[Hash length extension attack (MD5)] #hash #crypto #attack #signature #links

attack.py

from hashlib import md5
import struct

secret = 'secret'
data = 'data'
fullstring = secret + data
signature = md5(fullstring).hexdigest()
# Known are signature and data!

original_padding = 'I' + \
			(56 - 1 - len(fullstring)) + \
			struct.pack('<Q', len(fullstring) * 8)

append = 'append'
attack_string = data + original_padding + append
md = md5('') # here we should update the md5 function with our known signature as state
attack_sign = md(append)

links.txt

https://blog.skullsecurity.org/2012/everything-you-need-to-know-about-hash-length-extension-attacks
https://github.com/cbornstein/python-length-extension/blob/master/pymd5.py
# Also pip install hashpumpy