What is Use of a One-Way Hash with a Predictable (CWE-760)?

TL;DR: Use of a One-Way Hash with a Predictable Salt (CWE-760) is a security flaw where predictable salts are used in password hashing. This allows attackers to crack passwords more easily, compromising user accounts and access control mechanisms.

What is Use of a One-Way Hash with a Predictable Salt?

Use of a One-Way Hash with a Predictable Salt (CWE-760) is a type of cryptographic vulnerability that occurs when a predictable salt value is used in the hashing process for irreversible inputs such as passwords. As defined by the MITRE Corporation under CWE-760, and classified by the OWASP Foundation under A04:2025 - Cryptographic Failures, this weakness undermines password security by allowing attackers to perform more efficient brute force attacks or use precomputed rainbow tables.

Quick Summary

Use of a One-Way Hash with a Predictable Salt is critical because predictable salts enable attackers to crack passwords far faster than they would otherwise. This can lead to unauthorized access and compromise user accounts across systems that rely on hashed credentials for authentication. Jump to: Overview · How It Works · Business Impact · Attack Scenario · Detection · Fix · Framework-Specific Fixes · Ask AI · Best Practices Checklist · FAQ · Related Vulnerabilities

Jump to: Quick Summary · Use of a One-Way Hash with a Predictable Salt Overview · How Use of a One-Way Hash with a Predictable Salt Works · Business Impact of Use of a One-Way Hash with a Predictable Salt · Use of a One-Way Hash with a Predictable Salt Attack Scenario · How to Detect Use of a One-Way Hash with a Predictable Salt · How to Fix Use of a One-Way Hash with a Predictable Salt · Framework-Specific Fixes for Use of a One-Way Hash with a Predictable Salt · How to Ask AI to Check Your Code for Use of a One-Way Hash with a Predictable Salt · Use of a One-Way Hash with a Predictable Salt Best Practices Checklist · Use of a One-Way Hash with a Predictable Salt FAQ · Vulnerabilities Related to Use of a One-Way Hash with a Predictable Salt · References · Scan Your Own Site

Use of a One-Way Hash with a Predictable Salt Overview

What: A predictable salt is used in the hashing process for irreversible inputs like passwords.
Why it matters: It allows attackers to use precomputed rainbow tables or perform brute force attacks more efficiently, compromising password security and access control mechanisms.
Where it occurs: In any application that uses a one-way hash function with insufficiently random salts.
Who is affected: Applications and systems storing user passwords using predictable salts are at risk.
Who is NOT affected: Systems already using adaptive hashing functions like bcrypt, scrypt, or PBKDF2.

How Use of a One-Way Hash with a Predictable Salt Works

Root Cause

The root cause lies in the use of a predictable salt value during password hashing. This predictability allows attackers to precompute rainbow tables for common salts, significantly reducing the time required to crack passwords through brute force attacks.

Attack Flow

1. Attacker identifies that the system uses predictable or static salts.
2. The attacker generates rainbow tables for these known salts.
3. Using the generated tables, the attacker can quickly find corresponding hash values and crack user passwords.
4. Once cracked, the attacker gains unauthorized access to user accounts.

Prerequisites to Exploit

• Knowledge of the salt generation mechanism used by the application.
• Access to a large number of precomputed rainbow tables for common salts.

Vulnerable Code

import hashlib

def hash_password(password):
    salt = 'static_salt'
    hashed_password = hashlib.sha256(salt.encode() + password.encode()).hexdigest()
    return hashed_password

This code demonstrates the use of a static, predictable salt value in password hashing.

Secure Code

from bcrypt import gensalt, hashpw

def hash_password(password):
    salt = gensalt(rounds=12)
    hashed_password = hashpw(password.encode(), salt).decode()
    return hashed_password

This secure code uses bcrypt to generate a strong random salt and applies adaptive hashing to increase computational overhead for attackers.

Business Impact of Use of a One-Way Hash with a Predictable Salt

Confidentiality: Attackers can use precomputed rainbow tables or brute force attacks to crack passwords, leading to unauthorized access to sensitive data.

• Example: An attacker uses rainbow tables to quickly find the password hashes and gains access to user accounts.

Integrity: Compromised passwords can lead to unauthorized modification of system data.

• Example: Once an attacker has a valid set of credentials, they may modify or delete critical system configurations.

Business Consequences

• Financial loss due to compromised customer data.
• Regulatory fines for non-compliance with data protection regulations.
• Damage to reputation and trust among users.

Use of a One-Way Hash with a Predictable Salt Attack Scenario

1. The attacker identifies that the application uses predictable salts in password hashing.
2. Using this information, the attacker generates rainbow tables for common salts used by the system.
3. With these tables, the attacker can quickly find corresponding hash values and crack user passwords.
4. Once cracked, the attacker gains unauthorized access to user accounts.

How to Detect Use of a One-Way Hash with a Predictable Salt

Manual Testing

• Check for hardcoded or predictable salt values in password hashing functions.
• Ensure that salts are generated using strong random number generators.
• Verify that salts are stored alongside hashed passwords and are unique per user.

Automated Scanners (SAST / DAST)

Static analysis can identify the use of static or predictable salts, while dynamic testing is needed to confirm if these salts are actually used during runtime hashing operations.

PenScan Detection

PenScan’s automated scanners such as ZAP and Wapiti actively detect instances where predictable salts are being used in password hashing functions.

False Positive Guidance

A finding may be a false positive if the salt appears predictable but is generated securely at runtime or is part of an adaptive hash function designed to resist brute force attacks.

How to Fix Use of a One-Way Hash with a Predictable Salt

• Use adaptive hash functions like bcrypt, scrypt, or PBKDF2 that automatically handle salting with strong random values.
• Ensure salts are generated using cryptographically secure pseudo-random number generators (CSPRNG).
• Store the salt alongside the hashed password and ensure it is unique per user.

Framework-Specific Fixes for Use of a One-Way Hash with a Predictable Salt

Python/Django Example

from bcrypt import gensalt, hashpw

def hash_password(password):
    salt = gensalt(rounds=12)
    hashed_password = hashpw(password.encode(), salt).decode()
    return hashed_password

How to Ask AI to Check Your Code for Use of a One-Way Hash with a Predictable Salt

Use of a One-Way Hash with a Predictable Salt Best Practices Checklist

✅ Ensure salts are generated using cryptographically secure random number generators. ✅ Store the salt alongside the hashed password and ensure uniqueness per user. ✅ Use adaptive hash functions like bcrypt, scrypt, or PBKDF2 to increase computational overhead for attackers. ✅ Regularly audit your codebase for predictable salt usage.

Use of a One-Way Hash with a Predictable Salt FAQ

How does Use of a One-Way Hash with a Predictable Salt work?

It occurs when a one-way hash function is used to store passwords, but the salt value is predictable or static.

Why is it important to use adaptive hash functions like bcrypt?

Adaptive hash functions increase computational overhead for attackers attempting brute force attacks and protect against rainbow table attacks.

Can you provide an example of a predictable salt in code?

A predictable salt might be a static value or a simple incrementing number added before hashing the password.

How can I detect Use of a One-Way Hash with a Predictable Salt manually?

Look for hardcoded salts, non-random salts, or salts that change predictably between users or iterations.

What are some common pitfalls when fixing this vulnerability?

Common mistakes include using weak random number generators or failing to store the salt alongside the hash.

How do I prevent Use of a One-Way Hash with a Predictable Salt in Java applications?

Utilize libraries like BCrypt or Argon2, which automatically handle salting and hashing securely.

What are some best practices for mitigating this vulnerability across different frameworks?

Always use framework-specific secure hash functions designed to resist brute force attacks.

Vulnerabilities Related to Use of a One-Way Hash with a Predictable Salt

| CWE | Name | Relationship | |—|—|—| | CWE-916 | Use of Password Hash With Insufficient Computational Effort | ChildOf |

References

• MITRE - CWE-760
• OWASP Top 10:2025 A04 - Cryptographic Failures
• NVD - National Vulnerability Database

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Use of a One-Way Hash with a Predictable Salt and other risks before an attacker does.