Top 10 winner

padding oracle web attack

Juliano Rizzo and Thai Duong · 25 May 2010

Turns Vaudenay's CBC padding oracle into practical web attacks, with manual and automated methods for finding oracles in real sites. It cracks crypto-based CAPTCHAs and decrypts JSF view states, then introduces CBC-R, which reuses a decryption oracle as an encryption oracle to forge arbitrary plaintext without the key. A distributed cross-site variant reads the oracle bit through img load events.

Record

Researcher

Juliano Rizzo and Thai Duong

Date

25 May 2010

Format

Whitepaper

In the archive

• Ranked #1 in the 2010 Top 10 Web Hacking Techniques

Related sources

• POET tool
• Padbuster
• demo

Tags

• side-channel
• deserialization
• java
• rce
• tooling
• info-leak
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Juliano Rizzo and Thai Duong, first published at the original source. Preserved copies are kept so the citation survives its host.