Back when I took the Cryptography class on coursera, one of the programming projects was to develop a padding Oracle attack, I have forgotten about the code, but now it is on github with more tweaks.
The code is modular and in order to be used with a new padding Oracle, one has only to create an object representing this Oracle and wire it to the PaddingOracleAttacker; it's that simple.
The new code is available here: http://martani.github.com/Padding-Oracle-Attack/.
The Oracle must implement the interface ICBCOracle which has one function: bool RequestOracle (byte[] cipher), returning true when the padding is correct, false otherwise. There exists 2 examples of such oracles in PaddingOracleAttackTest/Oracles.
This is an example of an online Oracle which return HTTP code 403 when the padding is bad, and 404 on a correct padding.
Another offline Oracle that uses AES is also provided, it can be used for testing.
Once you have the Oracle ready, all what is left is to attach it to the PaddingOracleAttacker and you are in business:
The code is modular and in order to be used with a new padding Oracle, one has only to create an object representing this Oracle and wire it to the PaddingOracleAttacker; it's that simple.
The new code is available here: http://martani.github.com/Padding-Oracle-Attack/.
The Oracle must implement the interface ICBCOracle which has one function: bool RequestOracle (byte[] cipher), returning true when the padding is correct, false otherwise. There exists 2 examples of such oracles in PaddingOracleAttackTest/Oracles.
This is an example of an online Oracle which return HTTP code 403 when the padding is bad, and 404 on a correct padding.
Another offline Oracle that uses AES is also provided, it can be used for testing.
Once you have the Oracle ready, all what is left is to attach it to the PaddingOracleAttacker and you are in business:
Do not use this code if you are trying to solve the coursera assignment.
