Skip to content
ctfpal
All tools
Modern cryptoRuns locallyNo account

Hash length extension attack

Append data to a message and forge a valid MD5, SHA-1, or SHA-256 signature without knowing the secret - the Merkle-Damgard flaw behind `hash(secret || message)`.

Open in ctfpal

MD5, SHA-1, and SHA-256 are Merkle-Damgard constructions: they process a message block by block, and the final digest is the internal state at the end. That means a digest is a resumable checkpoint. Anyone holding hash(secret || message) can load that state and keep hashing - producing hash(secret || message || padding || anything) without ever learning the secret.

What you need

  • The original digest.
  • The original message (so you know what is being extended).
  • The length of the secret in bytes. If unknown, try 1 through 64 and submit each - it is a small search.

Why the glue padding matters

You cannot append cleanly - the original hash already absorbed the padding for the original length. Your forged message must therefore be message || original_padding || your_data, and that padding, full of null bytes and a length field, is visible in the forged input. Applications that parse the extended value forgivingly - a query string where a later admin=1 overrides an earlier one - are exactly the ones this breaks.

GET /api?data=user%3dguest%80%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%c0%26admin%3d1&sig=<forged>
The forged parameter, glue padding and all

Related tools