Cipher block chaining
This exercise details how to tamper with data encrypted using CBC
In this course, we explore the exploitation of a PHP website's authentication weakness, specifically focusing on the use of CBC (Cipher Block Chaining) encryption. The website employs CBC to encrypt user-provided information, which is then used for authentication. We demonstrate how to manipulate the Initialization Vector (IV) to alter the username in an encrypted cookie, allowing unauthorized access.
You will start by creating a username similar to the target username and then modify the cookie's initial bytes to impersonate the desired user. The course covers the basics of CBC encryption and decryption, illustrating the process with diagrams. You'll also learn to automate the attack using scripts, decode and manipulate cookies, and understand the XOR operations required to achieve the desired outcome.