Flag weak cryptography and password hashing

Search for fast hashes on passwords and insecure cipher modes. Passwords need a slow KDF, not a digest.

grep -rEn "MD5|SHA1|DES|ECB|Random()|mt_rand|Math.random" --include=*.{java,py,js,ts,php,go,cs} .
grep -rEn "AES/ECB|Cipher.getInstance("AES")" --include=*.java .

The insecure form hashes passwords with a digest.

hashlib.sha256(password.encode()).hexdigest()   # use bcrypt/argon2/scrypt

Pro note: a static or missing IV on CBC breaks confidentiality even with AES, so check that IVs are random per message and stored, not hardcoded. Password storage should be argon2id or bcrypt with a sensible cost; anything reversible or fast is a finding.