Rebuild Database | Login
  • Getting Started with WebGoat.NET
    • Welcome
    • Web Proxy Test
    • Testing Database
  • WebGoat Coins Customer Portal
    • Customer Login
    • Forgot Password
    • Change Password
    • Customer Portal
    • Product Catalog
    • Product Details
    • Customer Orders
    • Logout
  • Injection Attacks
    • SQL Error Messages
    • Exploiting SQL Injection
    • File Download Path Manipulation
    • File Upload Path Manipulation
  • Cross Site Scripting (XSS)
    • Stored XSS
    • Reflected XSS
  • Authentication Issues
    • Insecure Forgot Password
  • Testing and Debugging
    • Exploiting Debug Page
  • Encryption
    • Encryption vs Encoding
    • Insecure Message Digest
    • Weak Random Number Generators
  • .NET Exploits
    • Unsafe blocks
Skip Navigation LinksOWASP.WebGoat.NET Encryption Insecure Message Digest

Lesson Instructions

An insecure message digest can compromise a system when an attacker can:

  • Figure out a message from the digest.
  • Replace the existing message with another one with the same digest

This lesson will demonstrate how weak message digests can be exploited.

Try to construct a message that has the same digest as: =pD9[*L4'|=MqaA4[mHq

Result: