Rustpad - Multi-Threaded Padding Oracle Attacks Against Any Service

Padding Oracle attacks against any service. USAGE: rustpad [OPTIONS] --block-size <block_size> --decrypt <decrypt> --oracle <oracle> <SUBCOMMAND> OPTIONS: -B, --block-size <block_size> Block size used by the cypher [possible values: 8, 16] -D, --decrypt <decrypt> Original cypher text, received from the target service, which is to be decrypted --delay <delay> Delay between requests within a thread, in milliseconds [default: 0] -e, --encoding <encoding> Specify encoding used by the oracle to encode the cypher text [default: auto] [possible values: auto, base64, base64url, hex] -E, --encrypt <encrypt> Plain text to encrypt. Encryption mode requires a cypher text to gather necessary data -h, --help Prints help information --no-cache Disable reading and writing to the cache file -n, --no-iv Cypher text does not include an Initialisation Vector --no-url-encode Disable URL encoding and decoding of cypher text -O, --oracle <oracle> The oracle to question with forged cypher texts. This can be a URL or a shell script. See the subcommands `web --help` and `script --help` respectively for further help. -o, --output <output> File path to which log output will be written -t, --threads <threads> Amount of threads in the thread pool -V, --version Prints version information -v, --verbose Increase verbosity of logging SUBCOMMANDS: web Question a web-based oracle script Question a script-based oracle">

; rustpad --help rustpad Multi-threaded Padding Oracle attacks against any service. USAGE: rustpad [OPTIONS] --block-size <block_size> --decrypt <decrypt> --oracle <oracle> <SUBCOMMAND> OPTIONS: -B, --block-size <block_size> Block size used by the cypher [possible values: 8, 16] -D, --decrypt <decrypt> Original cypher text, received from the target service, which is to be decrypted --delay <delay> Delay between requests within a thread, in milliseconds [default: 0] -e, --encoding <encoding> Specify encoding used by the oracle to encode the cypher text [default: auto] [possible values: auto, base64, base64url, hex] -E, --encrypt <encrypt> Plain text to encrypt. Encryption mode requires a cypher text to gather necessary data -h, --help Prints help information --no-cache Disable reading and writing to the cache file -n, --no-iv Cypher text does not include an Initialisation Vector --no-url-encode Disable URL encoding and decoding of cypher text -O, --oracle <oracle> The oracle to question with forged cypher texts. This can be a URL or a shell script. See the subcommands `web --help` and `script --help` respectively for further help. -o, --output <output> File path to which log output will be written -t, --threads <threads> Amount of threads in the thread pool -V, --version Prints version information -v, --verbose Increase verbosity of logging SUBCOMMANDS: web Question a web-based oracle script Question a script-based oracle

Credentials to authenticate against the proxy server with [format: <user>:<pass>] -r, --redirect Follow 302 Redirects -t, --threads <threads> Amount of threads in the thread pool -T, --timeout <timeout> Web request timeout in seconds [default: 10] -A, --user-agent <user_agent> User-agent to identify with [default: rustpad/<version>] -v, --verbose Increase verbosity of logging Indicate the cypher text's location! See `--keyword` for clarification.">

; rustpad web --help rustpad-web Question a web-based oracle USAGE: rustpad --block-size <block_size> --decrypt <decrypt> --oracle <oracle> web [OPTIONS] OPTIONS: -c, --consider-body Consider the response body and content length when determining the web oracle's response to (in)correct padding -d, --data <data> Data to send in a POST request --delay <delay> Delay between requests within a thread, in milliseconds [default: 0] -e, --encoding <encoding> Specify encoding used by the oracle to encode the cypher text [default: auto] [possible values: auto, base64, base64url, hex] -h, --help Prints help information -H, --header <header>... HTTP header to send -k, --insecure Disable TLS certificate validation -K, --keyword <keyword> Keyword indicating the location of the cypher text in the HTTP request. It is replaced by the cypher text's value at runtime [default: CTEXT] --no-cache Disable reading and writing to the cache file -n, --no-iv Cypher text does not include an Initialisation Vector --no-url-encode Disable URL encoding and decoding of cypher text -o, --output <output> File path to which log output will be written -x, --proxy <proxy> Proxy server to send web requests over. Supports HTTP(S) and SOCKS5 --proxy-credentials <proxy_credentials> Credentials to authenticate against the proxy server with [format: <user>:<pass>] -r, --redirect Follow 302 Redirects -t, --threads <threads> Amount of threads in the thread pool -T, --timeout <timeout> Web request timeout in seconds [default: 10] -A, --user-agent <user_agent> User-agent to identify with [default: rustpad/<version>] -v, --verbose Increase verbosity of logging Indicate the cypher text's location! See `--keyword` for clarification.

; rustpad script --help rustpad-script Question a script-based oracle USAGE: rustpad --block-size <block_size> --decrypt <decrypt> --oracle <oracle> script [OPTIONS] OPTIONS: --delay <delay> Delay between requests within a thread, in milliseconds [default: 0] -e, --encoding <encoding> Specify encoding used by the oracle to encode the cypher text [default: auto] [possible values: auto, base64, base64url, hex] -h, --help Prints help information --no-cache Disable reading and writing to the cache file -n, --no-iv Cypher text does not include an Initialisation Vector --no-url-encode Disable URL encoding and decoding of cypher text -o, --output <output> File path to which log output will be written -t, --threads <threads> Amount of threads in the thread pool -v, --verbose Increase verbosity of logging Script must respond with exit code 0 for correct padding, and any other code otherwise. Cypher text is passed as the 1st argument.