epadctf / paddown

AES CBC PKCS7 Padding Oracle Attack engine

Paddown

Paddown is an AES CBC PKCS7 Padding Oracle Attack engine. It simplifies performing Padding Oracle Attack on a vulnerable encryption service. This is useful for both CTF and real-world attacks, where you are in possession of a ciphertext, and have a so called Padding Oracle available.

Usage

• Using Paddown is as easy as subclassing the Paddown class overwriting the hasValidPadding(...) method retuning a bool. As argument it takes ciphertext to test against the Padding Oracle. Have your implementation return True if you receive no padding error and False otherwise.

• Now you are ready to call .decrypt() on your class and start decrypting your ciphertext.

Examples can be found in the ./examples directory.

Development

The project can be setup with

python3 -m venv .venv
.venv/bin/activate
pip install -r requirements/dev.txt
pre-commit install

Pull requests

We are open to pull requests.

We use black, flake8 and isort for linting, and implement unit testing using pytest. A pre-commit configuration file has been added, for checking against these linters before comitting.

Please squash all commits when merging a pull request.

Testing

To run the unittests, simply run pytest.

paddown's Issues

Cleanup - naming

Naming of variables in the DecryptEngine.py file should be revisited.

Make PadDown a package on PyPi

package - consider if we should add this to pip

Convert tabs to spaces

Status indicator

Status of the running decryption

Add tests

Add example usage

Cast float to int when iterating blocks

https://github.com/hoeg/PadDown/blob/master/DecryptEngine.py#L35

Project set up

So I seem to have found a solution to one of the issues, but I am having trouble committing the changes. Specifically the .pre-commit-config.yaml. Can this be set to use a version of python >=3.7 ?

CI!

Of course we should have some kind of CI

Descripting error message when pad_checker does not implement hasValidPadding method

Raise Error if no valid padding found