Key at start or end of HMAC
This is a basic length extension attack. For hash functions like SHA-1 and SHA-2 the final state of hashing $h(K \| M)$ block by block is the output. If you hash $h(K \| M \| X)$ then you simply continue hashing from the given state (i.e. the last output).

In practice though the final block must contain a valid padding and length, which is added to $K \| M$. So basically you can create a valid hash for $K \| M \| P \| LE \| X$ where $P$ is the padding and $LE$ is the length encoding. You cannot just create any message that starts with $M$.