All Writeups

Comprehensive collection of CTF challenges, solutions, and insights.


Filter by tag:

DEADROP Crypto 3 - oracle_session.py

AES-CBC padding oracle attack against the agency's internal session token system. The oracle reveals one bit per query, valid or invalid PKCS#7 padding, which is enough to recover the full plaintext byte by byte.