Hack.LU 2014 :: Web 150 :: Hidden in Plain Sight

Posted by and filed under Hack.LU 2014.

For this challenge, we are given the service code to review and find the vulnerability. We locate the function that is generating the sha256 hash: var HMAC_SECRET = ” for (var i=0; i<20; i++) { HMAC_SΕCRET = HMAC_SECRET + (Math.random()+”).substr(2) } function hmac_sign(path) { var hmac = crypto.createHmac(‘sha256’, HMAC_SECRET) hmac.update(path) return hmac.digest(‘hex’) } At first… Read more »