Documentation
¶
Index ¶
Constants ¶
const ( ModuleID = "padding-oracle" ModuleName = "CBC Padding Oracle" ModuleShort = "Confirms a CBC padding oracle by flipping ciphertext bytes and observing a distinct, reproducible padding-error differential" )
Variables ¶
Functions ¶
func FlipPenultimateByteAt ¶
FlipPenultimateByteAt returns a copy of dec with the low bit of a byte inside the penultimate block flipped. byteOffsetFromBlockEnd counts back from the end of that block: 1 is the last byte, 2 the second-to-last, and so on. Using a different offset probes a different plaintext position, so a second confirmation round exercises a distinct bit position from the first.
It never panics: if dec is too short to hold two whole blocks, or the offset is out of range, the input is returned unchanged (a copy).
func FlipPenultimateLastByte ¶
FlipPenultimateLastByte returns a copy of dec with the low bit of the last byte of the penultimate block (block index n-2) flipped. This changes the last (padding) byte of the final plaintext block.
func MalformedControl ¶
MalformedControl corrupts the ENCODING of an already-encoded ciphertext so the target fails to decode it BEFORE any block decryption runs — yielding a decode/pre-decrypt error class distinct from a padding error. Appending characters outside every base64/hex alphabet guarantees the decode step fails regardless of which encoding was used.
Types ¶
type Candidate ¶
Candidate is a decoded ciphertext-shaped value plus the metadata a padding- oracle probe needs to mutate and re-encode it.
func DetectCiphertext ¶
DetectCiphertext reports whether value looks like a block-cipher (CBC) ciphertext worth probing for a padding oracle, and if so returns the decoded bytes, the inferred block size, and the encoding it decoded from.
It is deliberately conservative: it excludes JWTs, UUIDs, plain hex digests, and anything that decodes to printable text/JSON, and it requires a block- aligned length of at least two blocks plus high-entropy, mostly-non-printable content. It is only ever reached behind a hard "crypto-cbc" tech gate, so a permissive false accept still cannot fire without a rigorous active confirmation.
type Encoding ¶
type Encoding int
Encoding identifies how a ciphertext candidate was wire-encoded, so a mutated ciphertext can be re-encoded in the SAME form the target decodes.
const ( // EncodingStdBase64 is standard base64 with padding (RFC 4648 §4). EncodingStdBase64 Encoding = iota // EncodingRawStdBase64 is standard base64 without padding. EncodingRawStdBase64 // EncodingURLBase64 is URL-safe base64 with padding (RFC 4648 §5). EncodingURLBase64 // EncodingRawURLBase64 is URL-safe base64 without padding. EncodingRawURLBase64 // EncodingHex is lowercase/uppercase hexadecimal. EncodingHex )
type Module ¶
type Module struct {
modkit.BaseActiveModule
}
Module implements the CBC padding-oracle confirmer.
func (*Module) RequiredTechs ¶
RequiredTechs implements modules.TechAware: the executor only dispatches this module against hosts where "crypto-cbc" was detected. The executor gate fails OPEN on unknown hosts, so ScanPerInsertionPoint re-checks and fails CLOSED.
func (*Module) ScanPerInsertionPoint ¶
func (m *Module) ScanPerInsertionPoint( ctx *httpmsg.HttpRequestResponse, ip httpmsg.InsertionPoint, httpClient *http.Requester, scanCtx *modkit.ScanContext, ) ([]*output.ResultEvent, error)
ScanPerInsertionPoint confirms a CBC padding oracle at a single insertion point.
Source Files