A CLI tool and library for executing padding oracle attacks with concurrent network requests and an elegant UI.
Padding Oracle Attacker is a CLI tool and library for executing padding oracle attacks against web applications. It automates the process of decrypting or encrypting data by exploiting vulnerabilities in cryptographic padding validation, with support for concurrent requests and customizable HTTP parameters. The tool helps security researchers identify and demonstrate weaknesses in implementations of encryption algorithms like AES-CBC.
Security researchers, penetration testers, and developers who need to test web applications for padding oracle vulnerabilities or educate others about cryptographic attacks.
It offers a fast, concurrent, and user-friendly alternative to existing padding oracle tools, with a clean CLI, detailed logging, and a flexible JavaScript API for integration into custom security workflows.
🔓 CLI tool and library to execute padding oracle attacks easily, with support for concurrent network requests and an elegant UI.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Defaults to 128 concurrent requests, significantly speeding up attack execution compared to sequential tools, as highlighted in the README's performance focus.
Provides both a command-line interface for quick attacks and a JavaScript library for programmatic integration, making it versatile for different workflows.
Supports hex, base64, and custom base64 encodings, allowing adaptation to various server implementations, as detailed in the payload-encoding options.
Caches network responses to disk (poattack-cache.json.gz.txt) to avoid redundant requests, improving efficiency during repeated attacks.
Requires Node.js installation, which can be a barrier in environments without it or where lightweight, language-agnostic tools are preferred.
Custom injection points with {POPAYLOAD} and detailed HTTP options (e.g., headers, body) require non-trivial setup, potentially steepening the learning curve.
Specialized solely for padding oracle attacks, lacking features for broader cryptographic testing or other web vulnerability assessments.