cryptomedium
Protein Cookies
hackthebox
Task: Flask app with custom cookie signing using SHA-512(secret || data). Solution: Hash length extension attack to append isLoggedIn=True, exploiting parameter pollution in parse_qs.
$ ls tags/ techniques/
hash_length_extension_attackcookie_signing_bypassparse_qs_parameter_override
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub, then upgrade to Pro.
$ssh [email protected]