Skip to content

fig8 username==password download never decodes $HEX[...] passwords despite the comment #470

Description

@bandrel

Description

`hashview/analytics/routes.py` around line 774 (the fig8 username==password download route) has:

```python
for entry in fig8_cracked_hashes:
if entry[1] and entry[0]:
# Decode username (handle possible domain delimiters)
raw_username = entry[1]
...
# Decode password
password = entry[0]

    if username == password:
        fig8_usernames.append(username)

```

The "Decode password" comment claims decoding happens, but `password = entry[0]` is a bare assignment with no decoding — unlike the main dashboard query (same file, ~line 338) which calls `decode_hex_plain(plaintext)`.

Impact

If a recovered plaintext is stored as `$HEX[...]` (non-UTF-8 bytes), it will never equal the decoded `username`, so that username==password match is silently excluded from the fig8 export — even though the Shared Passwords / dashboard views would decode and potentially match it correctly.

Suggested fix

Decode `entry[0]` the same way the main dashboard query does (`decode_hex_plain`) before the `username == password` comparison.

Found during a repo-wide inline-comment accuracy sweep (see PR docs/inline-comment-accuracy).

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    AnalyticsChanges/improvements/bugs related to the Analytics PagebugSomething isn't workingpythonPull requests that update python code

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions