Byte-at-a-time ECB decryption
An attack that recovers a hidden string from an ECB-encrypted service one byte at a time, by controlling what lands in each block.
Imagine a service that encrypts your input together with a secret string, using AES in ECB mode. The attacker sends short inputs that push the secret along so that one unknown byte sits at the end of a block. The ciphertext for that block is then compared against a table of all 256 possible values for that position, and the byte is identified. Repeat until the whole secret has been read out.
The trick depends on ECB being deterministic: identical plaintext blocks produce identical ciphertext blocks. It became a staple of the Cryptopals challenges, and it is still the best argument for never using ECB for anything except demonstrating why ECB is a bad idea. An authenticated mode such as AES-GCM gives the attacker nothing to match against, because every nonce produces a fresh ciphertext.