Hash length extension attack
Append data to a message and forge a valid MD5, SHA-1, or SHA-256 signature without knowing the secret - the Merkle-Damgard flaw behind `hash(secret || message)`.
Open in ctfpalMD5, SHA-1, and SHA-256 are Merkle-Damgard constructions: they process a message block by block, and the final digest is the internal state at the end. That means a digest is a resumable checkpoint. Anyone holding hash(secret || message) can load that state and keep hashing - producing hash(secret || message || padding || anything) without ever learning the secret.
What you need
- The original digest.
- The original message (so you know what is being extended).
- The length of the secret in bytes. If unknown, try 1 through 64 and submit each - it is a small search.
Why the glue padding matters
You cannot append cleanly - the original hash already absorbed the padding for the original length. Your forged message must therefore be message || original_padding || your_data, and that padding, full of null bytes and a length field, is visible in the forged input. Applications that parse the extended value forgivingly - a query string where a later admin=1 overrides an earlier one - are exactly the ones this breaks.
GET /api?data=user%3dguest%80%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%00%c0%26admin%3d1&sig=<forged>