DEV Community: Vimrichie

Storing user passwords in plain text?

Vimrichie — Thu, 21 Jul 2022 02:38:30 +0000

Keeping your passwords secure is important. Even more if you are storing passwords for others. You won't believe how many companies out there have stored user information in plain text. I'll point you to some articles and see if you remember
any of these.

Krebs on Security - Facebook Stored Hundreds of Millions of User Passwords in Plain Text for Years

RockYou2021 - largest password compilation of all time leaked online with 8.4 billion entries

SolarWinds hack: the mystery of one of the biggest cyberattacks ever

I believe when a new app or website is created, security should be one of the first things that needs to be implemented. I'm going to show you a simple way of hashing passwords using Python. We will use SHA-2(512) to create a long string out of the password.

Requirements

Python 3.
Passlib
- https://passlib.readthedocs.io/en/stable/

TLDR

Let's code!

I'm going to write out some code and explain what is happening. I'll start off by importing our two libraries Passlib and Getpass.

1 |  from passlib.handlers.sha2_crypt import sha512_crypt as hasher
2 |  from getpass import getpass

So what do we have here?

Line 1: Passlib is imported and from the handlers.sha2_crypt module we import sha512_crypt
as hasher.

Line 2: From the library getpass we import getpass.

Now let's create our function that will ask for the username and password. In this function we can also
include the hash method.

5 | def account_creation():
6 |     username = input("Please enter a username: ")
7 |     password = getpass("Please enter a password: ")
8 |     hashed_password = hasher.hash(password, rounds=200_000)
9 |     database_create(username, hashed_password)

What just happened?

Line 5: we defined our function and we named it account_creation()

Line 6: asks the user for the username and sets it as a variable named username.

Line 7: prompts the user for the password and sets it as variable named password.

Line 8: hashes our password using hasher.hash and sets the rounds to 200 thousand. By default passlib
iterates the hash 29,000 times but we went above and beyond with 200k!

Line 9: we call a function named database_create() and give it two parameters named username and password.

Let's create our database_create() definition that we just passed the username and password through.

12 | def database_create(username, password):
13 |    file = open(f"{username}.txt", "w")
14 |    file.write(password)
15 |    file.close()
16 |    print("Account created.")

Line 12: we define our function database_create() and pass the username and password arguments.

Line 13: we create a variable named file and assign the Python built in function open(). This built in function is used to open or create files. Inside the open() function we pass an f-string with the
argument username. As you can see that it is creating a .txt file with the username that is provided.

Line 14: Our variable file is used to write the password using the write() function.

Line 15: We use the close() function to make sure code and the OS has closed the session.

Line 16 And we print something out to confirm our code completed.

Finally we add our main method. This makes us 10x developers!

19 | if __name__ == "__main__":
20 |     account_creation()

And that's it!

Yep, it is that easy!

Let's test the code in our terminal

➜ python3 main.py
Please enter a username: elmo
Please enter a password:
Account created.

I entered the username elmo and the password elmoloveshisgoldfishandcrayon123.

Now we check to see if the file was created using ls.

➜ ls 
elmo.txt main.py

As you can see there is a file named elmo.txt. I'll cat the file to check the contents.

cat elmo.txt
$6$rounds=200000$gYlAWMks4mttsMxS$xDjy0WP5d/zTL0hF/Y.ATqv1J5Yrji4pyerh6znnie01qKdMmAXrzqg7FV.9XtKHiGN/5p3aHsglCg2mA3kVY0%

Whoa. Check out that long hashed password!

Want to learn more about SHA-2?

https://en.wikipedia.org/wiki/SHA-2

Check out the code on Github: github.com/applericky/hasher

The Code

from passlib.handlers.sha2_crypt import sha512_crypt as hasher
from getpass import getpass


def database_create(username, password):
    file = open(f"{username}.txt", "w")
    file.write(password)
    file.close()
    print("Account created.")


def account_creation():
    username = input("Please enter a username: ")
    password = getpass("Please enter a password: ")
    hashed_password = hasher.hash(password, rounds=200_000)
    database_create(username, hashed_password)


if __name__ == "__main__":
    account_creation()

MAC Address lookup using Python ( and an API )

Vimrichie — Mon, 29 Nov 2021 10:13:50 +0000

Overview

As a network engineer, I sometimes have to verify what type of device is connected on a port or what is being registered on a firewall via ARP. Having a MAC address handy can be useful for many reasons but in my case, having one is great for network troubleshooting.

I'm going to walk you through my Python script that sends a MAC address to an API and the response will be the vendor of that address. So let's create the script so we don't have to open a browser and search for it on the web.🧑‍💻

What's a MAC address?

MAC addresses are registered with the IEEE (Institute of Electrical and Electronics Engineers). The prefix of a MAC address is a number that uniquely identifies a vendor, manufacturer, or other organization.

Wikipedia:

A media access control address (MAC address) is a unique identifier assigned to a network interface controller (NIC) for use as a network address in communications within a network segment. MAC addresses are primarily assigned by device manufacturers, and are therefore often referred to as the burned-in address, or as an Ethernet hardware address, hardware address, or physical address.

So if you have a device that connects to the internet, the networking interface card is registered with IEEE.

Here is a list of the vendors.
http://standards-oui.ieee.org/oui/oui.txt

Requirements

Python 3
Requests - A Python library
An API - Macvendors.com - This API is free and requires no sign up.

Let’s code!

Let’s start by importing our libraries.



import sys

from requests import get

Now let’s create a class because object oriented programming is cool. 😎



class Macpyoui:
    def __init__(self, api):
        self.api = api


site = "https://api.macvendors.com/"
data = Macpyoui(site)
macaddress = input("Please enter the MAC address: ")

Let’s break down the class and see what we did:

Created a class called Macpyoui. This is going to allow us to call our information.
Created a method __init__ and added the arguments self and api.
Assigned self.api as api.

You will also see that I added some variables.

site - This is the website that we will be sending the MAC address.
data - Here we create a variable called data and assign the argument site to the class Macpyoui. This will allow me to call it back in a function.
macaddress - We create a variable here called macaddress and we ask the person running the script what the MAC address is with the input function and we add the string inside it asking about the MAC address.

Now let's define our function:



def searchmac():
    macsend = data.api + macaddress
    vendorsearch = get(macsend).text
    if "Not Found" in vendorsearch:
        print("MAC address not found.")
    elif len(sys.argv) == 1:
        print("No MAC address entered.")
    else:
        print(vendorsearch)

Breaking down the function.



def searchmac():

Here we create our function searchmac ```python

macsend = data.api + macaddress

- Then we create a variable called `macsend`. 
- We assign `data.api + macaddress`. 
- In the assignment we use `data.api` which is asking for the website. 
- The `data` in `data.api` is the class `Macpyoui` being called and the `.api` is asking for the website in the class. As for `macaddress`, this is what the user provides and we combine then with the `+`. So written out it would look like *`https://api.macvendors.com/`* + *`mac address`*

```python


vendorsearch = get(macsend).text

Here we assign vendorsearch to use the get request and send the MAC address under the argument macsend. We make sure to convert it into simple text with .text at the end.



if "Not Found" in vendorsearch:
        print("MAC address not found.")
    elif len(sys.argv) == 1:
        print("No MAC address entered.")
    else:
        print(vendorsearch)

For the last part of the function we do a few if statements to see what information is entered.



if "Not Found" in vendorsearch:
        print("MAC address not found.")

If the API responds with Not Found, we print out MAC address not found. ```python

elif len(sys.argv) == 1:
print("No MAC address entered.")

-If the user enters no MAC address, we print out *`No MAC address entered`*.

```python


else:
        print(vendorsearch)

If there is a response from the website that is not one of the first two if statements, it prints the response.

Finally, let's add our main method at the bottom. This makes us a 10x coder.



if __name__ == "__main__":
    searchmac()

That's it! We don't need much to run our simple check.

Let’s test it out!

Successful search



~ ❯ python3 macpy.py                                                                                                                                   
Please enter the MAC address: F4BD9E
Cisco Systems, Inc

Unsuccessful Search



~ ❯ python3 macpy.py
Please enter the MAC address:
MAC address not found.

Missing entry



~ ❯ python3 macpy.py                                                                                                                                   
Please enter the MAC address:
No MAC address entered

Here is the full code:



import sys

from requests import get

__version__ = "1.0"


class Macpyoui:
    def __init__(self, api):
        self.api = api


site = "https://api.macvendors.com/"
data = Macpyoui(site)
macaddress = input("Please enter the MAC address: ")


def searchmac():
    macsend = data.api + macaddress
    vendorsearch = get(macsend).text
    if "Not Found" in vendorsearch:
        print("MAC address not found.")
    elif len(sys.argv) == 1:
        print("No MAC address entered.")
    else:
        print(vendorsearch)

if __name__ == "__main__":
    searchmac()

Check out the code on GitHub.
https://github.com/applericky/macpy

Thanks for reading!
Feedback or questions? Let me know!

Vim Setup - Moving away from an IDE (Part 1) - Saving and Quitting

Vimrichie — Wed, 28 Jul 2021 01:25:20 +0000

Modern IDEs and editors are slow. Pycharm and VSCode are some of my favorite ones to use but they didn't feel as fast as using Vim.

TLDR

We create remaps for easy save and exit.
All the information is at the bottom.

Part 1

In this post I'm going to remap saving and exiting in Vim. I will also give you a little bonus at the end for users who still prefer to use the mouse on occasion. At this point I’m assuming you have some familiarity with Vim and the .vimrc file but if not, feel free to ask me any questions.

I'll start off by making sure I have a leader key. The leader key is used to tell Vim that we are going to give it a sequence of button presses. I’m going to set my leader key as the space bar.

In your .vimrc or init.nvim (Neovim) add:

let mapleader = " "

So now that my leader key is set to the space bar, I can start to add my remaps.

On a Mac, to save a file in GUI programs you can do command + s. In Vim I’m going to do something similar. In the config file I will add the following:

nnoremap <leader>s :wr <CR>

So here we have a few things happening. I’ll explain what each section is doing.

nnoremap - 
nnoremap is telling Vim to remap in normal mode.

<leader>s - 
This is my space button (leader key) + the letter s.

:wr -
This how to save (write) in Vim.

<CR> - 
This is the same as pressing return/enter. We need this to auto enter the full command at the end.

Now we can save the file by entering :wr in normal mode and to reflect the changes enter :source %. Now every time I press space + s it saves the file. To confirm if your file has been saved, you will see "written" in the bottom of the buffer.

Lets go ahead and knock out one more remap.

nnoremap <leader>q :q <CR>

This will remap space + q to quit the current buffer or exit Vim.

Now for the bonus part. Add the following to your config so you have the ability to do mouse movements.

set mouse=a

Having the mouse feature enabled will really help out users who are starting off with Vim.

That’s it!

I how you enjoyed this. If you have any question or feedback do let me know!

TLDR

Add this to your .vimrc or init.vim (Neovim) file.

nnoremap <leader>s :wr <CR>
nnoremap <leader>q :q <CR>
set mouse=a

My vimrc/neovim config.

https://github.com/applericky/.vimrc/blob/main/vimrc