Collected research

ASP.NET 'Padding Oracle' Crypto Attack

'Padding Oracle' Crypto Attack Affects Millions of ASP.NET Apps

Dennis Fisher · threatpost.com

News report on Juliano Rizzo and Thai Duong's padding oracle attack on ASP.NET, presented at Ekoparty 2010. Modified ciphertext in a session cookie makes the framework return distinguishable errors, and enough of those errors recover the key. The pair say the attack is 100 percent reliable, typically inside 30 minutes, and released the Padding Oracle Exploit Tool.

Record

Document

'Padding Oracle' Crypto Attack Affects Millions of ASP.NET Apps

Researcher

Dennis Fisher

Published by

threatpost.com

Topic

Server

In the archive

• Collected in the 2010 research round

Related sources

• Vaudenay’s CBC padding-oracle research Whitepaper

Tags

• aspnet
• dotnet
• cookie
• side-channel
• auth-bypass
• case-study
• owasp-a01-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Dennis Fisher, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.