Length extension: why H(secret||msg) is not a MAC

Merkle-Damgård hash functions (MD5, SHA-1, SHA-2) process in blocks keeping an internal state that is also the final output. This allows continuing the hash.

The attack

Anyone authenticating with tag = H(secret || message) is vulnerable: knowing tag and the secret's length, the attacker seeds the hash state to tag and appends data, producing a valid tag for message || padding || extra — without ever knowing the secret.

hashpump -s TAG -d "message" -a "&admin=true" -k 16

Defence

Do not build MACs like that. Use HMAC, designed to resist it (keyed double hash). SHA-3/BLAKE2 do not have the flaw, but HMAC remains the interoperable standard.