poodle-attack-sandbox

Overview

This code is the test code for POODLE (CVE-2014-3566).

POODLE stands for "Padding Oracle On Downgraded Legacy Encryption" and is a vulnerability in SSLv3.0.

Warning

If you use this code to carry out an attack, you may be arrested by the judicial authorities of your country.

Use for study purposes only.

Installation

docker/docker compose is required, so please install it.

1. Start the container

docker compose up --build

2. Start the man-in-the-middle server script

• For connectivity check of client<-->mitm<-->target

  docker exec -it mitm-server bash
  

  Inside the container

  cd && cd mitm && sudo bash proxy-test.sh
  

• To start the attack script

  In the same container

  cd && cd mitm && sudo bash attack.sh
  

Notice

The mitm container uses iptables to temporarily queue packets in order to analyze packets as a man-in-the-middle.

Therefore, if you do not run the above Shell Script, unless you run a dequeue process yourself in a separate process, the response will not return after the request is sent.

Please be careful.