Hack the Padding Oracle Lab

The main purpose to solve this lab was to share the padding oracle attack technique with our visitors
The padding oracle attack enables an attacker to decrypt encrypted data without knowledge of the encryption key and used cipher by sending skillful manipulated cipher texts to the padding oracle and observing of the results returned by it. This causes loss of confidentiality of the encrypted data. E.g. in the case of session data stored on the client side the attacker can gain information about the internal state and structure of the application. A padding oracle attack also enables an attacker to encrypt arbitrary plain texts without knowledge of the used key and cipher. If the application assumes that integrity and authenticity of the decrypted data is given, an attacker could be able to manipulate internal session state and possibly gain higher privileges.
www.owasp.org/index.php/Testing_for_Padding_Oracle
 First you need to download padding oracle from here. Now install the iso image in VM ware and start it.
Start kali Linux as well as explore target IP: 192.168.1.29 on browser. Now at this point you need to create a user account, click on register option.

Now register username with its password and then login to exploit this vulnerability. I registered as raj: 123

Once you create a user account get on login panel and at the same time make use of burp suite to capture the cookies.

Turn up burp suite and don’t forget to set manual proxy of your browser. Now open proxy tab and hit intercepts on button to capture the request of target. When this is done you will get fetched data under intercept window. Here you will find that I try to login with credential raj: 123

Now right click on its window and a list of options will appear. Further click on send to repeater. Come across over screenshot here you will find two panel left and right for request and response respectively.
In left panel send username: raj and password: 123 as request; click on GO button to forward this request and which will further generate a cookie for auth as response in right panel.
Copy the highlighted cookie and this will be use in below command.

Next open terminal to run following command which contains target URL plus above copied cookie
padbuster http://192.168.1.102/login.php wJRTrRORayKbhI2aKPHxniQ6DEAHi7WG 8 –cookies auth=wJRTrRORayKbhI2aKPHxniQ6DEAHi7WG –encoding 0
 Python-paddingoracle is a Python implementation heavily based on PadBuster, an automated script for performing Padding Oracle attacks, developed by Brian Holyfield of Gotham Digital Science. Above command will decrypt the encrypted value of auth into plaintext. Further type 2 where it asked ID recommended.

Last part of screenshot has captured three decrypt values in base64, HEX and ASCII. The cookie of auth is combination of username with its password from padbuster we come to know what is encrypted value of username for raj.

We are very near to our goal just encrypt this auth cookie with user as admin once again. Here we have our plaintext as admin and lets encode it using padbuster.
padbuster http://192.168.1.102/login.php wJRTrRORayKbhI2aKPHxniQ6DEAHi7WG 8 –cookies auth=wJRTrRORayKbhI2aKPHxniQ6DEAHi7WG –encoding 0 –plaintext user=admin
Further type 2 where it asked ID recommended.

Here the highlighted part is our encrypted value for admin. Copy It”BAit——–AAAA”.

Go to burp suit once again and click on params under intercept frame; it contains two fields as username and password, now add third field for auth value. Click on ADD button on the right side of frame which will add another row in params.

Here it has three columns: type, name, and value; paste the above encrypted value in these columns as type: cookie, name: auth, value: BAit——AAAAAA which we have got from padbuster. Then Click on forward to send this request on web server.

Again click on forward to send it.

As request sent by burp suite automatically on web server you will get logged in as admin account.
Congrats!!! We meet the goal of this lab.

Author: AArti Singh is a Researcher and Technical Writer at Hacking Articles an Information Security Consultant Social Media Lover and Gadgets

Comments

  • russell westbrook shoes
    Trả lời

    I used to be very pleased to find this web-site.I wanted to thanks on your time for this wonderful learn!! I definitely having fun with every little bit of it and I have you bookmarked to take a look at new stuff you blog post.
    russell westbrook shoes [url=http://www.russellwestbrookshoes.us]russell westbrook shoes[/url]

  • nmd
    Trả lời

    I wanted to create you the bit of word to say thanks a lot the moment again with the marvelous concepts you have discussed at this time. It was really unbelievably open-handed with you to offer unreservedly exactly what a few people would’ve marketed as an electronic book to earn some cash for themselves, principally considering the fact that you could possibly have done it in case you decided. Those points as well acted to become good way to fully grasp some people have the same keenness the same as my own to realize good deal more with regards to this condition. I am sure there are millions of more pleasant opportunities ahead for individuals that looked at your blog.
    nmd

  • kevin durant shoes
    Trả lời

    An impressive share, I just given this onto a colleague who was doing just a little evaluation on this. And he in truth purchased me breakfast as a result of I found it for him.. smile. So let me reword that: Thnx for the deal with! But yeah Thnkx for spending the time to debate this, I feel strongly about it and love reading extra on this topic. If potential, as you develop into expertise, would you mind updating your weblog with more details? It’s highly useful for me. Large thumb up for this blog post!
    kevin durant shoes

  • nfl jerseys
    Trả lời

    Aw, this was a really nice post. In concept I would like to put in writing like this additionally ?taking time and precise effort to make a very good article?but what can I say?I procrastinate alot and by no means seem to get one thing done.
    nfl jerseys

  • nike air huarache
    Trả lời

    Can I simply say what a aid to find someone who truly knows what theyre talking about on the internet. You definitely know the best way to deliver a problem to light and make it important. Extra individuals have to read this and understand this facet of the story. I cant consider youre no more popular since you undoubtedly have the gift.
    nike air huarache

  • yeezy boost 350
    Trả lời

    There’s noticeably a bundle to find out about this. I assume you made sure nice factors in options also.
    yeezy boost 350

  • lebron 15
    Trả lời

    Would you be occupied with exchanging hyperlinks?
    lebron 15

  • adidas ultra boost
    Trả lời

    I’m just commenting to make you be aware of what a useful experience our child found visiting your web page. She noticed some issues, with the inclusion of how it is like to have a very effective giving character to have the rest completely understand several specialized subject matter. You truly did more than her expected results. Thank you for offering these effective, trusted, informative as well as easy thoughts on your topic to Mary.
    adidas ultra boost

  • adidas yeezy boost
    Trả lời

    I抦 impressed, I must say. Really hardly ever do I encounter a weblog that抯 both educative and entertaining, and let me tell you, you could have hit the nail on the head. Your thought is excellent; the difficulty is something that not enough people are speaking intelligently about. I’m very completely happy that I stumbled throughout this in my search for something referring to this.
    adidas yeezy boost

  • Adidas NMD XR1 White Red
    Trả lời

    I must voice my respect for your generosity in support of people who have the need for guidance on this area of interest. Your very own dedication to passing the solution up and down had become really good and have regularly empowered most people just like me to achieve their pursuits. Your own useful help signifies this much a person like me and even further to my mates. Thanks a lot; from each one of us.
    Adidas NMD XR1 White Red

  • adidas stan smith
    Trả lời

    Hiya! I simply want to give a huge thumbs up for the great info you’ve gotten here on this post. I will probably be coming again to your blog for extra soon.
    adidas stan smith

  • true religion
    Trả lời

    There are actually a variety of details like that to take into consideration. That may be a nice point to carry up. I provide the thoughts above as normal inspiration however clearly there are questions like the one you carry up where an important factor will likely be working in honest good faith. I don?t know if finest practices have emerged around issues like that, but I am positive that your job is clearly identified as a good game. Each girls and boys feel the influence of only a second抯 pleasure, for the remainder of their lives.
    true religion

  • adidas ultra boost
    Trả lời

    Nice post. I learn something tougher on totally different blogs everyday. It will always be stimulating to learn content from different writers and observe a little one thing from their store. I抎 desire to make use of some with the content material on my weblog whether or not you don抰 mind. Natually I抣l provide you with a hyperlink on your internet blog. Thanks for sharing.
    adidas ultra boost

  • nmd
    Trả lời

    Thank you for every one of your effort on this web page. My mother really likes managing research and it’s easy to understand why. Most of us notice all regarding the powerful ways you make powerful ideas by means of your blog and as well as invigorate response from the others about this concept then our girl is discovering a whole lot. Have fun with the rest of the year. Your carrying out a very good job.
    nmd

  • timberland shoes
    Trả lời

    I抎 should examine with you here. Which is not something I normally do! I enjoy studying a put up that may make people think. Also, thanks for allowing me to comment!
    timberland shoes

  • adidas eqt support adv
    Trả lời

    This website online is known as a walk-by means of for the entire data you wanted about this and didn抰 know who to ask. Glimpse right here, and also you抣l undoubtedly discover it.
    adidas eqt support adv

  • lebron soldier 10
    Trả lời

    This actually answered my problem, thanks!
    lebron soldier 10

  • air presto
    Trả lời

    very good submit, i certainly love this web site, carry on it
    air presto

  • yeezy boost 350
    Trả lời

    I used to be very pleased to find this net-site.I wished to thanks to your time for this wonderful learn!! I definitely having fun with every little little bit of it and I have you bookmarked to take a look at new stuff you weblog post.
    yeezy boost 350

  • michael kors outlet
    Trả lời

    Can I just say what a relief to find someone who truly knows what theyre speaking about on the internet. You undoubtedly know the best way to carry a problem to light and make it important. Extra folks must learn this and perceive this side of the story. I cant believe youre not more widespread since you positively have the gift.
    michael kors outlet

  • adidas yeezy boost
    Trả lời

    I wanted to post a simple word in order to express gratitude to you for some of the remarkable ways you are giving on this website. My rather long internet lookup has at the end been recognized with professional points to exchange with my company. I would assume that most of us visitors actually are really lucky to live in a remarkable network with many wonderful people with great tricks. I feel quite happy to have discovered your entire web page and look forward to many more fabulous minutes reading here. Thanks a lot once again for all the details.
    adidas yeezy boost

  • off white
    Trả lời

    The subsequent time I learn a weblog, I hope that it doesnt disappoint me as much as this one. I mean, I do know it was my option to learn, but I really thought youd have one thing fascinating to say. All I hear is a bunch of whining about one thing that you possibly can repair in case you werent too busy looking for attention.
    off white

  • pandora charms
    Trả lời

    There is noticeably a bundle to find out about this. I assume you made certain nice points in options also.
    pandora charms

  • golden goose
    Trả lời

    Oh my goodness! an incredible article dude. Thanks However I am experiencing difficulty with ur rss . Don抰 know why Unable to subscribe to it. Is there anybody getting an identical rss downside? Anybody who is aware of kindly respond. Thnkx
    golden goose

  • tom ford sunglasses
    Trả lời

    Hiya! I simply would like to give an enormous thumbs up for the good information you have here on this post. I can be coming again to your weblog for extra soon.
    tom ford sunglasses

  • adidas ultra boost
    Trả lời

    I precisely needed to say thanks once more. I’m not certain the things that I would have tried in the absence of the actual secrets shown by you concerning that situation. It seemed to be a challenging difficulty in my position, however , being able to see this well-written technique you resolved that forced me to weep with joy. Extremely happier for this guidance as well as believe you know what a great job your are getting into educating many people by way of your blog. I am sure you’ve never got to know any of us.
    adidas ultra boost

  • yeezy 500
    Trả lời

    It抯 hard to find knowledgeable people on this topic, but you sound like you know what you抮e speaking about! Thanks
    yeezy 500

  • nike cortez
    Trả lời

    Your house is valueble for me. Thanks!?
    nike cortez

  • nmd uk
    Trả lời

    I抦 impressed, I have to say. Really hardly ever do I encounter a weblog that抯 both educative and entertaining, and let me let you know, you’ve hit the nail on the head. Your idea is excellent; the problem is one thing that not sufficient individuals are talking intelligently about. I am very happy that I stumbled throughout this in my search for one thing regarding this.
    nmd uk