Lesson 1 of 6

How Passwords Are Stored

Understanding how applications store passwords is the foundation of both attacking and defending authentication systems. You will learn why plaintext storage is catastrophic, how hashing works as a one-way function, and why the same password can produce different hashes depending on how it is stored. This lesson explains the technical reality behind every password breach you have ever read about.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

This is asking you to build a clear mental model of the concept — not just memorize a definition, but genuinely understand what it means, why it exists, and how it connects to everything else you are learning. When you can explain "how passwords are stored in Linux and Windows" in your own words to someone who has never heard of it, you have truly learned it.

Why this matters

Weak passwords are still the number one cause of data breaches worldwide. Understanding how passwords are stored, attacked, and defended lets you build systems that are genuinely hard to compromise — and helps you advise clients on real password policies that actually work.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Audit password policies for an organization, demonstrate the risk of weak passwords using controlled testing, and recommend specific, practical improvements that actually reduce risk without making the system unusable.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

How Passwords Are Stored · Objective 1 of 4

VIDEO

Loading video…

Read the shadow file

On a Linux system, run 'sudo cat /etc/shadow' to display the shadow file, which stores hashed passwords for all local user accounts. Each line follows the format 'username:$id$salt$hash:lastchanged:min:max:warn:inactive:expire' — the $id field identifies the hashing algorithm (1=MD5, 5=SHA-256, 6=SHA-512, 2y=bcrypt). You need root or sudo access to read this file because it is owned by root with permissions 640 or 000. In a penetration test, gaining read access to /etc/shadow is a critical finding — it means you can attempt offline password cracking against every account on the system.

Identify the hash type

Look at the second field of each shadow entry and identify the algorithm prefix: $1$ is MD5-crypt, $5$ is SHA-256-crypt, $6$ is SHA-512-crypt, and $2y$ or $2b$ is bcrypt. Modern Linux distributions default to SHA-512 ($6$), which is significantly harder to crack than MD5 ($1$) due to its computational cost. An entry with no hash (just '!' or '*') means the account is locked or has no password set. Run 'sudo grep -v '!\|\*' /etc/shadow' to filter out locked accounts and focus only on accounts with crackable hashes.

Combine passwd and shadow

Run 'sudo unshadow /etc/passwd /etc/shadow > combined.txt' to merge the passwd and shadow files into a single file in the format that John the Ripper expects. The unshadow tool is part of the John the Ripper package and is pre-installed on Kali Linux. The combined file contains one entry per user with the username and hash on the same line, which John needs to map cracked passwords back to usernames. Verify the output looks correct by running 'head -5 combined.txt' and confirming each line has the expected format.

Identify hash format for Hashcat

Run 'hashid <hash-value>' or 'hash-identifier' to identify the hash format for use with Hashcat. Hashcat uses numeric mode codes rather than names — SHA-512-crypt is mode 1800, MD5-crypt is mode 500, and bcrypt is mode 3200. You can also look up the mode in Hashcat's example hashes page at hashcat.net/wiki/doku.php?id=example_hashes. Choosing the wrong mode causes Hashcat to either reject the hash or produce incorrect results — always verify the mode matches the hash format before starting a long cracking session.

Back to course Next Lesson