PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Identifying and Remediating CWE-328 Reversible One-Way Hash in Django Applications

hackerone.com | vulnerability | #web-security | #python | #django | #cwe-328 | #hashing | #password-storage
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Weak algorithms like MD5, improper salting, and homemade hash functions make Django password hashing reversible, violating CWE-328. Learn to spot the flaws and move to stronger, salted schemes.
Published
Collected

Related coverage

research · hackerone.com
Understanding the Benefits of Key Derivation Functions: A Deep Dive into PBKDF2
PBKDF2 hardens password hashing via salting and many iterations, making brute-force and rainbow table attacks far costlier than with fast hashes like MD5 or SHA-1. Includes a Python example.
Medium · vulnerability · bishopfox.com
Python Software Foundation - Python 3.11.0a3 to 3.15.0b2
Bishop Fox discloses CVE-2026-12003, a Windows-only CPython path-construction flaw letting a low-privilege user hijack execution when a privileged account runs Python; fixed in 3.13.15, 3.14.7 and 3.15.0b3.
Critical · vulnerability · xbow.com
Beyond the Bands: Exploiting TiTiler’s Expression Parser for Remote Code Execution
A methodical study of TiTiler's expression parser that ends in arbitrary Python code execution on the server, with a bonus arbitrary file read saved for a follow-up post.
vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
vulnerability · yeswehack.com
Dojo challenge #32 winners!
Winners and best writeups of Dojo challenge #32, 'Security Panel': exploiting a class pollution (Python prototype pollution) bug to capture the flag; top reports by Kant1, ambush and denabled.
vulnerability · vercel.com
The Vercel Bug Bounty Program is now publicly available
Vercel's Bug Bounty Program is now public on HackerOne, covering all Vercel products and open-source projects. Learn how to participate and report findings.
Back