Skip to content

Commit d0f6aeb

Browse files
authored
Merge pull request #4 from towynlin/master
Updates for python 3.7 compatibility
2 parents c53cdd4 + b2cf75d commit d0f6aeb

File tree

3 files changed

+369
-234
lines changed

3 files changed

+369
-234
lines changed

Diff for: README.md

+11-11
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
# Padding Oracle Attack
22

33
An exploit for the [Padding Oracle Attack](https://en.wikipedia.org/wiki/Padding_oracle_attack). Tested against ASP.NET, works like a charm. The CBC mode must use [PKCS7](https://en.wikipedia.org/wiki/Padding_%28cryptography%29#PKCS7) for the padding block.
4-
This is an implementation of this great article [Padding Oracle Attack](https://not.burntout.org/blog/Padding_Oracle_Attack/). Since the article is not very well formated and maybe unclear, I made an explanation in the readme. i advise you to read it if you want to understand the basics of the attack.
5-
This exploit allow block size of 8 or 16 this mean it can be use even if the cipher use AES or DES. You can find instructions to launch the attack [here](https://github.com/mpgn/Padding-Oracle-Attack#options).
4+
This is an implementation of this great article [Padding Oracle Attack](https://not.burntout.org/blog/Padding_Oracle_Attack/). Since the article is not very well formated and maybe unclear, I made an explanation in the readme. I advise you to read it if you want to understand the basics of the attack.
5+
This exploit allows block sizees of 8 or 16. This means it can be used if the cipher uses AES or DES. You can find instructions to launch the attack [here](https://github.com/mpgn/Padding-Oracle-Attack#options).
66

77
I also made a test file `test.py`, you don't need a target to use it :)
88

@@ -116,14 +116,14 @@ Details required options:
116116
-l length of a block example: 8 or 16
117117
-u UrlTarget for example: ?/page=
118118
--host hostname example: google.fr
119-
--error Error that the orcale give you for a wrong padding
119+
--error Error that the oracle gives you for a wrong padding
120120
example: with HTTP method: 200,400,500
121121
with DOM HTML : "<h2>Padding Error</h2>"
122122
```
123123
Optional options:
124124
```bash
125125
--cookie Cookie parameter example: PHPSESSID=9nnvje7p90b507shfmb94d7
126-
--method Default GET methode but can se POST etc
126+
--method Default GET method but can set POST etc
127127
--post POST parameter if you need example 'user':'value', 'pass':'value'
128128
```
129129
@@ -144,10 +144,10 @@ No problem, find these line and do what you have to do :)
144144
145145
* Custom oracle response:
146146
```python
147-
####################################
148-
# CUSTOM YOUR RESPONSE ORACLE HERE #
149-
####################################
150-
''' the function you want change to adapte the result to your problem '''
147+
#######################################
148+
# CUSTOMIZE YOUR RESPONSE ORACLE HERE #
149+
#######################################
150+
''' The function you want change to adapt the result to your problem '''
151151
def test_validity(response,error):
152152
try:
153153
value = int(error)
@@ -165,9 +165,9 @@ def test_validity(response,error):
165165
166166
* Custom oracle call (HTTP)
167167
```python
168-
################################
169-
# CUSTOM YOUR ORACLE HTTP HERE #
170-
################################
168+
###################################
169+
# CUSTOMIZE YOUR ORACLE HTTP HERE #
170+
###################################
171171
def call_oracle(host,cookie,url,post,method,up_cipher):
172172
if post:
173173
params = urllib.urlencode({post})

0 commit comments

Comments
 (0)