huffman coding check returning the same byte length

[nealharris]

huffman coding check returning the same byte length

[jasekiw]

@samrocketman That was the point of my comment. This is supposed to be a working demo with the website. I found out last night that getting a stream cipher to work is extremely difficult to get working because any newer operating system rejects it. I got around the block cipher but it's not that great of an implementation. If I come up with a decent solution I will try to make a pr.

[jasekiw]

I noticed when I test in the browser it gets around 2584 bytes vs in the console it gets around 2922 bytes. This is quite a large difference. I wonder if I'm on to something.

[jasekiw]

When decoding the response fro the request https://malbot.net/poc/?param1=value1request_token='b{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}{}@

The reflected value becomes <input type="hidden" target="https://malbot.net/poc/?param1=value1request_token='b%7B%7D%7B%7D%7B%7D%7B%7D%7B%7D%7B%7D%7B%7D%7B%7D%7B%7D%7B%7D%7B%7D%7B%7D%7B%7D%7B%7D%7B%7D%7B%7D%7B%7D%7B%7D%7B%7D%7B%7D%7B%7D@">
It seems the padding is getting encoded as html entities. Is this supposed to happen?

[jasekiw]

It seems after every request I always get the same byte response of 2906. I've adjusted the request url and the response bytes are the same. I'm thinking the calculation of the response bytes might be the issue.

[jasekiw]

I'm wondering if it is negotiating a block cipher instead of a stream cipher and this is the cause of the same response length..

[jasekiw]

So, malbot.net is using a block cipher. It negotiates TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA. Which breaks this repo.

[samrocketman]

It says in the README this doesn’t support block ciphers.