Description

This detector identifies hardcoded salt values used in PBKDF2 key derivation functions in Go code. Hardcoded salts make password hashing predictable and vulnerable to rainbow table attacks, as the same password will always produce the same hash. Using static salts defeats the primary purpose of salting, which is to ensure unique hashes for identical passwords across different systems.

Detection Strategy

• Scans Go source code for imports of the PBKDF2 cryptographic library

• Identifies calls to the pbkdf2.Key function used for password-based key derivation

• Examines the second argument (salt parameter) of pbkdf2.Key function calls

• Reports a vulnerability when the salt argument is a hardcoded string literal or constant value instead of a dynamically generated random salt

Vulnerable code example

package main

import (
	"crypto/sha256"
	"golang.org/x/crypto/pbkdf2"
)

func weakPbkdf2(password string) {...

✅ Secure code example

package main

import (
	"crypto/rand"
	"crypto/sha256"
	"golang.org/x/crypto/pbkdf2"
)
...