Description

Detects the use of hardcoded salt values in password hashing when using Rfc2898DeriveBytes in C# code. Using hardcoded salts undermines the security of password hashing since salts should be randomly generated for each password to prevent rainbow table attacks.

Detection Strategy

• Identifies calls to the Rfc2898DeriveBytes constructor or method

• Examines the second argument (salt parameter) passed to Rfc2898DeriveBytes

• Reports a vulnerability if the salt parameter is a hardcoded value (like a string literal or constant) rather than a randomly generated value

• The detection specifically looks for cases where the salt is statically defined in the code instead of being dynamically generated

Vulnerable code example

using System;
using System.Security.Cryptography;
using System.Text;

public class PasswordHasher
{
    public static byte[] DeriveKey(string password)
    {...

✅ Secure code example

using System;
using System.Security.Cryptography;
using System.Text;

public class PasswordHasher
{
    public static byte[] DeriveKey(string password)
    {...