Suppose a server authenticates messages as MAC = SHA-256(secret ‖ message) and sends both the message and MAC. An attacker who intercepts them does not know secret — but can still forge a valid MAC for an extended message.

Step 1. The server computes SHA-256 over secret ‖ message. Internally, SHA-256 pads this to a multiple of 512 bits: it appends 0x80, then zeros, then the 64-bit length. Call this padded string P.

Step 2. The final 256-bit chaining value after processing P is exactly the MAC the attacker sees. That chaining value is the initial state for the next block.

Step 3. The attacker constructs message' = message ‖ padding ‖ extra and resumes SHA-256 from the known chaining value, hashing only extra. The resulting digest is a valid MAC for message' under the same secret.

Numbers: if secret ‖ message is 100 bytes, padding adds 1 + 51 zero bytes + 8 length bytes = 60 bytes, so the forged message begins at byte 160. The attacker never learns the secret — only exploits the structure.

Fix: use HMAC, which wraps the key in two nested hashes: H(K ⊕ opad ‖ H(K ⊕ ipad ‖ m)). HMAC is provably secure even with Merkle–Damgård hashes.