When passwords are stored with weak hashing algorithms, attackers can obtain the original passwords from the database. This vulnerability is called:

When passwords are stored with weak hashing algorithms, attackers can obtain the original passwords from the database. This vulnerability is called:

• A. Timeout Exploitation
• B. Access Control
• C. Password Exploitation
• D. Missing Function Level Access Control

Answer: (C)

Weak password storage lets an attacker resist the hash and crack the credentials offline. When passwords are protected with a weak hashing algorithm (especially without unique salts), a database breach enables the attacker to brute-force or use precomputed rainbow tables to recover the original passwords. This is known as password exploitation—the attacker exploits poorly stored credentials to obtain plaintext passwords. It isn’t about timeouts, access control, or missing function level access control, which relate to authorization or session handling rather than recovering passwords from hashes. To prevent this, store passwords with strong, salted hashes (like bcrypt, scrypt, or Argon2) using unique salts per password, and consider additional safeguards like peppering and MFA.

Weak password storage lets an attacker resist the hash and crack the credentials offline. When passwords are protected with a weak hashing algorithm (especially without unique salts), a database breach enables the attacker to brute-force or use precomputed rainbow tables to recover the original passwords. This is known as password exploitation—the attacker exploits poorly stored credentials to obtain plaintext passwords. It isn’t about timeouts, access control, or missing function level access control, which relate to authorization or session handling rather than recovering passwords from hashes. To prevent this, store passwords with strong, salted hashes (like bcrypt, scrypt, or Argon2) using unique salts per password, and consider additional safeguards like peppering and MFA.