I don't make a list of like kind of baby objectives here for the day. I'll put it all on the middle scope which is that know I suggested that this is our alternative project too. On Wednesday largely because. For instance I remember. Watching. When I was first learning crypto ages ago. And thinking like how on earth. Did. It felt to me like it was these people with encyclopedic knowledge of every little weakness that exists and so on. And . I've always hated subjects where you have to just like memorize a million different approaches to a million different problems like differential equations I like my subjects have a narrative that are you know that it flows from A to B you know and I am heading here whenever and so I kind of had crypto in that camp a little bit. I thought when I first started learning it which is like it felt the second time but different stuff whatever. I don't see it that way now but when I got started this read a bunch of textbooks and things like that whenever and I kind of knew what I was talking about. But then I'd see people who were really competent and I thought like how are they so much more competent. And it's because I've been reading textbooks and what they have done as do CPS right. So to some extent to really know where the weaknesses and pull off the weakest is in all of this stuff is is. Like the essence of publishing in the area. Going to build a name as a crypto guy or whatever else you. Just pull off the text. I know that people who've like published these things or whatever and were in the cool and I like a shitty public life. I mean other people the publishing the real stuff. And we're going to do one today. And you can if you get it. You can pull back from the stuff off all the time anyway. So so I believed in what I wanted. All I'm saying is that I want you to know block ciphers and modes and weaknesses in all the things that can go wrong and I had a gut level and it was a really good way. Now we have these pictures and stuff so I wanted to play the python Image Library and kind of is this like just extra pay become an awesome script or kind of person or whatever so we can do that and I'd like to see you do that TTR mold problem to really crack that one. The one with the can do in the off the back room. So we can do that together. Be totally appropriate. But I know it's going to be a half attendance kind of a day the last day of spring break and I'm really excited about this. So what I'm going to do is sort of walk you through maybe the warm up problem or just how this thing works. And because I think it's really scary. So I was thinking I had like this you know I'm a neurotic person like Woody Allen on some level where every interaction I have I can replay in my head later you know like you know what I did right or wrong and things like that. I don't know. I'm like Alpha go on human interaction crisis play myself. So so I like I one of these sentences I thought this morning you know because I've imagined this scenario visualize being in the room. Let's talk about this. Yeah OK I'll continue it it gets right and I'm right. I want to say stop it but yeah. Yeah exactly. So I think the sentence is I think this is the opposite of the black hat challenge where the black hat challenge you get these emails you say play fair Legionnaire whatever so. And I think you are like excited you get those e-mails like awesome this would be great. And then you dive in and you're like oh this kind of sucks like bile is really hard I've no idea you know like it gets harder the deeper you go into it. But it started feeling like it's gonna be great easy. This is the office. I think when you look at it it feels really hard. You're like I have no fucking clue what's going on in this code. But then once it clicks it's actually really easy. So I think all of these are solvable in 30 seconds. If you know what you're doing. But so the whole problem is dealing get your head right to know what you're doing which is a really cool reversal right. So it's in. And that's one of things I really like. Is that like. I was almost tempted to do the black. I challenge myself to see how quickly can I write like you know from scratch or whatever because I believe that these are things that you just get better if the problems don't get harder. And that's really cool also about personal growth. Is that the problems are justice intimidating as they ever were. But you're such a bad ass you in 30 seconds and other people don't. Right. And that's like a general General like hey I can defend myself right. I can just do this 10 times better than other people you know. So hey that's so cool as. It was. So. Up wanted and just like Project two. I kind of gave them points based on my destination of how hard it should be for you. Roughly. I almost think that problem 1 and 2 are the most work of any of them but they're very similar to each other. And so you kind of see problem wanted to as one problem is worth 20 25 films . To some extent. The points are arbitrary. I think they add up to seven hundred and fifty. You know great. We can have a high score board or something or whatever but I didn't like to implement it. And also like you guys will certainly show there's a chance that flags will move around from student to student somehow you know so just suddenly the flag is not enough here I want to see you just a little write up of what how you cracked it right. What it with the script with the idea like you know. I'd like to see this and say that just 2 percent saving your iPhone. Oh. So here is the kill kill a little bit of sleep making this for you because a lot of issues I'm done at home. But that's all right. Two days to write a CTF right. So I've got things posted on a flask server flask is just kind of PSP but python. So it's going to be on the server and the server is going to take your request and process it in Python and send you back the results. So here is the flask server at CTF 1. That gel that actual dot com. I don't know if you guys are going to be able to like please don't attack my server and try to get into the same time he y by you know exploiting something on there whatever I mean if you do write it up and you know every time that I asked you not to try and I also don't know if like 40 of you I think that you're probably gonna have to make about twenty thousand requests each to the server something like that and a lot of times when you start to run your script you're gonna make four or five thousand requests in a road and got a two minute period. You know maybe a full twenty five students did all of those 4000 requests in the same two minute period it might crash something you know if that happens let me know. I can spot up more servers you know just stuff. So I did not vet this as like an I.T. guy like per say in terms of volume so I don't know if this is ready to release to 100 CTF teams around the world or whatever else at the same time it might be OK but it's blast. So it's fine. Here's how it server works. This is the literal server imports from a secret file key zero flat zero key six flags six to 12. OK. These are just as good as any ports. Q 6 5 6 0 5 0. Runs flask whatever this is just a utility function for a problem six if you go to slash you'll see this message. So if I go to that and where l hit enter I see that message. Okay. So that if that is the right server the ones that are a problem once or for it only says usage problem 1 or 2. But you can see the exact server. All right fine. Then if you go to PS zero slash get flagged it's gonna execute these four lines of code. This assertion tells you the flag has 48 characters. Right. Right. You now know that. Why would I tell you that. Well because I'm giving you a problem so I'm aware that you know my source code. The source code is the problem and the server is how you can interact and an ongoing basis in a conversation with this problem. Now this is the warm up problem but again just like I'm saying about the opposite of the black hat it's a more of a problem cause cryptic graphically it's really really easy but it's got to feel hard to you which is kind of what I wanted to do today is sort of a normal lecture whenever I say let's do this warm up problem kind of or whatever like that you kind of on the right road which is to say when you do get flagged I'm going to generate sixteen bytes of true random and put it into the Ivy and I started to cipher using a secret key that you're never going to know and your job is more or less never to find that key like in none of these is your job to find any of those keys. All right. So these. So here's one and this one of those subtleties of the philosophy here ADX is strong API yes on its own. If you don't know the key you've got zero chance of figuring out how it works. Right write it encrypted plain text. You should have zero chance of doing that. And yet we've got seven problems you can crack that or 80 Yes days straight or six or eight years. So you're going to crack a real high level thing that's always going to be because the implementation is wrong. Right. Which is why it's so important to me in this class is that you're going to be doing this for real people for real money on the line and you're going to fuck it up like this. Right. And if you do that you're at risk. And so you have to know what does that even mean. Is it like what are the types of risks to face. So all right. So here it is. This is not bad. This is high class. Encryption here. Right. I see no flaws in lines. Twenty five for you're 28. I've got a three block flag. I get a random IP. I encrypted the CBC mode CBC modus fine. Yeah what's up. You say that if the random I.D. would be . Generated in that function or method. So you're remembering that problem from the image with the CCR mode. But this is different every single time I call it. So let's test that actually let's just test that hypothesis right. So how do I generate the flag. Well I go to be you or else slash p zero slash gameplay. So you go to the URL slash p zero slash you get the flag and I get a flag. All right. I can copy paste this now. Fire up my file on I don't do this and I'll say the length of teeth. It's actually 64. Right. I know the flag is like 48. All right. Because the idea is the first 16 blocks you can look at the code to see that and you should just get a laptop. Don't let yourself get lost in a few minutes late. My whole goal today is make sure everybody is on board. Exactly. I. Don't think I'll get this later. Get it now. All right. But just to show you that it's random every time I get a hit enter again different you get different levels. So. How does it look. I just lost it because of the fights. Not like it is not mono spaced font. That was actually said it doesn't mean I actually want this to show is like Jason Jason. I'm not a classic. It's the first I to play the last product. So that was another part of the fun losing sleep is figuring out how to get the last word in quick fashion. OK but this is proof that cryptic graphically This is fine right. If if I'm encrypting the exact same message every time you have no idea. If you didn't have the source. Right. So that's high quality encryption. So what's the weakness. Well I give you another thing which is called decrypt the block. OK. So this is more of a problem. I will decrypt any blocking on in ECB mode. So all you gotta do here is is follow the CBC diagram and do the decryption using my little web server. All right. Now this like any of the things that I would call a console you can do one way and get the answer and then I encourage you to do it a better way and get a better answer right. In terms of your scripting or whatever the answer is maybe the same to get the flag and move on but mentally one of the things is going to have to happen especially for problems going into you're going to have to make thousands of requests to the server and pass that content. This is the one place where it's easy at a disadvantage. There's then went to where I think get to meet thousands of requests on the server. No. There's no one in my area. There might be three or three thousand three guys. That's. But. That's OK. Making requests for a server is actually not that hard and that's one of the things we'll do today is make sure that you're comfortable interacting with cryptographic server. So a lot of these have. Little leaks and things like that for various kinds of attack moments like in this case. You have a decryption oracle. Well you have a decryption as well and you're not even limiting you from decrypting flag blocks or anything like that. Yeah OK. That's why it's more of a problem with twenty five but still do it because I think the logistics of it might scare you. Right. So. So let's pull that off together. Twenty three. Point. Four is one twenty eight a thing for the length of the flag over. Right . Now we're getting one twenty four point forty eight. I assert that the length of the flight is 48 here. Yes. This this is one hundred and twenty eight ASCII characters OK. Yes. Now that's. Yeah. OK. OK OK. So so where's this hundred twenty eight. Because that's because I don't know what length 128. That's exactly right. But why is his length 128 and why was I shocked by that number. OK. Right. So I'm asserting that the flag's length 48. But what did he do to get length 128. He didn't decode the hex. That's been your problem every single time you've called me over the last week. So hex is not played like Max is not wrong. I'm only using hex to make it easy to copy paste if we all had just computer interfaces we'd never touch. But we're humans. So we have to touch. So 128 is actually 64. I would like to see team guy before. You did it you got 128. Now I want to. Yeah good. Yeah. And then why does 64 not 48. Because in most of these I take the IP and I and I make it the first 16 bytes. Right. Which is really thirty two bytes. If you're not decoding that's OK. Now when it comes to decrypting a block so let's decrypt a block. Now this is CBC mode rates. They already have a seat. So my idea is the first sixteen bytes of that and my sacred text is actually the last 40. Now how does CBC mode work. Well you probably just want to stare at CBC mode image. So I stared at this for a while and maybe you want to start the decryption diagram for a while you see it's also background like. And if it was just hanging out in the class and you didn't get the email as cricket your side project to . Someone else. So we're looking at CBC mode. So you just take a second talk out with people at your table. Nick Foles over there you need to probably move to different tables you can share. Yeah sorry. You got a similar bill. Kennedy. With that regard. I'd like I Jalen Ramsey on Twitter was like when we hired Nick Foles is like substitute teacher asked buddy because Jalen Ramsey talks anyway. I've had that my head for the last week is. It's. Not. Very nice. So talk about what are the steps that you do to be this warm up. You have my blessing to join together to solve more a problem. I want to. See. Anyone. Any. Of. US . TOO. NOW. CAN. YES. I think. So. Yes. Oh. Yeah. Yeah. Yeah. I mean you've got to. Get to see us. Always. We can. See this in my mind. You never did find the key. You never need to find. It. None of these problems. You need to find the key and generally your block cipher intuition should almost never find the key parts. So. I. Say this. Because it makes . No sense right. Feels. A. Perfect. Temptation. To just leave with a second. On the that's clearly not the point which. Is . Why you don't wish you luck. I can't play. This is exciting I so. So there's a thing there and then you say anything it's pleasant like Michael Moore did hours from now here at this diagram. But we. Can. It as to where I don't understand why so many things. Go. So I want to get you comfortable with how I wondering in this web server these works and how do I look at this for solving problems. Let's check on you. If you go anywhere else CTF Why is that gel. I actually like. That's fine. Then if you look at that server it kind of shows what it doesn't give a crap. So you just go there you'll see these flash and check stealing usage and then it goes slash P zeros I should get flagged you'll get an instance of the five minutes that you refresh it will be different in your books. So glad you. Said . That. Yeah. You. Know you don't see that anywhere. Right. Like I would not advise doing that order cause problems 1 3 4 are harder than it gets from a government point order or opposite point where you want to. You know I I don't you sort of person that eats the frog in the morning where . It knocks off the easy things that you to do with the signature coax out or whatever. Like I don't I'm not I'm not even frog person so I go the hardest and work my way backwards. But no injuries like that. To. Do. Of. The. Case . More or less the other you are out gives you this part of the diet right. So you've got an Oracle a decryption oracle that would do this error. So I decided I was going to say well how do I pull off these steps and do them using that you are L and you do that. Oh. My. Slept. At one. Point. Seventy nine. Or. Older. While. It's really the closest to. Place. Because. It's very. Fast. So I'm gonna to decode my first block the second text I have to put it back in the hex order to stick it on your l. O. Say decrypt block 33. Slash. That's. OK . I get this back on if ever you've got an internal server error you've done something screwed like you've given it. Not enough characters rhetoric and you aren't going to get the error message. I will. I've got some OG file if you like it throws an error. This is your block should be longer whatever your Cincy the internal server. Sorry but that's information too like that is actually leakage . From one of the problems leaves and that leakage. Maybe we'll talk about it. So this is decrypt one is that right. What should you do with that. So I've taken the first sixteen bytes of my sacred text I've decrypted it. I have that raw thing now we'll see. Let's look at that picture again. So I now know this side of the arrow. We know that it is X or those two things and I should get my first one. Out do we have done. Yes. The first sixteen bytes I'll get . Way. OK. OK. I feel good about that. That's all the more I'll give up. So. I don't see these. Conservative ones. Peter. Yeah. Slash. I. Find. That. How does he know. What you said. There must be a slab someplace. Take a look at the service and let's see it's there. Let's. Take that. Give them food. Homeless. Throughout. The rest of. The day. It's a good question. I think we're thinking about the key. What's going on with the kids. Well the essence of the problem is that the secret and then he planted . A flag are secrets that the server knows. And if not going to just show you the flag but it will let you know it doesn't. Look like you can't decrypt yourself with that he is your own. But you regained its secret. Thank you for your support. So that's why if some wrong or whatever I said my ass. About. Biology but . You don't get to just write your own check but you at least hope that the to convert this area in the same year. So I think all of us have room for all the same. Oh really. Oh. My. I'm just thinking about my. Ovaries . Again. Just. Kidding. Sighs. They're. So openly. Silly. Last week. You sent. Out a rebuttal. When. You. Showed. That. All of their stories were. This. Is . A disease that is less pleasant yet a safer place. You're doing it blah blah blah. Here. What wasn't there a way to just do it all at once with to be clear yelling at the motor on the ground right. Yeah totally. But you don't have that ability here right. Because you are the key. Oh so you like haven't you guys like all you get is the server going about that of. Course. Is. Pretty bad. And whether they actually. Just. Kind of. Fired a big it's time you know. You're on . Your own. That's correct. Correct. That's correct. Slash. It's like somebody. Oh. OK. Explosives. Not . Acting. Guess. What. So I'm going to purposefully mangle my Hex here. I'm just going to delete some of it and enter and I get internal server. And if I go look at the logs it's gonna say online whatever this server file can't decrypt must have sixteen bytes because it's the box. So I could make something like pads or whatever and there is a pattern problem. So. So if there was one intellectual thing I did want to accomplish today that isn't just doing this. It's to look at the padding issues. But I'll be patient. So. So. This has always crack at least one block of the warm up problem. What are we at. Good idea. Yeah. Well you look at your diagram and the diagram says decrypt first blockers like text X or it with the Ivy and c plaintext. OK. I use what this. Is about. The idea is the original thing. Now this is the decryption diagram. If you look at the encryption diagram for CBC what they do is they take the IP X or the plaintext and then encrypt that . Record. That was funny. So the decryption has to go the other way. Direct excellent excellent. Decryption so if you pay something. In. I read it aloud. So. I'm happy to fix. It. With. Should not show the same. For game. Yes. Yes. This email. Continues to generate another one. You'll never get back to this argument. I mean if you try for a long time like you like the universe and the next one is the next generation next universe for you to get. To the one hundred universes then you might give it. All I could just look at the logs. Maybe you like I don't belong as those guys. Down. The street. I said if you're struggling to get the server explaining how this works would ever call me over and let's do it. I need the service. Sort of what could. Happen in the second half. Of the I see assuming that the first actually. Interactive . Didn't play. I think to say that that's. Very. Reason problem 2 is not problem . Lines. Yeah. Yeah. And Santa. Is. Now. Saying. Get us to the lake or. I'll. Get . Ahead. Yes that's right. So. So you have to think a little bit differently to get the backpack to the little. Whenever . You wanted longer. You got the first 21 lines. The first one in one place. And. Then. You had it really work. I've seen. So if they. My. Oldest. Of to. Fully remember previously. So. I just love that. What would you have preferred next block. Of say. Yes might be helpful for you. Are you looking at the 30 percent. Early yet characters in. The . Play the diplomats use all lowercase o. Wish they. Were . Like the reason. That's helpful. Just because this isn't actually any slower. Some people have you know. So I feel like. We're just getting nuts back. And I think I have all the shouting and I need to do it right. Yeah I shouldn't be a problem. I think I practiced you know I sit there for 45 seconds. Like. Back the script around. This . Is great. Thanks for. Being. Here . Tonight. Why. Do. We say 20 seconds between 20 seconds here. Yeah it's insulting that one to read this tournament. I mean obviously the same idea right now. Yeah it's a game. So getting on with life become one. So how is probably the big difference. I'm shocked you got 21 Yes 21 k. And. 12. Well I was going to give a little mini lecture on that. Yeah. That's right. I think the pattern is yes to this made me think. Psychologist. That . We need some help people problems. Yeah bottom line is that is. Charities. That I try to pick these problems out so that if you can. Get all of these more or less you can get points in every city your participate so there's always going to be one of the problems that matches like a 7 something. LBJ. Side of things is to. Have. Needs for your . Jerry. Simply spot over the differences between problem 1 and problem to. Solve a particular. Part of the. Way. I like. The hybrid . I imported it from here. It's. A. 3 . By line seven and eight. So. You would think. I. Would get them in the same . System. Sorry. How do you. Measure it. How did you. Ask play. Oh. So you get it. Well if you take a look at this when you use the device to say. So these are at CTM to tell them in actual. One is encrypt. Whatever . I get. Well if I create nothing that's my flag that's the flag. All right. So that's an inscription on the flag with the key. Attached to it. But I I almost don't even need that. Like I almost don't even need the encryption of the flag. I mean I need to decrypt the flag. Yes. I don't need the sacred text of the Flag order flags schools. Is. Supposed. To . Give. OK. So. I've got. Work to do. So that's like one of the sacred texts we feel good about that. OK. So let's go to where you are. Anywhere. OK. So we will keep zero. Gravity guy and replace hex digest. No. No. Go . Ahead. Yeah. So. So and that's why I wanted to do this in class today. Right. Something now you've got everything. Mentally you need rest. OK. So let me talk a little bit about this pattern problem I've skirted it all of the conversations about black ciphers. But there is a big issue which is that I can't encrypt something which is five plus blocks cipher. Now some of the modes kind of can you will find two modes that don't really complain o f b and c TR if you give it some off brand cipher text or plaintext it's just going to XOR. So it uses those in the stream cipher mode. So it's just going cryptic cryptic encrypted give you this big random thing and XOR it with your plaintext. So if you're plaintext is it perfectly 16. That's OK. And sometimes you need that right. Sometimes you need ciphertext that is exactly like plaintext. That might be a good reason to use one of a string of cipher modes. But most of the time CBB CBC or ECB or TCI these are the guys you need to pad till like 16. OK. So if you're paddling 16. How do you do it. So these are kind of almost ok but not actually. So like part of the CTF is that my padding is a little bit clunky and so. But this is OK. So what I what I do is say OK it's like like 16. I didn't actually use block size get it. I could delete lines 13 human the number of bytes I need to pad by is going to be 16 minus the length of the message mine sixteen. Now this is the part that's technically wrong on the padding. No that's not. This actually isn't in my challenges at all per say this doesn't actually affect you very much at all. Maybe problem 2. I don't know. But me doing this. No it's not. Sixteen means that if I have zero pad needed I'm not I'm not spending a block that says 16 16 66 says sorry. So let me show you what I do. Let's suppose I need exactly five characters then the way I'd pad this thing and you should just do this at home like this. Copy the pad do it yourself. Paid me a letter a . Pad. If you're somewhere. Or just Natalie Portman I mean ABC TV. So what am I doing in my cabin. I'm taking the number of bytes that I need to pad with and I'm finding that actual value as the pattern. All right. That's fine. That's actually a fine pattern scheme to place but this is a little bit wrong is that I actually think it's better to pad with an entire block. So if I had something that is exactly you know 16 characters I actually want to add a block of 16th at the end as opposed to not. I did not write a CTF problem centered around the leakage that happens there. I was tempted to but just a little bit too subtle which is that when you had the unpaid will read the last bite and then removed that many bites if they're all the same. So. So the idea is that I can just look at the last bite. Know exactly how long the padding is stripped and on back to the right size after my description. OK. So this is like now there's a thing in this. Right. And this is not that. This is not that bad. But the place where it got really scary for the world is minus 20. So like 20 is what opens up the door for what I call padding oracle attack. All right. So this is the essence of problem. For a problem for you get the encryption of a password that has been passed and you get to decrypt anything you want. So you've got a decryption Oracle. But you don't actually see the encryption. So. So you don't actually see the output of the decryption. You only see. Whether or not a decrypted to the password or whether or not it doesn't decrypted the password for a third thing which is if the padding is screwy and that's where all the leakages. So there are three possible ways that this can go wrong. One is you don't have the password. One is you do have the password. The other is you have a bad part and that's enough to read the entire password. So so in this attack it's not quite a decryption Oracle like the warm up problem. You don't actually get to see what got decrypted but to imagine that this is actually a real world scenario. Is that right. Tampering with your ciphertext sending it along to the bank transfer and I see women on their complaining or the way that they're complaining or whether the server is sending an error message or whatever else. Like I can see something went wrong when I screwed with it this way. That's the kind of work you have here which is actually really really common. And this problem has been haunting could be like SSL. Tell us what are you gonna call it for a decade and they keep trying to fix it in funky ways because salt in turns it do it or whatever else they haven't had enough of this. So they're patting this patting Oracle back has a bunch of different names that they're calling the beast attack and I'd like eight different variations of the beast attack the beast returns less these attack. And. Like. History. Is still a thread it pops back. Yet crime and breach are all basically just the beast attack again after they're trying to patch in the brutal attack is all just police attack again. So all of this just comes from bad padding. And the fact that the packets are coming across the Internet and they have to know like hey I was backpacking and they and they're just the error messages and the timing of it and things like that is enough to detect which of these cases happen. So so that particular type is actually really important to your conceptual understanding. And you know and I gave it the most points I think I give it the most points of anything at two hundred for one problem . Although problems one or two are kind of two twenty five for the same thought process. OK. Don't ask questions on the link because I'm positive that that wasn't enough for you to just get it. Up. To 1 4 from 4. Yeah. Can you conceive of what happens here. So how are you going to do it. So I you can see the exact padding algorithm which is this one. So. So this password you don't know the password you know how long the password is whatever the password got patted. OK. So in fact let's just do. Let's just do it real quick to kind of validate some stuff. So let's go forward and create OK here's my passport now. It does have an Ivy. It's a random IP. It's in CPR mode with that and the CCR has done really well. So OK maybe there's a floor to as a different floor. Yeah that's a different floor there. I should have a different idea. Oh no no no no that's that's not that's on the floor. That's why. I. Was getting my head mixed up. I'm generating a random I.V. and making a counter. It's encrypting the value of that I.V. And it's adding one encrypting that adding one thing that adding one encrypting that for every block that I need something extra. That's counterfeit. But it's padding. And then here if I pass it the heck scientists in the I.V. It will decrypt with that same key. I'm going to pass it and it will unpack. And that's the key part on that. So let's take a look. Here's my thing. I find on. And. Pulls. This. Code. And. This. Is for 316 IP and the CDC is equal to some. Border . City. So this is the encryption of the passport. If I know the password it will just tell me the plan. So in this case the third function on that server says just tell the password and it will tell you the flag to get the right password. I'll just tell you that. Cool. Great. So all you do is unlock your password then. Now I have text digest in the Ivy. So I want to just kind of double check that like I can get all three of these different types of problems here. So I've got my Maggie. Here's kind of what I would do would you like make that you are all I want. I'll say C.T. done in code x plus this plus IBD and code x. This is kind of the thing I have to copy paste the . Fax. Let me show you how to do this in Python so I don't have to go back and forth like chrome. I can go. Import requests requests doc get CTF to God. Gerald I want a factual outcome slash pain for Slash because it decrypt slash. And I can save this is sort of my response. And I can say I've looked at the status code and I can look at the text so that way programmatically I can do this a thousand times a minute or whatever. You know like I can just go nuts getting the server which is why I didn't put it on my profit and the server crashed my server or whatever else. Like this service I use for anything. I don't care. Well if it does have I think it's got you the gelato that actual come. Up. No I took that. OK. It had a v arts who were of the ice suites but the ice sheets are real now. So I don't need to be Arturo. So here so you can see that what I got was Do you know the password which is saying Hey this actually works right. Like I just took what you gave it to me. I asked you to decrypt it when here and it's like hey how did you get the password or through this. Do you actually know the password or you'd like. Just give me something to decrypt the password. So that's like the most success we can get out of this thing here. Right. That's as good as it gets the network pool. OK. So let's do something let's change the last. Thing here. I have to. That's my last bite. It was contained to too deep. All right. This is not the other message. Right. This is something went wrong. OK. That's something went wrong. I should probably conceptions that I think it's. Not . Yes. Yes. OK. I'm changing the wrong path because I'm thinking of CDC. That's where backdoor the password. I want to change this part here internal server error still but. Yes. Yeah. Nine eight maybe something different OK so I think I'll just leave you with that. Like I just love you think about how of control matters. What does that mean. I was able to tamper with the ciphertext. And it. Gave me something . That wasn't the right password. But it didn't fail a bad patch. There were two types of failures. First one failure is not knowing the password. The other failure is that the pattern was bad and I see that as an internal server error. Which means that you have an oracle that will tell you whether or not panic is bad and you can tamper with the ciphertext. So. That should be enough for you to read the entire passwords and then get the. Next. Four. Weeks. Personal. Figure. Like yourself. What. Works or decrypting or you go to work because you know that . That's always a problem. Do you want everything in. Ask yourself if I didn't go to my next Labor Day have three men in your yard right. Including my. So. I didn't want to do it. Needless to say. I've. Signed. Up to do the tech story asking together how you feel like you want to export raw stuff together. So I like the decoding. It's just that we're very keen to make actual packages. For the. World. Yes. We didn't know the same as the time be the same. Especially today. So both axes are brought out as equal. Right. Now. And. That's . Okay. I guess it all as they did that. They decided to pay writers. Now that's . In the works. I don't know what it means. I know. But. But. That was wrong before. This is Maura . Probably you like me over any of the other lake. So he's here. Plaintext. Down to 3 3 was interesting way strangest thing you guys. Yeah. Well yeah I don't know. I like how he might help. I think three's pretty or easy. I got some good points Grant there maybe. Five is the only one it's not on a server YOLO you only roll your own crypto once. You're . On the board. I actually like this. I wrote my own crypto here.
cpeg472-010-20190329-101000.mp4
From Andrew Novocin March 29, 2019
58 plays
58
0 comments
0
You unliked the media.