实验吧——让我进去（hash长度扩展攻击）

 1 <?php
 2 $flag = "XXXXXXXXXXXXXXXXXXXXXXX";
 3 $secret = "XXXXXXXXXXXXXXX"; // This secret is 15 characters long for security!
 4 
 5 $username = $_POST["username"];
 6 $password = $_POST["password"];
 7 
 8 if (!empty($_COOKIE["getmein"])) {
 9     if (urldecode($username) === "admin" && urldecode($password) != "admin") {
10         if ($COOKIE["getmein"] === md5($secret . urldecode($username . $password))) {
11             echo "Congratulations! You are a registered user.\n";
12             die ("The flag is ". $flag);
13         }
14         else {
15             die ("Your cookies don‘t match up! STOP HACKING THIS SITE.");
16         }
17     }
18     else {
19         die ("You are not an admin! LEAVE.");
20     }
21 }
22 
23 setcookie("sample-hash", md5($secret . urldecode("admin" . "admin")), time() + (60 * 60 * 24 * 7));
24 
25 if (empty($_COOKIE["source"])) {
26     setcookie("source", 0, time() + (60 * 60 * 24 * 7));
27 }
28 else {
29     if ($_COOKIE["source"] != 0) {
30         echo ""; // This source code is outputted here
31     }
32 }