Skip to content

Commit c53cdd4

Browse files
le4kermpgn
authored andcommitted
Update README.md (#2)
* fix typo in Readme thx @PanosSakkos
1 parent 5c36d0e commit c53cdd4

File tree

1 file changed

+14
-14
lines changed

1 file changed

+14
-14
lines changed

README.md

+14-14
Original file line numberDiff line numberDiff line change
@@ -40,15 +40,15 @@ An attacker will intercept a cipher text and retrieve byte by byte the plaintext
4040
* intercepted cipher : C<sub>0</sub> | C<sub>...</sub> | C<sub>i-1</sub> | C<sub>i</sub>
4141
* then build a block like this :
4242

43-
C'<sub>i-1</sub> = C'<sub>i-1</sub> ⊕ 00000001 ⊕ 0000000X || C<sub>i</sub>
43+
C'<sub>i-1</sub> = C<sub>i-1</sub> ⊕ 00000001 ⊕ 0000000X | C<sub>i</sub>
4444

4545
Where X is a char between `chr(0-256)`.
4646

47-
* then he sends C'<sub>i-1</sub> || C<sub>i</sub> to the oracle. The oracle will decrypt like this :
47+
* then he sends C'<sub>i-1</sub> \| C<sub>i</sub> to the oracle. The oracle will decrypt like this :
4848

49-
D<sub>k</sub>(C'<sub>i</sub>) ⊕ C'<sub>i-1</sub> <br>
50-
= D<sub>k</sub>(C'<sub>i</sub>) ⊕ C'<sub>i-1</sub> ⊕ 00000001 ⊕ 0000000X <br>
51-
= P'<sub>i</sub> ⊕ 00000001 ⊕ 0000000X <br>
49+
D<sub>k</sub>(C<sub>i</sub>) ⊕ C'<sub>i-1</sub> <br>
50+
= D<sub>k</sub>(C<sub>i</sub>) ⊕ C<sub>i-1</sub> ⊕ 00000001 ⊕ 0000000X <br>
51+
= P<sub>i</sub> ⊕ 00000001 ⊕ 0000000X <br>
5252

5353
Now there is two possibilities: a padding error or not :
5454

@@ -63,7 +63,7 @@ This is a wrong padding, so we can deduce the byte Y is wrong.
6363
* The oracle didn't give us a padding error and we know the byte X is good :
6464

6565
```
66-
If P'i ⊕ 0000000X == abcdefg0 then:
66+
If Pi ⊕ 0000000X == abcdefg0 then:
6767
abcdefg0 ⊕ 00000001 = abcdefg1
6868
```
6969

@@ -72,18 +72,18 @@ If P'i ⊕ 0000000X == abcdefg0 then:
7272
**For the second byte :**
7373

7474

75-
C'<sub>i-1</sub> = C'<sub>i-1</sub> ⊕ 00000022 ⊕ 000000YX || C<sub>i</sub>
75+
C'<sub>i-1</sub> = C<sub>i-1</sub> ⊕ 00000022 ⊕ 000000YX \| C<sub>i</sub>
7676

7777
And then :
7878

79-
D<sub>k</sub>(C'<sub>i</sub>) ⊕ C'<sub>i-1</sub> <br>
80-
= D<sub>k</sub>(C'<sub>i</sub>) ⊕ C'<sub>i-1</sub> ⊕ 00000022 ⊕ 000000YX <br>
81-
= P'<sub>i</sub> ⊕ 00000001 ⊕ 00000YX <br>
79+
D<sub>k</sub>(C<sub>i</sub>) ⊕ C'<sub>i-1</sub> <br>
80+
= D<sub>k</sub>(C<sub>i</sub>) ⊕ C<sub>i-1</sub> ⊕ 00000022 ⊕ 000000YX <br>
81+
= P<sub>i</sub> ⊕ 00000001 ⊕ 00000YX <br>
8282

8383
* The oracle didn't give us a padding error and we know the byte X is good :
8484

8585
```
86-
If P'i ⊕ 000000YX == abcdef00 then:
86+
If Pi ⊕ 000000YX == abcdef00 then:
8787
abcdef00 ⊕ 00000022 = abcdef22
8888
```
8989

@@ -120,7 +120,7 @@ Details required options:
120120
example: with HTTP method: 200,400,500
121121
with DOM HTML : "<h2>Padding Error</h2>"
122122
```
123-
Optionnal options:
123+
Optional options:
124124
```bash
125125
--cookie Cookie parameter example: PHPSESSID=9nnvje7p90b507shfmb94d7
126126
--method Default GET methode but can se POST etc
@@ -136,7 +136,7 @@ python exploit.py -c E3B3D1120F999F4CEF945BA8B9326D7C3C8A8B02178E59AF506666542AB
136136
137137
## Customisation
138138
139-
> I wan to custom the Oracle !
139+
> I wan to customize the Oracle !
140140
141141
Example with sockets https://gist.github.com/mpgn/fce3c3f2aaa2eeb8fac5
142142
@@ -178,4 +178,4 @@ def call_oracle(host,cookie,url,post,method,up_cipher):
178178
conn.request(method, url + up_cipher, params, headers)
179179
response = conn.getresponse()
180180
return conn, response
181-
```
181+
```

0 commit comments

Comments
 (0)