Skip to main content

34. Hash Length Extension: The Key to Bypassing MD5/SHA1 Signatures

A web signature of the form hash(secret || msg) is vulnerable to length extension. Using the original hash and an estimate of the msg length, an attacker can append additional data and create a new hash.

Why is this possible?​

  • MD5/SHA1 use the Merkle–Damgård construction
  • The internal state (=hash) is reused as the IV for the next block
  • With the correct padding, hashing can continue from the "intermediate state"

Attack flow (standard CTF routine)​

  • Obtain the known msg and hash
  • Guess the secret length across a range (for example, 8–32)
  • Append padding and a payload such as ;admin=true
  • Recalculate the hash and pass server validation

Practical defenses​

  • Use HMAC(hash, secret, msg)
  • The answer is to change the construction, not hide the length

hashpump is a well-known tool, and CTF challenges often require a direct implementation. The key lesson is: "do not use a hash as a signature."