Weak cryptography vulnerabilities occur when applications use outdated, weak, or improperly implemented cryptographic algorithms and protocols. This can lead to data exposure, man-in-the-middle attacks, and other security breaches.
- Use of weak hashing algorithms (MD5, SHA1)
- Weak encryption algorithms (DES, RC4)
- Hardcoded cryptographic keys
- Insufficient key lengths
- Improper SSL/TLS configuration
- Predictable random number generation
Identify cryptographic implementations and test for weak algorithms, hardcoded secrets, and improper configurations.
See weak-crypto-payloads.txt for a comprehensive list of weak cryptography indicators and test cases.