$50M CTF from Hackerone – Writeup

Almost sure that it is really a hash function and so the backend will be unable to get the original input values (username and password). In this scenario we can infer that the backend will also compute the hash with the same function, as , using the stored username + password. This is a padding algorithm and the XOR operation is not working as expected, because of this:

This is a typo and this wrong piece of code probably makes the hash function unfeasible for a correct validation on the backend server, because we won’t ever get the same hash value… This is a good assumption to take!

Source: github.com