This intermediate, challenge-only project reviews how to classify protected artifacts, recover a priority credential, and measure predictable password weakness. You will work from supplied evidence files and produce concise audit artifacts with standard Linux cryptography and password-recovery tools.
The course keeps encoding, integrity, encryption, and password hashing conceptually separate. It then asks you to choose focused recovery strategies from known context instead of relying on indiscriminate brute force.
What You Will Learn
- Decode a Base64-encoded passphrase clue without treating encoding as encryption
- Verify a file against a supplied SHA-256 checksum and record its integrity status
- Identify AES-256-CBC parameters and decrypt a PBKDF2-protected artifact with OpenSSL
- Identify an
md5cryptpassword hash before selecting a cracking format - Build a compact, context-driven wordlist from organizational password clues
- Recover and report a simulated priority credential with John the Ripper
- Generate targeted password mutations from company, seasonal, numeric, and symbol patterns
- Crack a small audit set and count the accounts affected by the weak pattern
Who This Course Is For
This course is for learners who understand basic cryptography and password hashing and want an independent audit project. It suits aspiring security analysts and penetration testers who need to distinguish artifact types, choose proportionate recovery methods, and turn cracked results into evidence of policy weakness.
Prerequisites: Comfortable with a Linux shell, file redirection and filtering; basic familiarity with Base64, checksums, symmetric encryption, password hashes, wordlists, and authorized password auditing.
Learning environment: An Ubuntu 22.04 LabEx VM with local synthetic artifacts and credentials, OpenSSL, GNU core utilities, hashid, and John the Ripper. No external target or account is used.
Frequently Asked Questions
Is this a guided beginner course?
No. It contains three challenge-based assessments. Each challenge specifies the evidence and required output, but you must select and apply the commands and recovery workflow yourself.
Do I need Hashcat or a GPU?
No. The password exercises use hashid and John the Ripper with very small, targeted wordlists. Hashcat is not used, and no special cracking hardware is required.
Are the hashes and recovered credentials real?
No. The encrypted message, md5crypt hashes, company clues, usernames, and passwords are synthetic training data stored locally in the VM.
Does the course configure an enterprise password policy?
No. It demonstrates a policy weakness by generating predictable mutations, recovering all three supplied audit accounts, and recording the affected-account count. It does not deploy or enforce a password policy.
