Thank you so much! Your support keeps us motivated to bring you the best cybersecurity content. Stay tuned for more exciting content! Share these to fellow learners.
Hi, I still don't understand something. The string administrator:timestamp should be a multiple of 16? I don't understand that because the user name can change. I mean, I understand why you need to pad the first block but how can you guarantee that the next block will be a multiple of 16?
this block cipher size is 16. Which means, the encrypted value must be 16 byte size, not the administrator:timestamp. name can be anything. We deleted from the encrypted value. Not the name. Hope you get it.
@@HMCyberAcademy sorry but i Still dont get it. The encrypted part is the warning sentence and the name ! Not only the warning sentence. So why, we care only about the first block ? Éven in the video you Said That it should be 64 but after i got confused.
@@mohammedelbahlouli7242 Maybe you're not considering padding(spaces) at the end, that makes 64 bytes in total. "The main focus should be on stay-logged-in cookie, that's the one you use to login". But you don't know what kind of cipher is used, so, you use notification cookie, you should be able to decrypt the encrypted value. You can break the blocks based on block size (here 16, including the padding at the end), and use the blocks individually. If the server can read the blocks and understand it, it can give proper reply. If the blocks are not complete (not multiple of 16 including padding), you cannot get a proper reply. The notification error message adds 23 bytes in the beginning (not multiple of 16). So, you cannot delete first 16. Server can't understand. You cannot delete 23 bytes. because blocks will be incomplete. You can't simply add padding to counter it, because it violates the encryption method in server. All you can do is, Let the server generate 23 bytes in beginning, make the 23 bytes to 32 bytes(Multiple of 16) by adding random chars at the end of 23 bytes (Not at end of whole string). Use this string. Then when we get the block cipher, we remove first 32 bytes. And make sure the rest of the string(including padding/spaces) is also multiple of 16, not more, not less. Now the block is complete, readable, Server can understand it. Use that string to replace "Stay-logged-in" cookie. Remove any other cookies, because server can't understand which user you're trying to tell. Be patient, go step-by-step, understand them, You can get it. I'm sure. Because you're still trying. Most people give up when things get hard. You didn't.
great explaination , thanks from iraq
Great explained thank You
Thankyou, very nicely explained every labs.
Thank you so much! Your support keeps us motivated to bring you the best cybersecurity content. Stay tuned for more exciting content! Share these to fellow learners.
Hi, I still don't understand something. The string administrator:timestamp should be a multiple of 16? I don't understand that because the user name can change. I mean, I understand why you need to pad the first block but how can you guarantee that the next block will be a multiple of 16?
this block cipher size is 16. Which means, the encrypted value must be 16 byte size, not the administrator:timestamp. name can be anything. We deleted from the encrypted value. Not the name. Hope you get it.
@@HMCyberAcademy sorry but i Still dont get it. The encrypted part is the warning sentence and the name ! Not only the warning sentence. So why, we care only about the first block ? Éven in the video you Said That it should be 64 but after i got confused.
@@mohammedelbahlouli7242 Maybe you're not considering padding(spaces) at the end, that makes 64 bytes in total. "The main focus should be on stay-logged-in cookie, that's the one you use to login". But you don't know what kind of cipher is used, so, you use notification cookie, you should be able to decrypt the encrypted value.
You can break the blocks based on block size (here 16, including the padding at the end), and use the blocks individually. If the server can read the blocks and understand it, it can give proper reply. If the blocks are not complete (not multiple of 16 including padding), you cannot get a proper reply.
The notification error message adds 23 bytes in the beginning (not multiple of 16). So, you cannot delete first 16. Server can't understand. You cannot delete 23 bytes. because blocks will be incomplete. You can't simply add padding to counter it, because it violates the encryption method in server.
All you can do is, Let the server generate 23 bytes in beginning, make the 23 bytes to 32 bytes(Multiple of 16) by adding random chars at the end of 23 bytes (Not at end of whole string). Use this string. Then when we get the block cipher, we remove first 32 bytes. And make sure the rest of the string(including padding/spaces) is also multiple of 16, not more, not less. Now the block is complete, readable, Server can understand it.
Use that string to replace "Stay-logged-in" cookie. Remove any other cookies, because server can't understand which user you're trying to tell. Be patient, go step-by-step, understand them, You can get it. I'm sure. Because you're still trying. Most people give up when things get hard. You didn't.
@@HMCyberAcademy Thankyou