33. Cryptography Basics

33.7 Red vs Blue, Project and Real Incidents

By Ravindra Bagale · Last updated: 27 September 2026

Chala mitrano, hashing vs encryption, bcrypt/Argon2 vs MD5, AES-GCM, TLS 1.2/1.3, key management, certificates/PKI – aata Purple Team loop. Red OWN PHP lab app (kiwa Ch.16 reels app on OWN EC2) madhe weak MD5/no-salt password storage, hard-coded DB secret, kiwa weak TLS dakhavto; Blue password_hash bcrypt/Argon2 + secrets baher + TLS 1.2+ ne band karto. Tumhi Raja-Rani Traders style OWN lab madhe build → hack → fix karun Purple report liha. Algorithm nav aikun thambu naka – key ani config suddha. Samjla ka? Dusryacha site – kadhi nahi.

Red Team vs Blue Team – cryptography basics

Defender chi simple checklist: bcrypt/Argon2 for passwords → secrets out of code → AES-GCM (or libsodium) for data → TLS 1.2/1.3 + valid certs → no homemade crypto → re-prove with hash crack attempt fail + ssl scan clean. Red = weak crypto config on OWN app; Blue = fix + prove. Interview madhe "We used MD5 because it is fast" peksha "I migrated an OWN lab app from MD5 to password_hash bcrypt, moved the DB secret out of PHP, forced TLS 1.2+, and re-proved" jast strong.

# OWN lab only – Raja-Rani Traders (Nashik) PHP app / Ch.16 reels on YOUR EC2
mkdir -p ~/labs/raja-rani-crypto
# 1) BASELINE weak checks (OWN app only):
#    # find MD5-style password storage in YOUR PHP (example pattern to search):
#    grep -Rn "md5(" ~/labs/raja-rani-crypto/app --include='*.php' | tee ~/labs/raja-rani-crypto/md5-hits.txt
#    # find hard-coded secrets (example):
#    grep -Rn "password\s*=" ~/labs/raja-rani-crypto/app --include='*.php' | head
#    # TLS surface on YOUR HTTPS site:
#    nmap --script ssl-enum-ciphers -p 443 YOUR_EC2_OR_LAB_IP \
#      | tee ~/labs/raja-rani-crypto/tls-before.txt
# 2) FIX examples (Blue – code YOU own):
#    # PHP password storage (concept – put in your register/login):
#    #   $hash = password_hash($plain, PASSWORD_ARGON2ID);  # or PASSWORD_BCRYPT
#    #   password_verify($plain, $hash);
#    # Move DB secret to environment (example):
#    #   export RR_DB_PASS='...'    # not inside config.php committed to Git
#    # On Amazon Linux web host YOU own – after nginx/apache TLS edit:
#    #   sudo nginx -t    # or: sudo apachectl configtest
#    #   sudo service nginx reload   # or httpd
#    #   sudo yum update -y   # stay current on OpenSSL / packages
# 3) RE-VERIFY:
#    # old MD5 test hash should no longer be how new users are stored
#    # nmap / sslscan again → only TLS 1.2+ ; weak protocols gone
#    nmap --script ssl-enum-ciphers -p 443 YOUR_EC2_OR_LAB_IP \
#      | tee ~/labs/raja-rani-crypto/tls-after.txt
echo 'Scope: Raja-Rani OWN PHP/EC2 lab – no third-party sites' \
  > ~/labs/raja-rani-crypto/scope.txt
echo 'Fix: password_hash bcrypt/Argon2 | secrets out of code | TLS 1.2+' \
  >> ~/labs/raja-rani-crypto/scope.txt

Interview model (clean English): "I find MD5 or a hard-coded secret or weak TLS on my own lab app, switch to password_hash bcrypt or Argon2, move secrets out of code, force TLS 1.2 or 1.3, and re-prove with a clean ssl scan."

Thodkyaat: weak hash/TLS olakha, pan bcrypt/Argon2 + secrets baher + TLS 1.2+ + re-prove shika. Aata pudhe Bharatatle cyber kayde ani cyber crime complaint. Chala pudhe, mitrano!

Samjla ka? Aata HTTPS, SSH ani password hash maagche shastra tumhala kalle. Pudhchya chapter madhe Bharatatle cyber kayde ani cyber crime complaint kashi karaychi. Chala pudhe, mitrano!