Lets say an application is using CBC mode without authentication. The application is generating cipher text. This cipher text can be manipulated by the attacker and then transmitted back to the application.
Without looking at the code, what is an easy method for the attacker to prove that a Padding Oracle or Decryption Oracle is present? Is there a method more elegant than brute force manipulation of the cipher text?
We have a Padding Oracle if there is a different response from the server gives us an indication of the correctness of the pad (say if this needs proving). We can establish this by playing a game where we send badly padded cipher-text and random strings to the server, finally submitting some at random and seeing if we can get a non-negligible Advantage is guessing which one we sent.
The problem is that this might be the "brute force" way. It's fairly easy to do if there is obvious data-leakage, but you have to check through a lot of side-channel attacks to rule out data-leakage to an efficient adversary. I sense you want a clever fast way to prove there is no data-leakage, which doesn't sound possible to me.
Prove? Why does the attacker need to "prove" it? For example, the attacker can check whether there is an oracle by looking at the code and seeing whether such an attack is possible. Or, the attacker can guess that such an attack might be possible and then try the attack. If the attack succeeds, the attacker knows the system is vulnerable. There might be other ways too.
Or, to put it another way: an easy way to prove that such an attack is possible is to actually implement the attack and demonstrate that it works. Boom, done. Problem solved.
Proving that an attack is possible is usually a lot easier than finding the attack in the first place. Both of those are, in turn, a lot easier than proving that oracle-based attacks are impossible.
There's something funny about your question that I'm not following. I'm not getting why an attacker would care about a mathematical proof of the existence of such an attack. The proof of the pudding is in the eating. If an attack successfully breaks the system, seems like that's all that matters; who cares whether we have a mathematical proof?
I can see why a system defender would want a proof of the non-existence of such an attack, but that's a different question. Is that what you were asking for?
