Padding Oracle Hunter

Summary: PortSwigger's BApp Store lists Padding Oracle Hunter, a Burp Suite extension by GovTech-CSG at version 1.2, last updated 10 September 2024, that helps penetration testers identify and exploit the PKCS#7 and PKCS#1 v1.5 padding oracle vulnerability. The extension has two separate tabs, one for PKCS#7 and one for PKCS#1 v1.5, and carries an overall estimated system impact of Low.
Bottom line: A free, third-party extension that automates finding and exploiting padding oracles puts a known crypto flaw within reach of any tester running Burp - and PortSwigger states it makes no warranty about the quality or usefulness of extensions written by third-party users.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026