web-crypto-exploitation

Web Crypto Exploitation

Exploits applications that misuse symmetric ciphers (CBC/ECB), MACs (HMAC, hash-length extension), or token signers (JWT). The decisive trick is almost always: find the oracle, prove the oracle is real, then iterate within a hard request budget. Without the proven oracle the attack burns the cycle.

Step 0 — Key Discovery (Do Before ANY Network Attack)

Check if the application key is hardcoded in source. CTF challenge apps frequently embed keys in source code. If you have filesystem access to the app, run this before any network probe:

# Find app source in the workspace
find /workspace -name "*.py" -o -name "*.js" -o -name "*.rb" -o -name "*.php" 2>/dev/null | head -20

# Grep for hardcoded keys
grep -rn 'AES_KEY\|SECRET_KEY\|key\s*=\s*[b'"'"'"'"'"'"'"'"']\|password\s*=' /workspace/*/app/ 2>/dev/null | head -20

# Also check environment files
cat /workspace/*/.env 2>/dev/null; cat /workspace/*/app/.env 2>/dev/null

If the key is found, decrypt offline immediately — no oracle, no network requests:

import base64
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.primitives import padding as crypto_padding

KEY = b'C' * 32  # replace with discovered key
cookie = "<base64-cookie-from-browser>"

raw = base64.b64decode(cookie)
iv, ct = raw[:16], raw[16:]
cipher = Cipher(algorithms.AES(KEY), modes.CBC(iv))
pt = cipher.decryptor().update(ct) + cipher.decryptor().finalize()
# Remove PKCS7 padding
unpadder = crypto_padding.PKCS7(128).unpadder()
plaintext = unpadder.update(pt) + unpadder.finalize()
print("plaintext:", plaintext)

Only proceed to the oracle-based attack below if no key is found in source.

Recognition Signals

Trigger this skill when ANY of the following are present:

• Base64 cookie / token whose decoded length is a multiple of 16 (AES-CBC) or 8 (DES/3DES). Length boundaries are the giveaway: len(b64decode(token)) % 16 == 0 and not 32 or 48 → likely 1-2 blocks of CBC; % 16 == 0 with 32-64 bytes → IV+ciphertext pattern.
• Distinct error responses for "invalid padding" vs "invalid auth/decryption". Status code, body, length, or even response time differences across the two failure modes ARE the oracle. If the two modes look identical, no oracle.
• JWT in Authorization: Bearer <three-base64-segments-separated-by-dots>. Always inspect alg header (alg=none, alg=HS256 with public-key confusion, alg=RS256→HS256 substitution).
• Repeated 16-byte ciphertext blocks within a single token — direct ECB tell. Decode base64, slice into 16-byte blocks, look for duplicates.
• Server returns separate encrypted blob + tag/HMAC concatenated — candidate for HMAC bypass / hash-length extension if the MAC scheme is weak (e.g. MD5(secret || message)).
• Challenge tag includes crypto, cipher, oracle, captcha, encrypted_captcha, padding, hmac_bypass, jwt, length_extension.