fig8 username==password download never decodes $HEX[...] passwords despite the comment
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 88/100
Research direction
Open hashview/analytics/routes.py around line 774 and compare the fig8 username==password download route with the dashboard query around line 338. Verify how decode_hex_plain(plaintext) handles $HEX[...] values, then ensure the export comparison uses the decoded password. Done means encoded passwords can participate in username==password matches consistently with the dashboard and Shared Passwords views.
Written by the indexing model from the issue text.
Description
Description
`hashview/analytics/routes.py` around line 774 (the fig8 username==password download route) has:
```python
for entry in fig8_cracked_hashes:
if entry[1] and entry[0]:
# Decode username (handle possible domain delimiters)
raw_username = entry[1]
...
# Decode password
password = entry[0]
if username == password:
fig8_usernames.append(username)
```
The "Decode password" comment claims decoding happens, but `password = entry[0]` is a bare assignment with no decoding — unlike the main dashboard query (same file, ~line 338) which calls `decode_hex_plain(plaintext)`.
Impact
If a recovered plaintext is stored as `$HEX[...]` (non-UTF-8 bytes), it will never equal the decoded `username`, so that username==password match is silently excluded from the fig8 export — even though the Shared Passwords / dashboard views would decode and potentially match it correctly.
Suggested fix
Decode `entry[0]` the same way the main dashboard query does (`decode_hex_plain`) before the `username == password` comparison.
Found during a repo-wide inline-comment accuracy sweep (see PR docs/inline-comment-accuracy).
- Dominant language
- Python
- Stars
- 399
- Forks
- 52
- Avg merge
- 21h 39m
- Merged PRs (30d)
- 79
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from hashview/hashview
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
bug python
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
-
Analytics bug python
Difficulty 1/5 Under an hour Newbie friendliness 90/100
-
user:hash import stores the whole 'user:hash' line as the ciphertext for hash_type 300 and 1731 Openbug Jobs python
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
bug Jobs python Wordlists
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
All issues in hashview/hashview
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100