@@ -6,4 +6,40 @@ With this tool you can:
6
6
- Craft modified cipher texts
7
7
8
8
## Usage
9
- See [ example.py] ( example.py ) .
9
+ Example:
10
+ ``` py
11
+ from padding_oracle import PaddingOracle
12
+ from optimized_alphabets import json_alphabet
13
+
14
+ import requests
15
+
16
+ # This function has to be implemented and will be passed to the PaddingOracle constructor.
17
+ # It gets a hex encoded cipher text and has to return True if it can be decrypted successfully,
18
+ # False otherwise.
19
+ #
20
+ # Here is an example implementation that I used for P.W.N. CTF 2018.
21
+ def oracle (cipher_hex ):
22
+ headers = {' Cookie' : ' vals={} ' .format(cipher_hex)}
23
+ r = requests.get(' http://converter.uni.hctf.fun/convert' , headers = headers)
24
+ response = r.content
25
+
26
+ if b ' Invalid padding bytes.' not in response:
27
+ return True
28
+ else :
29
+ return False
30
+
31
+
32
+ # Instantiate the helper with the oracle implementation
33
+ o = PaddingOracle(oracle, max_retries = - 1 )
34
+
35
+ # Decrypt the plain text.
36
+ # To make the guesswork faster, use an alphabet optimized for JSON data.
37
+ cipher = ' b5290bd594ba08fa58b1d5c7a19f876c338191a51eeeac94c2b434bdb8adbfb8596f996d6eddca93c059e3dc35f7bef36b57a5611250ec4528c11e1573799d2178c54c034b9ea8fda8ae9a4a41c67763'
38
+ plain, padding = o.decrypt(cipher, optimized_alphabet = json_alphabet())
39
+ print (' Plaintext: {} ' .format(plain))
40
+
41
+ # Craft a modified but valid cipher text
42
+ plain_new = plain[:24 ] + b ' XXXX' + plain[28 :]
43
+ cipher_new = o.craft(cipher, plain, plain_new)
44
+ print (' Modified: {} ' .format(cipher_new))
45
+ ```
0 commit comments