oracle_padding.py 文件源码

def page(data=None):
    IV = "".join(random.choice(string.ascii_uppercase + string.digits) for _ in range(8))
    json_data = json.dumps({'username': 'Guest', 'flag': FLAG})
    data = cipher(json_data, KEY, IV)
    if request.get_cookie("secret_data"):
        secret_data = request.get_cookie("secret_data")
        try:
            try:
                if "libwww-perl" in request.headers.get('User-Agent'): # Anti Padbuster simple
                    response.set_header('Set-Cookie', 'secret_data=%s' % data)
                    return "Attack detected."
                plain = uncipher(secret_data, KEY)
                data = json.loads(plain)
                print data
                return "Hello %s." % data['username']
            except PaddingError:
                response.set_header('Set-Cookie', 'secret_data=%s' % data)
                return "Padding error."
        except:
            response.set_header('Set-Cookie', 'secret_data=%s' % data)
            return "Secret value error."
    else:
        response.set_header('Set-Cookie', 'secret_data=%s' % data)
        return '<a href="/">Enter website</a>'