title: Exploiting hash function in python
body: <p>I made a topic about the built-in python hash function: <a href="https://stackoverflow.com/questions/5128990/old-python-hashing-done-left-to-right-why-is-it-bad">Old python hashing done left to right - why is it bad?</a>
  The previous topic was about why it was bad for encryption, because we have an application called Gruyere which is filled with security holes, and it uses the hash() to encrypt cookies.</p>
  
  <pre><code># global cookie_secret; only use positive hash values
  h_data = str(hash(cookie_secret + c_data) &amp; 0x7FFFFFF)
  </code></pre>
  
  <p>c_data is a username; cookie_secret is salt (which is just '' by default)</p>
  
  <p>I have implemented a more secure encryption method using md5 hashing with salt, but one excercise is to beat this old encryption and I still cannot understand how :-( I've read the string_hash code from python sourcecode but it's not documented and I can't figure it out. </p>
  
  <p>EDIT: The idea is to write a program which can create a valid cookie any valid user, so I think I need to find out cookie_secret somehow</p>