Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-cryp-02
Testing for Padding Oracle
Passed 17 of 21 test cases with the skill, and 11 of 21 without it.
and 5 more in the full report
7 fixed11 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
What is the standard OWASP Web Security Testing Guide code assigned to testing for padding oracle vulnerabilities?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies WSTG-CRYP-02. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-CRYP-02
Testing for Padding Oracle
A padding oracle attack exploits the information leaked when a system reveals whether decrypted data has valid padding. This occurs with block ciphers in CBC mode when the application returns different error messages or behaviors for valid versus invalid padding. Attackers can use this to decrypt ciphertext without knowing the key.
# Look for encrypted parameters
# - Cookies with Base64-like values
# - URL parameters with encrypted data
# - Hidden form fields
# - ViewState (ASP.NET)
# Check cookie values
curl -sI "https://target.com" | grep -i "set-cookie"
test cases passed, vs 11 / 21 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.