Skip to main content

44. Introduction to Cryptographic Attack Techniques: From Padding Oracles to Bit-Flipping

Encrypted cookies and tokens appear often in CTFs. Assuming "it is encrypted, so it must be safe" is a way to lose. In practice, a single implementation mistake often brings the whole design down.

Padding Oracle Attack​

This attack often appears with AES-CBC mode. It occurs when the server leaks a hint about whether the padding is correct after decryption.

The principle is simple. Because of CBC's decryption structure, modifying the preceding ciphertext block changes the plaintext of the next block. Knowing only whether a padding error occurred is enough to brute-force the complete plaintext one byte at a time.

# Core idea
# D(C2) XOR C1 = P2
# C1[i] XOR D(C2)[i] = P2[i]
# → Manipulating C1[i] controls P2[i]

In practice, use the padbuster tool or implement it directly with PyCryptodome.

Bit-Flipping Attack​

Another weakness of CBC mode. Flipping a specific bit in the encrypted data creates a predictable modification in the decrypted result of the next block.

For example, what if you want to change role=user to role=admi?

C1[i] XOR 0x00 = original
C1[i] XOR (original_byte XOR target_byte) = target

This can be used for privilege escalation and session forgery.

The trap of ECB mode​

ECB should never be used. The same block always produces the same ciphertext, allowing content to be inferred from patterns. A famous visual demonstration is known as the ECB Penguin.

CTF tips​

  • If an encryption oracle exists, always try a Padding Oracle
  • If a cookie or token uses CBC, check Bit-Flipping
  • After Base64 decoding, check whether the IV is prepended
  • Solving the cryptopals challenges rapidly improves your skill

Cryptographic attacks are more about exploiting implementation flaws than mathematics. Even when the algorithm is correct, incorrect code ends the game.