It is my Birthday (Medium)
- Challenge Link: https://play.picoctf.org/practice/challenge/109?category=1&difficulty=2&page=3
- Challenge Description: I sent out 2 invitations to all of my friends for my birthday! I'll know if they get stolen because the two invites look similar, and they even have the same md5 hash, but they are slightly different! You wouldn't believe how long it took me to find a collision. Anyway, see if you're invited by submitting 2 PDFs to my website.
- How may a PHP site check the rules in the description?
- Look at the category of this problem.
- How may a PHP site check the rules in the description?
Solution
You can view the link to the exploit/study I am using in the Sources section. What is an MD5 hash collison? Imagine MD5 is a machine that takes in a file, mixes it up, and spits out a short “fingerprint”. The idea is that if two files have the same fingerprint, they must be the same file. But these researchers discovered that you can carefully design two different files that produce the same fingerprint.
Or a popular explanation where in a room filled with people, there’s a surprisingly high chance two people share a birthday.
In this study, MD5 fingerprints are only 128 bits, s eventually, collisions are mathematically guaranteed.
As can you see in the code, it requires us to upload two different files but the MD5 hash sum must match in order to get the flag.
picoCTF{c0ngr4ts_u_r_1nv1t3d_c63bbaf}