rustpad v1.8 releases: Multi-threaded Padding Oracle attacks
rustpad is a multi-threaded successor to the classic padbuster, written in Rust. It abuses a Padding Oracle vulnerability to decrypt any cypher text or encrypt arbitrary plain text without knowing the encryption key!
- Decryption of cypher texts
- Encryption of arbitrary plain text
- Multi-threading on both block and byte level
- Modern, real-time and interactive TUI!
- No-TTY support, so you can just pipe output to a file
- Supports Web server oracles…
- … and Script-based oracles. For when you need just that extra bit of control.
- Automated calibration of web oracle’s (in)correct padding response
- Progress bar and automated retries
- Smart detection of cypher text encoding, supporting: hex, base64, base64url
- No IV support
- Written in purely safe Rust, making sure you don’t encounter nasty crashes
Using rustpad to attack a padding oracle is easy. It requires only 4 pieces of information to start:
- target oracle (–oracle)
- cypher text to decrypt (–decrypt)
- block size (–block-size)
- type of oracle (web/script, see below)
Web mode specifies that the oracle is located on the web. In other words, the oracle is a web server with a URL.
For a padding oracle attack to succeed, an oracle must say so if a cypher text with incorrect padding was provided. rustpad will analyse the oracle’s responses and automatically calibrate itself to the oracle’s behaviour.
Script mode was made for power users
or CTF players 🏴☠️ who were given a script to run. The target oracle is a local shell script.
Scripts allow you to run attacks against local oracles or more exotic services. Or you can use script mode to customise and extend rustpad‘s features. However, if you’re missing a feature, feel free to open an issue on GitHub!
- Adds shell auto-completion.
Copyright (C) 2021 Kibouo