Top 10 winner

padding oracle web attack

Practical Padding Oracle Attacks

Juliano Rizzo and Thai Duong · usenix.org · 25 May 2010

Turns Vaudenay's CBC padding oracle into practical web attacks, with manual and automated methods for finding oracles in real sites. It cracks crypto-based CAPTCHAs and decrypts JSF view states, then introduces CBC-R, which reuses a decryption oracle as an encryption oracle to forge arbitrary plaintext without the key. A distributed cross-site variant reads the oracle bit through img load events.

Record

Document

Practical Padding Oracle Attacks

Researcher

Juliano Rizzo and Thai Duong

Published by

usenix.org

Date

25 May 2010

Format

Whitepaper

Topic

Crypto

In the archive

• Ranked #1 in the 2010 Top 10 Web Hacking Techniques

Related sources

• Flickr's API Signature Forgery Vulnerability Paper
• Automated Padding Oracle Attacks with PadBuster
• POET vs ASP.NET: DotNetNuke Recording

Tags

• side-channel
• deserialization
• java
• rce
• tooling
• info-leak
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Juliano Rizzo and Thai Duong, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 September 2026.