Hash Length Extension
crypto · medium · +45 XP
Target
GET /api/lab/hash-ext-101/cookie (returns a signed message + mac, secret length=16)
GET /api/lab/hash-ext-101/verify?msg=<hex>&mac=<hex> (verifies; returns flag iff msg contains 'admin=true' AND mac is valid)
Goal: the issued cookie says user=guest. Use a length-extension attack (hashpump or hash_extender) to append &admin=true and produce a valid mac WITHOUT knowing the secret. The server uses MD5; the secret is exactly 16 bytes long.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/hash-ext-101/
// reuse on the cli
// submit flag
// no solves yet