Rustpad – Multi-Threaded Padding Oracle Attacks Against Any Service

; rustpad --help  rustpad  Multi-threaded Padding Oracle attacks against any service.    USAGE:      rustpad [OPTIONS] --block-size <block_size> --decrypt <decrypt> --oracle <oracle> <SUBCOMMAND>    OPTIONS:      -B, --block-size <block_size>              Block size used by the cypher [possible values: 8, 16]        -D, --decrypt <decrypt>              Original cypher text, received from the target service, which is to be decrypted            --delay <delay>              Delay between requests within a thread, in milliseconds [default: 0]        -e, --encoding <encoding>              Specify encoding used by the oracle to encode the cypher text [default: auto]  [possible values: auto, base64, base64url, hex]        -E, --encrypt <encrypt>              Plain text to encrypt. Encryption mode requires a cypher text to gather necessary data        -h, --help              Prints help information            --no-cache              Disable reading and writing to the cache file        -n, --no-iv              Cypher text does not include an Initialisation Vector            --no-url-encode              Disable URL encoding and decoding of cypher text        -O, --oracle <oracle>              The oracle to question with forged cypher texts. This can be a URL or a shell script.              See the subcommands `web --help` and `script --help` respectively for further help.      -o, --output <output>              File path to which log output will be written        -t, --threads <threads>              Amount of threads in the thread pool        -V, --version              Prints version information        -v, --verbose              Increase verbosity of logging      SUBCOMMANDS:      web       Question a web-based oracle      script    Question a script-based oracle  

; rustpad web --help  rustpad-web  Question a web-based oracle    USAGE:      rustpad --block-size <block_size> --decrypt <decrypt> --oracle <oracle> web [OPTIONS]    OPTIONS:      -c, --consider-body              Consider the response body and content length when determining the web oracle's response to (in)correct padding        -d, --data <data>              Data to send in a POST request            --delay <delay>              Delay between requests within a thread, in milliseconds [default: 0]        -e, --encoding <encoding>              Specify encoding used by the oracle to encode the cypher text [default: auto]  [possible values: auto, base64, base64url, hex]        -h, --help              Prints help information        -H, --header <header>...              HTTP header to send        -k, --insecure              Disable TLS certificate validation        -K, --keyword <keyword>              Keyword indicating the location of the cypher text in the HTTP request. It is replaced by the cypher text's value at runtime [default: CTEXT]            --no-cache              Disable reading and writing to the cache file        -n, --no-iv              Cypher text does not include an Initialisation Vector            --no-url-encode              Disable URL encoding and decoding of cypher text        -o, --output <output>              File path to which log output will be written        -x, --proxy <proxy>              Proxy server to send web requests over. Supports HTTP(S) and SOCKS5            --proxy-credentials <proxy_credentials>              Credentials to authenticate against the proxy server with [format: <user>:<pass>]        -r, --redirect              Follow 302 Redirects        -t, --threads <threads>              Amount of threads in the thread pool        -T, --timeout <timeout>              Web request timeout in seconds [default: 10]        -A, --user-agent <user_agent>              User-agent to identify with [default: rustpad/<version>]        -v, --verbose              Increase verbosity of logging      Indicate the cypher text's location! See `--keyword` for clarification.  

; rustpad script --help  rustpad-script  Question a script-based oracle    USAGE:      rustpad --block-size <block_size> --decrypt <decrypt> --oracle <oracle> script [OPTIONS]    OPTIONS:          --delay <delay>              Delay between requests within a thread, in milliseconds [default: 0]        -e, --encoding <encoding>              Specify encoding used by the oracle to encode the cypher text [default: auto]  [possible values: auto, base64, base64url, hex]        -h, --help              Prints help information            --no-cache              Disable reading and writing to the cache file        -n, --no-iv              Cypher text does not include an Initialisation Vector            --no-url-encode              Disable URL encoding and decoding of cypher text        -o, --output <output>              File path to which log output will be written        -t, --threads <threads>              Amount of threads in the thread pool        -v, --verbose              Increase verbosity of logging      Script must respond with exit code 0 for correct padding, and any other code otherwise. Cypher text is passed as the 1st argument.