Modern Web Application Penetration Testing Part 2, Hash Length Extension Attacks

แชร์
ฝัง
  • เผยแพร่เมื่อ 20 ธ.ค. 2024

ความคิดเห็น • 5

  • @TheSkepticSkwerl
    @TheSkepticSkwerl 3 ปีที่แล้ว +1

    Way better explanation than 660, thank you. Simply put, some hashing algorithms use the hash as the next values to further hash the next 64 bytes (or whatever length each cycle is) so if we can pad it, and then add to that, and use the previous hash as our next step in hashing, we get the longer file names hash. we're basically hashing it by skipping step 1. as long as we guess the padding correctly, and the new file name correctly, we will get a valid file. lucky for us padding is generally done the same (all 0s or similar) and lucky for us password length is simple to guess, as most people use 6-16 length passwords)
    we're not finding a way to break hashing, we're just hashing where the server left off, and cheating. "extending the hashing process"

  • @Jinzo-
    @Jinzo- 3 ปีที่แล้ว

    This was so useful. Thank you

  • @tarapowell8957
    @tarapowell8957 3 ปีที่แล้ว

    Virgin goat!!! Great explanation! Thank you!

  • @SteveWoznokav
    @SteveWoznokav 4 ปีที่แล้ว

    very good explanation,thank you