CBC-MAC

The course delves into the exploitation of CBC-MAC, a method to ensure message integrity by encrypting it in CBC mode and using the last encrypted block as a "signature." The course explains that CBC-MAC can be vulnerable if not used with fixed-length messages. By manipulating the lack of length enforcement, you can get the application to sign two messages and concatenate them to forge another message with a valid signature.

The lab walks you through generating two signatures for different messages and then using them to create a forged signature that allows unauthorized access. You are guided through the theory and implementation steps, including splitting usernames, generating signatures, and using XOR operations to combine them into a valid signature for the target user. The exercise demonstrates the importance of enforcing message length in CBC-MAC implementations.