This presentation will discuss how to identify and exploit cryptographic padding oracle vulnerabilities in custom web applications. Through a series of live demonstrations, the presentation will cover common scenarios related to padding oracle detection and show how to use the free open source PadBuster tool to both identify and exploit each scenario.