CBC Bit Flipping Explained: Why Encryption Alone Doesn't Guarantee Integrity

CBC Bit Flipping attacks demonstrate that encryption does not guarantee data integrity. Attackers can manipulate encrypted data, such as session cookies, without knowing the secret key if the application lacks integrity checks like a MAC. While developers often assume encrypted data is safe from tampering, cryptography treats secrecy and integrity as separate functions. This vulnerability allows testers to identify attack vectors in web applications that handle state data poorly using Cipher Block Chaining mode.