Padcheck: A TLS CBC Padding Oracle Scanner

This tool tests how a server responds to various CBC padding errors.

The tool makes a series of connections where the TLS record containing an HTTP request is malformed. Servers should respond uniformly to all malformed records. If the server responds differently to certain types of errors, an attacker may be able to construct a padding oracle for use in an adaptive chosen ciphertext attack.

There are currently five malformed record test cases:

Invalid MAC with Valid Padding (0-length pad)
Missing MAC with Incomplete Padding (255-length pad)
Valid MAC with Inconsistent Padding (SSLv3 style padding)
Missing MAC with Valid Padding (Entire record is padding)
Invalid MAC with Valid Padding (0-length record)

Background

This tool was created to help identify lingering TLS CBC padding oracles. The research was originally presented at Black Hat Asia in March 2019. The slides are available for review.

For further reading on the topic, refer to the following links:

Disclosures related to modern TLS CBC padding oracles are being tracked on GitHub. This also includes oracles identified by TLS-Scanner

Usage


-h		Show help
-hosts	string	Filename containing hosts to query
-iterations	int	Number of iterations required to confirm oracle (default 3)
-keylog	string	Path to a file NSS key log export (needed to decrypt pcap files) (default "/dev/null")
-v	int	Specify verboseness level (default: 1, max: 5) (default 1)
-workerCount	int	Desired number of workers for testing lists (default 32)

The basic usage is to run padcheck hostname A list of hosts can also be read from a file padcheck -hosts hostnames.txt

Vulnerable hosts are indicated in the tool output with a line similar to:

Hostname (ip:443) is VULNERABLE with a Observable MAC Validity (Zombie POODLE) oracle when using cipher 0xc027 with TLS 0x0303. The fingerprint is 6867b5

The fingerprint produced by this tool is a hash of the server responses. These values are subject to change with changes to the tool or with environmental variation which may influence the error message text. The fingerprint value should therefore be primarily used for correlating similar vulnerabilities within a specific environment.

Obtaining padcheck

The easiest way to get started with padcheck is by downloading the latest Linux binary release

Users can alternatively build it locally for cross-platform or development testing.

Building on Linux

Install Go - Distro packages (e.g. sudo apt install golang-go) are fine.
Run ./build.sh

Upon success, ./padcheck will be available as a portable/standalone executable.

Building on Docker

Building with Docker is easier and cross-platform.

Run docker build . -t padcheck to build the patched Go toolchain and the padcheck tool in a container.

Run with: docker run --rm -it padcheck [args]

If you want to use a hosts file or keylog file, you will need to mount them in the container:

docker run --rm -it \
    -v /path/to/hosts:/tmp/hosts \
    -v /path/to/keylog:/tmp/keylog \
    padcheck -hosts /tmp/hosts -keylog /tmp/keylog

Credits

The original idea for this padding check tool was a very simple tool for checking for POODLE issues in TLS servers, by Adam Langley (agl AT imperialviolet DOT org). See:

Additional Resources

More information about scanning for TLS CBC padding oracles on the Internet can be found in this repo: https://github.com/RUB-NDS/TLS-Padding-Oracles

Tripwire/padcheck