# How to break AES CBC PADDING with chosen ciphertext attack

I'm doing a penetration testing for a web application that uses AES CBC PADDING encryption for the parameter ?email=ciphertext then it's printing the plaintext email on html body.

I would like to know if is there any possibility to :

• Crack the IV or the KEY using chosen plaintext attack?
• Can i encrypt a given plaintext?
• Huh? I'm not sure if I understand your 2nd point: Can i encrypt a given plaintext? AES has been build to encrypt plaintext and decrypt the resulting ciphertext. If you wouldn't be able to encrypt a given plaintest with AES CBC PADDING - what else would you be using it for? Can you please clarify that? – e-sushi Nov 4 '16 at 16:13
• @e-sushi I mean is there any way to generate a ciphertext for this string "' or '1'='1" using AES CBC padding oracle attack. – Jonatana miracle Nov 10 '16 at 11:37

I believe you can deduce the IV by passing in a chosen ciphertext. This ciphertext should be of the form C = C0||C0, where C0 is the first ciphertext block, and || is the concatenation operator. In other words, send the same block twice!

This will get you two blocks of plaintext, P0||P1. We have that

Decrypt(key, C0) ^ IV = P0
Decrypt(key, C0) ^ C0 = P1


Therefore,

P1 ^ C0 = Decrypt(key, C0)
P0 ^ P1 ^ C0 = IV