I'm doing a penetration testing for a web application that uses AES CBC PADDING encryption for the parameter ?email=ciphertext then it's printing the plaintext email on html body.

I would like to know if is there any possibility to :

  • Crack the IV or the KEY using chosen plaintext attack?
  • Can i encrypt a given plaintext?
  • $\begingroup$ Huh? I'm not sure if I understand your 2nd point: Can i encrypt a given plaintext? AES has been build to encrypt plaintext and decrypt the resulting ciphertext. If you wouldn't be able to encrypt a given plaintest with AES CBC PADDING - what else would you be using it for? Can you please clarify that? $\endgroup$
    – e-sushi
    Nov 4, 2016 at 16:13
  • $\begingroup$ @e-sushi I mean is there any way to generate a ciphertext for this string "' or '1'='1" using AES CBC padding oracle attack. $\endgroup$ Nov 10, 2016 at 11:37

1 Answer 1


I believe you can deduce the IV by passing in a chosen ciphertext. This ciphertext should be of the form C = C0||C0, where C0 is the first ciphertext block, and || is the concatenation operator. In other words, send the same block twice!

This will get you two blocks of plaintext, P0||P1. We have that

Decrypt(key, C0) ^ IV = P0
Decrypt(key, C0) ^ C0 = P1


P1 ^ C0 = Decrypt(key, C0)
P0 ^ P1 ^ C0 = IV

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.