Hunting CBC Vulnerabilities: A Cloud Pentester's Step-by-Step Guide

If you spend enough time poking at web applications, you’ll eventually run into a target that handles session management poorly. You’ll intercept a request, look at the cookie, and see a massive, encrypted string. For a lot of testers, encrypted state data is a dead end. If you can’t read it, you mo