Insecure service configuration - Salt | Fluid Attacks Database

Database

Description

Salt is generated in an insecure way, which makes the password easier to guess.

Impact

Obtain valid credentials through dictionary attacks.

Recommendation

Generate the Salt with a secure hashing function.

Threat

Anonymous attacker from the Internet.

Expected Remediation Time

⏱️ 30 minutes.

Requirements

266 - Disable insecure functionalities

Rules

Dart Hardcoded Salt In Pbkdf2 Typescript Noble Predictable Kdf Salt Javascript Cryptojs Predictable Pbkdf2 Salt Dart Cryptography Hardcoded Salt Java Hardcoded Salt Literal Javascript Scrypt Js Predictable Salt Dart Pointycastle Argon2 Hardcoded Salt Kotlin Hardcoded Salt Value Typescript Pbkdf2 Predictable Salt C Sharp Hardcoded Plaintext Salt Rust Hardcoded Salt In Bcrypt Java Hardcoded Salt Pbkdf2 Javascript Noble Predictable Kdf Salt Javascript Pbkdf2 Predictable Salt Typescript Forge Predictable Pbkdf2 Salt Scala Hash Without Salt Java One Way Hash Without Salt Go Hardcoded Salt In Scrypt Typescript Cryptojs Predictable Pbkdf2 Salt Php Hardcoded Salt In Hash Typescript Predictable Kdf Salt Go Hardcoded Salt In Pbkdf2 Kotlin Hardcoded Salt Bytes Javascript Predictable Kdf Salt Typescript Scrypt Js Predictable Salt Typescript Hash Wasm Predictable Salt Javascript Forge Predictable Pbkdf2 Salt Javascript Hash Wasm Predictable Salt Scala Hardcoded Salt In Hash

Fixes

Kotlin Python Rust