no salting. Now to demonstrate what I'm talking about here, I have this website pulled
up and I'll put a link to this below. And what this does, it allows us to take some plain text
and convert it to all the different types of hashing that this website can think of.
I'll zoom in for you real quick. And you can see that we have NTLM, which is very familiar in those
Windows XP systems out there. And MD5, MD6, SHA, SHA, SHA, CRC, all the different ones out there.
And what we do is we type in a phrase here and hit calculate hash, and it will generate the
hashes for all those different algorithms. So for instance, we'll just type in password
because we have no minimum password requirements on our imaginary system here. And I'm going to
hit calculate hash. And you can see here that we have all the different hashes for what password
would be converted to if we had no salting. And I say if we have no salting, because
if I go back and just, let's say, let me refresh it and that way we can do it again.
If you go through and say password again, again, no salts or anything like that, and say calculate
hashes, they're going to be exactly the same no matter how many times you've tried this.
So this is cooking our steak at medium rare, for instance, with no seasoning whatsoever.
So if I do this on this website with password, this is what will come out. If you do this on
this with the phrase password and hit calculate hashes, the exact same thing will come out.
It's all done medium rare with no seasoning. So we add salts inside of our POSIX based systems to
add a little bit of seasoning to shuffle things up just a little bit. And it makes things a whole
lot more difficult to reverse engineer said password from hash to plain text. Now I have
another site here for you to practice with if you want at home. And what this does, it allows us to
be able to do the exact same thing, hash calculations, with salts or no salts. And I'm
going to do this first one with no salts to show you what I'm talking about here. So as I zoom in
for you, you can see that we have in our plain text box password, which is what we were using
previously in the previous website. And I have no salt, and I'm going to create the hashes for
this. So I'm going to do that. And you can see that it generates all the hashes that we want
right here on the website, which is fantastic. But I'm going to highlight MD5 right here and
zoom in for you. You can see that the hash ends with CF99. If we go back to our previous site
right here and go to MD5, you can see that we have the exact same hash.
Let's add some salt to it. Going back to our hash calculator. Now with the plain text of
still be a password and adding a salt of one, just as an example, we're going to create hashes
and go to MD5 right here. And you can see that the hash for this has changed,
but the actual phrase in plain text of password has not. So this is a way for us to be able to
have our algorithms in hashing format change. So that way we don't have the exact same translation
from plain text to hash and hash to plain text. You may be wondering, what does that look like
going from, as an example, MD5 to plain text when we add our salt in, because we have password with
the salt of one now. And I'm just going to give you a quick example because I have a third
website for us to take a look at. And this is just basically taking MD5 and I'm just picking on it
because it's one of the weaker hashing algorithms to be able to take MD5 to plain text. So you can
put in the top box, your plain text to convert to MD5 or in the box below, you could take your MD5
text or output and have it convert to plain text. So let's go over to our hash calculator.
Matter of fact, let's go to the first one, this one right here where we had no salting whatsoever.
We'll copy that MD5 hash, go over to our MD5 converter, paste it in there and say convert
to plain text. And you can see there that it converted it right there straight to password.
So that's a one-for-one translation from plain text MD5, MD5 back to plain text.
Now, if we go to our hashing calculator here, where we added the salt of one in there,
you can see right here that we're now going to paste this in and hit to text. The difference
being that we now have password and one. So what happened here? Well, the password in plain text
was appended by the actual salt. So did it convert all the way back to the original plain
text password that we inputted? No, it appended to password plus our salt of one. So it will convert
that algorithm from MD5 back to plain text using that salt that we inputted. So you may be able to
convert something like this here and see the password and say their password is not password
one. It's actually password and the salt we used was one. It's just an example for us to see how
salting affects that different plain text of the password input and how it's actually configured
inside of the different operating systems.