Context of the hashing issue
During a web assessment, Excellium’s Intrusion & AppSec team audited a PHP application where users passwords were stored using the bcrypt hashing algorithm. As bcrypt 1https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.htmlis still a valid and recommended algorithm to hash passwords, compromising passwords 2https://github.com/danielmiessler/SecLists/tree/master/Passwords/Common-Credentials should not be an easy task. However, sometimes, the devil is in the details.
