I'm working on padding oracle attack and I have a 16 byte cipher on which I need to perform the attack. I've been able to successfully decrypt all the bytes of the plain-text except first byte and I'm now out of ideas as to why I'm not getting any response for the first byte of plain text and any idea or help would be appreciated.

Since it is known that the message was encrypted using AES CBC mode, I do understand the block size is 16 bytes and hence the padding can be between 0x01 to 0x10 and upto 0x0f everything works well but I'm unable to find the plain-text for 0x10. Do I need to do something special for the first byte? I have also tried adding a full block i.e. 16 byte padding of 0x10 at the end of cipher text block when decrypting for the first byte of plain-text but that didn't help.

hex_lst = []  
for i in range(0, 256):
    hex_lst.append('0' + hex(i)[2:] if len(hex(i)[2:]) == 1 else hex(i)[2:])

for each_hex in hex_lst:
    c_1 =  each_hex + 'ef7999a200e306ab2c413d855a2b1c'
    c_2 =  cipher[1]
    response = requests.get("http://dev/api/test/%s%s" % (c_1, c_2))
    if response.status_code != 500:

In above code, the hexadecimal string in $c_1$ is computed using the following formula for each byte:

$c_1[16] = 10 ⊕ I[16]$

$c_1[15] = 10 ⊕ I[15]$

And so on.. $I[i]$ represents the intermediate value for $i^{th}$ byte of the $c_2$ cipher block! I have calculated these values by hand as well through script multiple times and it returned same value.

  • $\begingroup$ When you print the plaintext with the padding can you see the case that all of the bytes are 10? What is the size of the message? When working such implementations make sure that you properly implemented all error handlings. $\endgroup$
    – kelalaka
    Commented Nov 12, 2020 at 5:51
  • $\begingroup$ @kelalaka I have 3 blocks of cipher-text each 16 bytes and when I print plain-text for the last block with padding this is what I get "s_founder 0505050505". As it can be seen it returned 15 bytes but I wasn't able to decrypt the first byte when I tried using 0x10 padding. I don't have access to the Oracle code so I don't know how its setup. All I have is the cipher blocks and IV and I get response from Oracle. I'm having this issue during the decryption of all blocks $\endgroup$
    – Alex
    Commented Nov 12, 2020 at 7:39
  • $\begingroup$ What does the server return to you? only padding error? In this case, out of 256, only one value must not return an error. Of course, we assume that you don't have any programmatical error that we can't see from here. $\endgroup$
    – kelalaka
    Commented Nov 12, 2020 at 7:43
  • $\begingroup$ @kelalaka I've updated the question with a small code snippet relevant for this question. I have calculated all values with hand as well as through script and they are consistent! The server returns 500 error response if there is padding error but when correct padding is found then it returns 200 status. $\endgroup$
    – Alex
    Commented Nov 12, 2020 at 9:16
  • $\begingroup$ I see. What if the server just doesn't look for the last character to determine the padding? What if it checks all? Like see 04 then make sure that there are 4 04. IMHO, you should always modify the last cipher text block to make sure that that it has the correct PKCS#7 format for each case. $\endgroup$
    – kelalaka
    Commented Nov 12, 2020 at 9:43


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.