BEAST is a browser-based attack against CBC-mode encrypted connections. It combines traffic observation with the ability to make a victim’s browser issue requests, recovering secret request data such as HTTP session cookies when CBC initialization vectors are reused predictably. section 5.5 section 5.6
Figure 5.14 The attacker can see encrypted traffic and make the victim’s browser issue web requests that contain HTTP cookies.
Use the network scenario to see how an attacker observes encrypted traffic while inducing requests containing browser cookies. section 5.5
A practical setup uses a malicious public Wi-Fi hotspot or captive portal that serves JavaScript. The attacker controls request fields such as the path and hostname, knows the general HTTP layout, observes ciphertext, and does not know the cookie value. section 5.5 section 5.5.1
The exploit proceeds by aligning controlled plaintext with a secret byte:
- Simulate a browser session with a host-specific SESSIONID, AES-CBC encryption, and an HTTP request template. section 5.5.1
- Observe ciphertext blocks from an initial request and submit additional requests whose paths can be chosen by the attacker. section 5.5.1 section 5.5.2
- Use XOR to construct a trial block that recreates the encryption input for a target block; a correct guess produces a matching ciphertext block. section 5.5.2
- Slide the request so that controlled bytes expose one unknown cookie byte at a time, reducing each trial to 256 candidates. section 5.5.2
Recovering a simulated session ID
A Go test creates an encrypted session for bank.com, runs the recovery routine, and verifies the recovered value against the stored session ID; the demonstrated result is d28e730a.
The underlying failure is CBC IV reuse: older browsers sometimes used the previous HTTP request’s final ciphertext as the next request’s IV. CBC requires a unique IV for every message, so implementations must generate a new IV rather than chaining requests this way. section 5.6
