Lion Cipher Lab
Exploit a CBC padding oracle to decrypt without the key
- Foundations
- Intermediate
- ~60 min
- Free · no account required
Why it matters
In the predecessor lab you flipped one byte of a CBC ciphertext and changed the message with no error — proof that unauthenticated CBC has no integrity. This lab shows the far scarier consequence: if the receiving system so much as HINTS whether the padding was valid, an attacker who never has the key can decrypt the entire message. That hint can be an exception, a different error page, a status code, even a timing difference. This exact flaw — Vaudenay's 2002 padding oracle — is not a museum piece: POODLE (2014) broke SSL 3.0 with a padding-oracle-style attack, and Lucky Thirteen (2013)…
What you'll learn
- the CBC decryption relation P_i = D(C_i) XOR C_{i-1} and how to weaponize it
- building a padding oracle (the distinguishable valid/invalid error)
- recovering plaintext one byte at a time with no key
- PKCS#7 padding and why 0x01, then 0x02 0x02, drives the attack
- why unauthenticated CBC is malleable and oracle-able
- the fix: AEAD (AES-GCM / ChaCha20-Poly1305), Encrypt-then-MAC, constant-time compare, uniform errors
Steps in this lab
- What you're about to do (and why it should feel impossible)
- The one equation the whole attack rests on
- Understand PKCS#7 padding — the thing the oracle checks
- Build the vulnerable oracle (server.py)
- The intuition: recover ONE byte (onebyte.py)
- Automate it: recover the whole message (attack.py)
- When this bites in the real world (and why it kept happening)
- The fix: authenticate, and never distinguish the failure