Int 9: Cryptographic Failures - OWASP A02:2021

cd ~ && mkdir crypto-int9 && cd crypto-int9

python3 << 'PYEOF'
# OWASP A02:2021 - Cryptographic Failures
# Contoh nyata kelemahan kriptografi di aplikasi

print("=== BAD CRYPTO - DON'T DO THIS! ==*")
print()

# BAD #1: Hardcoded encryption key
print("❌ BAD: Hardcoded encryption key")
print('   KEY = "SuperSecretKey123"  # hardcoded!')
print("   → Attacker bisa baca source code → decrypt semua data!")
print()

# BAD #2: ECB mode (elephant pattern)
print("❌ BAD: ECB mode - plaintext pattern still visible!")
print("   AES-ECB: same input → same output")
print("   → Gambar yang dienkripsi ECB masih menunjukkan bentuk!")
print()

# BAD #3: Weak hash for passwords
print("❌ BAD: MD5 for passwords")
print('   hash = md5(password)  # NO SALT!')
print("   → Rainbow table attack langsung tembus!")
print()

# BAD #4: Custom crypto
print("❌ BAD: Custom 'encryption' algorithm")
print("   def encrypt(data):")
print("       return ''.join(chr(ord(c) ^ 0x55) for c in data)  # XOR fixed key!")
print("   → Siapa pun bisa reverse dalam 5 detik!")
print()

# BAD #5: Predictable random
print("❌ BAD: Predictable random for crypto")
print("   import random; random.seed(12345)  # Python random != crypto secure!")
print("   → Jika seed diketahui, semua 'random' bisa diprediksi!")
print()

# GOOD practices
print("=== GOOD CRYPTO - DO THIS! ==*")
print()
print("✅ AES-256-GCM (authenticated encryption)")
print("✅ bcrypt/argon2 for passwords")
print("✅ Secrets.token_hex() for random")
print("✅ Key dari secure keystore / env vars")
print("✅ Regular key rotation")
PYEOF