Hash Length Extension Attack Lab
SEED Lab: A Hands-on Lab for Security Education
Overview
In this lab we will cover how the length extension attack works. Students will gain first hand experience how a Message Authentication Code (MAC) is calculated using one-way hash using a key and message. The lab explores how an attacker can intercept a client request, expand the message and calculate a correct MAC without knowing the key. Students will apply this knowledge to attack a server program. Students will also learn how to correctly generate a MAC using HMAC.
Activities: Students are given a server program that accepts a list of commands. The client and server share a secret key. The server expects a MAC argument in the request. This MAC is calculated in an insecure way by concatenating the key and request arguments. Students will exploit the insecure MAC calculation to add an additional command to a client request. Students will then fix the server program by calculating the MAC using HMAC.
Lab Tasks
- VM version: This lab has been tested on our pre-built SEEDUbuntu16.04 VM.
Recommended Time
- Supervised situation (e.g. a closely-guided lab session):
- Unsupervised situation (e.g. take-home project):
Files that are Needed:
- server.zip (this file contains the server program and required lab files)
Suggested Reading
- SEED Book by Wenliang Du
(Book website)
(Chinese version)