EUVD-2026-80067

An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed...

CVE-2026-15638 Cryptographic Padding Oracle

An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed...

CVE-2026-15638

Delinea Secret Server is affected by a cryptographic padding oracle vulnerability (CVE-2026-15638). An unauthenticated user with network access to the server can leverage the oracle to decrypt or encrypt data using one of the server's cryptographic keys; however, the key itself is not directly ex...

CVE-2017-1000486

CVE-2017-1000486 Primefaces = 5.2.21, 5.3.8 or 6.0 - Remote Code Execution Exploit To install the requirements execute: root@kitploit: git clone https://github.com/pimps/CVE-2017-1000486.git cd CVE-2017-1000486 pip3 install -r requirements.txt Here is how to use the exploit: root@kitploit: $ pyth...

dotnetpaddingoracle

dotnetpaddingoracle Small script to check if the .NET web application is vulnerable to padding Oracle This script actually verify if the oracle is present and exploitable, not just if the patch has been installed. usage root@kitploit: dotnetpaddingoracle.py -h -t -b -d -s -p PARAMETER Burp reques...

Oracle-OAM-Padding-Oracle-CVE-2018-2879-Exploit

Oracle-OAM-Padding-Oracle-CVE-2018-2879-Exploit Introduction This exploit was developed during pentesting activity against oracle OAM 11.1.2.3.0. It was developed based on the technical description by sec-consult root@kitploit:...

OAMBuster

OAMBuster Multithreaded Padding Oracle Attack on Oracle OAM CVE-2018-2879 Authors Red Timmy Marco Ortisi, Stefan Broeder, Ahmad Mahfouz Description This multithreaded exploit was developed to greatly increase the speed of the attack as compared to the single threaded version. For more information...

pax

pax 利用填充预言机（Padding Oracle）进行攻击，获得乐趣与收益！ Pax（填充预言机利用工具）是一款用于利用填充预言机的工具，可实现以下功能： 1. 针对给定的 CBC 加密数据，获取其明文。 2. 针对给定的明文，利用预言机未知的加密算法，获取加密后的字节。 该工具可用于泄露加密的会话信息，并且通常能够绕过身份验证、提升权限，甚至通过加密自定义明文并将其写回服务器来实现远程代码执行。 一如既往，此工具仅应用于你拥有所有权或已获得探测权限的系统！ 安装 从发布页下载，或使用 Go 安装： root@kitploit: go get -u...

poodle-PoC

Poodle PoC 🐩 🐩 🐩 A proof of concept of the Poodle Attack Padding Oracle On Downgraded Legacy Encryption : a man-in-the-middle exploit which takes advantage of Internet and security software clients' fallback to SSL 3.0 The Poodle attack allow you to retrieve encrypted data send by a client to a...

padre

padre padre is an advanced exploiter for Padding Oracle attacks against CBC mode encryption Features: blazing fast, concurrent implementation decryption of tokens encryption of arbitrary data automatic fingerprinting of padding oracles automatic detection of cipher block length HINTS! if failure...

padre

padre padre は、CBCモード暗号に対するPadding Oracle攻撃のための高度なエクスプロイターです。 特徴: 高速で並行処理に対応した実装 トークンの復号 任意のデータの暗号化 Padding Oracleの自動フィンガープリンティング 暗号ブロック長の自動検出 ヒント！操作中に失敗が発生した場合、成功するために調整できる点についてヒントを提供します GET/POSTパラメータ、Cookie内のトークンをサポート エンコードルールの柔軟な指定（base64、hexなど） デモ インストール/アップデート...

padding-oracle-attacker

padding-oracle-attacker CLI tool and library to execute padding oracle attacks easily, with support for concurrent network requests and an elegant UI. Install Make sure Node.js is installed, then run root@kitploit: $ npm install --global padding-oracle-attacker or root@kitploit: $ yarn global add...

PadBuster

PadBuster - Padding Oracle攻撃を実行するための自動スクリプト 作者: Brian Holyfield - Gotham Digital Science [email protected] 謝辞: J.Rizzo氏とT.Duong氏には、概念実証のWebエクスプロイト技術の提供を、S.Vaudenay氏には攻撃の最初の発見を感謝します。また、James M. Martin氏 [email protected] には、様々なブルートフォース攻撃手法を実行するための概念実証エクスプロイトコードの共有を感謝します。 PadBusterは、Paddin...

CVE-2016-2107

CVE-2016-2107 Simple test for the May 2016 OpenSSL padding oracle CVE-2016-2107 Installation root@kitploit: $ go version go version go1.6.2 darwin/amd64 $ go get github.com/FiloSottile/CVE-2016-2107 This tool only builds with Go 1.6+, and only when downloaded to the right position in the $GOPATH...

python-paddingoracle

python-paddingoracle：一个可移植的填充预言机（Padding Oracle）利用 API 已针对 PYTHON 3 更新 python-paddingoracle 是一个 API，为渗透测试人员提供了 PadBuster 及其他填充预言机（padding oracle）利用工具的可定制替代方案。这些工具很难（不经大量重写）应用于独特的、因应用而异的场景，例如非 HTTP 应用、原始套接字、客户端应用、特殊编码等。 用法： 要使用 paddingoracle API，只需实现 PaddingOracle API 中的 oracle...

python-paddingoracle

python-paddingoracle: A portable, padding oracle exploit API UPDATED FOR PYTHON 3 python-paddingoracle is an API that provides pentesters a customizable alternative to PadBuster and other padding oracle exploit tools that can't easily without a heavy rewrite be used in unique, per-app scenarios...

oracle-oam-authentication-bypas-exploit

Oracle Access Manager OAM Authentication Bypass Exploit Introduction Exploiting Oracle Access Manager OAM padding oracle vulnerability CVE-2018-2879 to perform authentication bypass and login to any web app protected by OAM using valid username. This exploit is based on OAM padding oracle...

SHIRO-721

SHIRO-721 RememberMe Padding Oracle Vulnerability RCE 0x00 简介： cookie的cookiememeMe已通过AES-128-CBC模式加密，这很容易受到填充oracle攻击的影响。 攻击者可以使用有效的RememberMe cookie作为Padding Oracle Attack 的前缀，然后制作精心制作的RememberMe来执行Java反序列化攻击，例如SHIRO-550。 0x01 重现此问题的步骤： 1. 登录网站，并从cookie中获取RememberMe。 2. 使用RememberMe...

CVE-2026-11119-Padding-Oracle-Attack-on-CBC-Mode-Encryption

CVE-2026-11119 – Padding Oracle Attack on CBC Mode Encryption Program Code Python root@kitploit: paddingoracleserver.py - Server that returns padding error from flask import Flask, request from Crypto.Cipher import AES from Crypto.Util.Padding import pad, unpad import os key = os.urandom16 app =...

CVE-2017-1000486

CVE-2017-1000486 This is a PoC of CVE-2017-1000486 with some payloads useful to bypass blacklisting lexicographic checks on standard functions used to achieve RCE getClass, exec, etc.. and for retrieving primefaces secret through Padding Oracle in order to be less noisy possible on exploitation...