New challenge, hash length extension attack

Includes shitty hack to get the attack to actually work in PHP (damn null bytes...)