CBC padding oracle attack
Decrypt CBC ciphertext one byte at a time using only a valid/invalid padding signal - Vaudenay’s attack, explained and driven.
Open in ctfpalA padding oracle is any observable difference between 'the padding was wrong' and 'the padding was fine but something else failed'. That one bit of information, asked repeatedly, decrypts the entire ciphertext without the key.
How one byte falls
In CBC, P[i] = D(C[i]) XOR C[i-1]. You control C[i-1] because you are submitting it. Take the target block, prepend a block of your own bytes, and vary the last byte through all 256 values. Exactly one (usually) produces valid padding - which means the decrypted last byte became \x01. That tells you D(C[i]) for that position, and XORing with the real previous block gives the real plaintext byte. Move to the second-to-last byte, forcing \x02\x02, and repeat.
- 256 requests per byte in the worst case, 128 on average. A 16-byte block is a few thousand requests.
- The oracle need not be an error message. A timing difference, a different HTTP status, or a different response length all work.
- The same control lets you forge plaintext, not just read it - CBC bit flipping changes a decrypted byte by XORing the corresponding byte of the previous block.
Related tools
AES decryption tool (CBC, GCM, CTR, ECB)
Decrypt AES in every common mode and key size, with hex, Base64, or UTF-8 key material and automatic PKCS#7 padding removal. Runs on Web Crypto in your browser.
AES-GCM nonce reuse (forbidden attack)
Recover the GHASH authentication key from two messages encrypted under the same key and nonce, then forge arbitrary authenticated ciphertexts.
HTTP request replayer
Craft and replay HTTP requests with arbitrary methods, headers, and bodies, and read the raw response - a Repeater that runs in your browser.
RSA decryption and attack runner
Paste n, e, and c and let ctfpal choose the attack: trial division, Fermat, Pollard’s rho, Wiener, common modulus, or Hastad broadcast. Arbitrary-precision, in-browser.