# ultra secretThe challange was:  ![ultra secret chall](https://i.imgur.com/4kf9EnM.png)
And povides with a nc conection and source code.  
When you try to connect with the nc it ask you, very politly, to enter the "very secret password".  ```$ nc 35.207.158.95 1337$ Please enter the very secret password:```Looking to the source code we see that is in Rust.It loads some hashes to a vector of strings and load the flag to the the flag variable. And then it ask for the password. The password must have at least 32 char and it only uses the first 32, and for each char of the password it calls function hash on it. If the hash of the char didn't match with the loaded one it killed the program whitch is useful for the attack. If it passes all the tests the flag is cat'd out.   ![hash function](https://i.imgur.com/NnvsxYp.png)  Lookin at the hash function we see that peforms a SHA256 on itself 9999 times. Instinctively, I though that would take a long time, so I'll try a Timming Attack.  
So with a payload of containing 32 'a' it took the server 0.85s to respond. So I started to change the first char of the payload and see how much time it takes to respond.  ```payload			                 timeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.858063936234baaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.859606981277caaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.858677148819daaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.87083697319eaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.859264135361faaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.871843099594gaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.857834815979haaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.86031794548iaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.860155105591jaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.862596988678kaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.86190199852laaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.869740009308maaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.859644889832naaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.857651948929oaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.863571882248paaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.857762813568qaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.857203960419raaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.867964982986saaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.863717079163taaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.868489980698uaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.861666917801vaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.861833095551waaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.859680891037xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.858031988144yaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.86004281044zaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.863693952560aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.8582868576051aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 1.524066925052aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.8638398647313aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.8605070114144aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.8724660873415aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.8577637672426aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.8593251705177aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.8583719730388aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.8607850074779aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 0.862840890884```And I notice when the payload started it with a '1', it took 0.66s more to respond and that the rest averaged at the same time to respond. So I gether that the hash function takes 0.66s to be executed on the server's machine.  With that a created a script to extract char by char of the password using the time it takes to the server to respond.    
After a long time, the flag poped out on the terminal`35C3_timing_attacks_are_fun!_:)`  and the final payload was `10e004c2e186b4d280fad7f36e779ed4`  