Other nomination

ASP.NET 'Padding Oracle' Crypto Attack

Dennis Fisher

News report on Juliano Rizzo and Thai Duong's padding oracle attack on ASP.NET, presented at Ekoparty 2010. Modified ciphertext in a session cookie makes the framework return distinguishable errors, and enough of those errors recover the key. The pair say the attack is 100 percent reliable, typically inside 30 minutes, and released the Padding Oracle Exploit Tool.

Record

Researcher

Dennis Fisher

In the archive

• Nominated for the 2010 Top 10 Web Hacking Techniques

Related sources

• Foundational paper (2002)

Tags

• aspnet
• dotnet
• cookie
• side-channel
• auth-bypass
• case-study
• owasp-a01-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Dennis Fisher, first published at the original source. Preserved copies are kept so the citation survives its host.