cryptomedium

Shambles

hackthebox

Task: Banking service encrypts JWT tokens and user data with AES-CBC using fixed KEY/IV; login endpoint leaks padding validity via distinct error messages. Solution: CBC padding oracle attack with batched queries to decrypt user data, recover IV from known JWT header, extract card number, and withdraw exact balance to get flag.

$ ls tags/ techniques/
jwtaes_cbcpkcs7padding_oracleiv_recoverybanking_service
cbc_padding_oracleiv_recovery_known_plaintextoracle_batching_pipeliningpkcs7_side_channel
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub to get started.

$ssh [email protected]