Lion Cipher Lab
Attack a naive MAC with a hash length-extension attack
- Foundations
- Advanced
- ~60 min
- Free · no account required
Why it matters
Homegrown APIs constantly 'sign' a request by hashing a secret glued in front of the data -- sha256(secret + querystring) -- and treat that as proof the request wasn't tampered with. It isn't. A whole class of hashes leaks enough state in the digest itself that an attacker can append '&admin=true' and produce a valid signature without ever knowing the secret. Doing this attack once, by hand, permanently changes how you build and review any signing code.
What you'll learn
- How Merkle-Damgard hashes (MD5/SHA-1/SHA-256) actually finalize
- Why sha256(secret || message) is a broken MAC
- Performing a length-extension forgery with hash_extender
- Brute-forcing an unknown secret length
- Fixing message authentication with HMAC (RFC 2104)
Steps in this lab
- The idea: a hash that never really 'finishes'
- Build a naive MAC 'server'
- Get the tool: build hash_extender
- Forge a tampered request without the secret
- If you don't know the secret length, brute-force it
- Land it: the server accepts your forgery
- Fix it: use HMAC, not secret-prefix
- When it matters, and the pro instinct