Reduce padding oracle false positives in lightfuzz crypto module

[liquidsec]

Summary

• Add f5avr to parameter blacklist prefixes to filter F5 BIG-IP APM cookies early
• Reject narrow-charset strings (ASCII span ≤ 20) in format_agnostic_decode() that round-trip as valid base64 but aren't actual cryptographic data (e.g. A-P nibble encodings)
• Add confirmation round to padding oracle detection: re-run the test before emitting to filter jitter-based false positives

[github-actions]

📊 Performance Benchmark Report

Comparing 3.0 (baseline) vs padding-oracle-fp-reduce (current)

📈 Detailed Results (All Benchmarks)

📋 Complete results for all benchmarks - includes both significant and insignificant changes

🧪 Test Name	📏 Base	📏 Current	📈 Change	🎯 Status
Bloom Filter Dns Mutation Tracking Performance	3.83ms	3.81ms	-0.5% ⚪	✅
Bloom Filter Large Scale Dns Brute Force	17.73ms	17.70ms	-0.2% ⚪	✅
Large Closest Match Lookup	320.50ms	322.85ms	+0.7% ⚪	✅
Realistic Closest Match Workload	169.08ms	173.72ms	+2.7% ⚪	✅
Event Validation Full Scan Startup Small Batch	467.19ms	458.42ms	-1.9% ⚪	✅
Event Validation Full Scan Startup Large Batch	702.44ms	700.77ms	-0.2% ⚪	✅
Make Event Autodetection Small	26.41ms	26.08ms	-1.2% ⚪	✅
Make Event Autodetection Large	268.20ms	269.13ms	+0.3% ⚪	✅
Make Event Explicit Types	11.46ms	11.62ms	+1.4% ⚪	✅
Excavate Single Thread Small	3.570s	3.562s	-0.2% ⚪	✅
Excavate Single Thread Large	9.495s	9.534s	+0.4% ⚪	✅
Excavate Parallel Tasks Small	3.713s	3.742s	+0.8% ⚪	✅
Excavate Parallel Tasks Large	7.108s	7.108s	+0.0% ⚪	✅
Is Ip Performance	2.94ms	2.95ms	+0.5% ⚪	✅
Make Ip Type Performance	10.79ms	10.82ms	+0.3% ⚪	✅
Mixed Ip Operations	4.20ms	4.31ms	+2.7% ⚪	✅
Typical Queue Shuffle	54.50µs	54.74µs	+0.4% ⚪	✅
Priority Queue Shuffle	599.82µs	598.07µs	-0.3% ⚪	✅

🎯 Performance Summary

✅ No significant performance changes detected (all changes <10%)

---

🐍 Python Version 3.11.14

[codecov]

Codecov Report

❌ Patch coverage is 77.55102% with 22 lines in your changes missing coverage. Please review.
✅ Project coverage is 92%. Comparing base (389b8aa) to head (6935a64).
⚠️ Report is 14 commits behind head on 3.0.

Files with missing lines	Patch %	Lines
bbot/core/helpers/interactsh.py	42%	10 Missing ⚠️
.../test_step_2/module_tests/test_module_lightfuzz.py	87%	9 Missing ⚠️
bbot/modules/lightfuzz/submodules/crypto.py	82%	3 Missing ⚠️

Additional details and impacted files

@@          Coverage Diff          @@
##             3.0   #2951   +/-   ##
=====================================
- Coverage     92%     92%   -0%     
=====================================
  Files        436     436           
  Lines      35642   35736   +94     
=====================================
+ Hits       32504   32572   +68     
- Misses      3138    3164   +26     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.