I'm doing a challenge in which I need to login to a server as an admin to capture a flag.
I can enter an $id$ and a $password$ only consists of 'a-z', '0-9','-', '_' characters.
The flow is as follows:

  • The client side creates a message of a specific format: $$M = {id}\text{-}{password}\text{-}{cookie}$$ Where "$\text{-}$" acts as delimiter and $cookie$ is a constant postfix to ensure that the message was sent from the expected server (kind of like a signature).
  • Then the client adds padding of null bytes and encrypts $M$ using AES128-CBC and the same key $k$ and same iv $IV$ is used every time, for which I don't have access to.
  • The ciphertext is encoded in hex and sent (I do have access to the sent message)

After some analysis I found that if I obtain $cookie$ I can login as an admin.

  1. What attack should I try to implement?
  2. Can I get my hands on $IV$ or even $k$ using CPA when they are reused in CBC mode?
  3. What additional information I should try to gather which can help me?
  • $\begingroup$ Hint: Make your input so that exactly one byte of the cookie is still in the same block as your input. Now for every possible value of the byte make an encryption. Recover the byte from this. Repeat the process. $\endgroup$
    – SEJPM
    Jul 25, 2017 at 13:30
  • $\begingroup$ You won't get the key, unless the programmer made a really bad mistake, like using the same value as key and IV. $\endgroup$ Jul 25, 2017 at 15:16
  • $\begingroup$ @SEJPM Nice solution! $\endgroup$ Jul 25, 2017 at 19:41

1 Answer 1


The strategy you need to apply here, is basically the same as with most other oracle attacks:

You construct a message such that you can verify your guess for a single byte, then you adapt to guess the next byte until you are done.

In this specific case you would pick the user-controlled message length such that one byte of the cookie is in the same block as the tail of your message, encrypt that. Then you make your input one byte longer and try all possible values for the cookie byte until the corresponding block is equal to the encryption of the cookie byte.

Now you repeat this process for the second byte and so on.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.