[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7DFGSJBKX3AFDYP6KC3E21B":3,"skill-same:01M7DFGSJBKX3AFDYP6KC3E21B":49},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":29,"commitSha":30,"skillDirectory":31,"forksCount":14,"repositoryHtmlUrl":32,"repositoryHomepageUrl":6,"ownerHtmlUrl":33,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":34,"install":35,"resources":48},"01M7DFGSJBKX3AFDYP6KC3E21B","crypto-decode",null,"Cipher detection + automated decryption via Ciphey, Cyberchef recipes, hashcat hash-ID, format conversion, common encoding chains.","Akapi895\u002Fraptix","Akapi895","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F83953516?v=4","01M7DEGNDGERR4F4YETDFVA512","Phạm Anh Tuấn","01M7DEGNEHYZNA920AYM5EH7H8",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fexploit\u002Fcrypto\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: crypto-decode\ndescription: Cipher detection + automated decryption via Ciphey, Cyberchef recipes, hashcat hash-ID, format conversion, common encoding chains.\nmetadata:\n  when_to_use: \"cipher decrypt decode base64 hex caesar rot vigenere xor unknown encoding identify ciphey hashid\"\n  mitre_attack: T1140\n  subdomain: cryptanalysis\n  upstream_url: https:\u002F\u002Fgithub.com\u002Fbee-san\u002FCiphey + https:\u002F\u002Fgithub.com\u002FCiphey\u002FAres (Rust successor)\n---\n\n# Crypto \u002F Decode Playbook\n\nWhen you have unknown ciphertext (CTF flag, leaked DB field, captured\ntoken, encoded payload), the right tool depends on the cipher class.\n\n## 1. Identify FIRST\n\n### Unknown text → automated cracker\n```bash\n# Ciphey — original (Python, slowed maintenance)\nciphey -t \"$CIPHERTEXT\"\n\n# Ares — Rust rewrite (faster, current)\nares -t \"$CIPHERTEXT\"\n```\nA*-search across 16+ decoders (base64, base85, hex, Caesar, ROT-N,\nAtbash, Vigenere, XOR-known-plaintext, URL encoding, binary, morse,\nbrainfuck, esolang, leetspeak, etc.) + BERT plaintext detector to know\nwhen to stop.\n\n### Hash → identify type\n```bash\nhashid -m '$2a$12$....'             # bcrypt 12 rounds\nhashid -m '5f4dcc3b5aa765d61d8327deb882cf99'  # MD5\nhash-identifier\n```\n\n### Specific format checks\n```bash\n# JWT\necho $TOKEN | cut -d. -f1-2 | tr '_-' '\u002F+' | base64 -d 2>\u002Fdev\u002Fnull\n\n# Hex → bytes\necho \"$HEX\" | xxd -r -p\n\n# Base64 → bytes (handle URL-safe)\necho \"$B64\" | tr '_-' '\u002F+' | base64 -d 2>\u002Fdev\u002Fnull\n\n# Multi-encoded (unwind layers)\necho \"$BLOB\" | base64 -d | base64 -d | xxd -r -p\n```\n\n## 2. Classical cipher quick-checks\n\n| Cipher | Signature |\n|---|---|\n| Base64 | `[A-Za-z0-9+\u002F=]+`, len multiple of 4 |\n| Base32 | `[A-Z2-7=]+` |\n| Hex | `[0-9a-fA-F]+`, even length |\n| Caesar\u002FROT | only A-Z + spaces, freq-attack ready |\n| Vigenere | A-Z, multiple-of-key-length repeating bigrams |\n| Substitution | A-Z, IC ≈ 0.066 (English) |\n| Vernam\u002FOTP | random-looking bytes, no statistical signal |\n| XOR fixed-key | bytes w\u002F printable XOR'd against pattern (file headers leak) |\n| Hill | small block size, matrix-based |\n\n## 3. CyberChef recipe library\n\nCyberChef (gchq.github.io\u002FCyberChef) is the GUI workhorse but recipes\ncan be exported as JSON and chained programmatically:\n```bash\n# Common chains\n\"From Base64 \u002F Magic \u002F To Hex\"\n\"From Hex \u002F XOR (Brute) \u002F Magic\"\n\"AES Decrypt(KEY) \u002F From Hex \u002F Strings\"\n```\n\nCLI version: `cyberchef-cli` (community port).\n\n## 4. Hash cracking quick-ref\n\n| Mode | Hash type |\n|---|---|\n| 0 | MD5 |\n| 100 | SHA-1 |\n| 1400 | SHA-256 |\n| 1700 | SHA-512 |\n| 1000 | NTLM |\n| 13100 | Kerberos TGS-REP (etype 23) |\n| 19700 | Kerberos TGS-REP (etype 18) |\n| 18200 | Kerberos AS-REP |\n| 16500 | JWT (HS256) |\n| 3200 | bcrypt |\n| 7400 | sha256crypt $5$ |\n| 1800 | sha512crypt $6$ |\n| 22000 | WPA-EAPOL+PMKID |\n| 7100 | macOS v10.8+ (PBKDF2-SHA512) |\n| 8200 | 1Password Cloud Keychain |\n\n```bash\nhashcat -m \u003Cmode> hashes.txt rockyou.txt -r best64.rule\njohn --format=\u003Cformat> hashes.txt --wordlist=rockyou.txt\n```\n\n## 5. Token \u002F blob unfolding workflow\n\nFor a mystery token captured in HTTP traffic:\n```\n1. ciphey\u002Fares → reveal base layer\n2. If structured (JSON \u002F proto3 \u002F msgpack) → parse\n3. If still encoded → repeat step 1\n4. Look for HMAC \u002F signature suffix → identify symmetric key candidates\n5. If symmetric encryption suspected → try AES-CBC\u002FGCM w\u002F common keys\n   (app-name, \"secret\", env vars exposed elsewhere)\n```\n\n## 6. Raptix integration\n\nWrap as MCP tool:\n```python\n# raptix\u002Ftools\u002Fcrypto\u002Fdecode.py — skeleton\ndef crypto_decode(ciphertext: str, hint: str = None, timeout: int = 30) -> dict:\n    \"\"\"Try ares first (fast), fallback to ciphey, return best decode.\"\"\"\n    import subprocess\n    cmd = [\"ares\", \"-t\", ciphertext]\n    if hint:\n        cmd += [\"--language\", hint]\n    r = subprocess.run(cmd, timeout=timeout, capture_output=True, text=True)\n    return {\n        \"tool\": \"ares\",\n        \"output\": r.stdout,\n        \"confidence\": _parse_ares_confidence(r.stdout),\n    }\n```\n\nNote in your findings record when classification succeeds (your role\nhas no direct KG write tool — the auto-ingest pipeline and the\norchestrator own graph writes):\n```\ndecoded:\u003Chash> → plaintext \u003Cresult> via \u003Cchain>\n```\n\n## 7. Severity (depends on what was decoded)\n\n| Decoded content | Severity |\n|---|---|\n| Plaintext password | Critical (depends on user role) |\n| API key \u002F private key | Critical |\n| Internal hostname \u002F IP | Medium |\n| Session token | High-Critical |\n| Encryption key | Critical |\n\n## Cross-references\n- Upstream: https:\u002F\u002Fgithub.com\u002Fbee-san\u002FCiphey, https:\u002F\u002Fgithub.com\u002Fbee-san\u002FAres\n- JWT-specific (different layer): `skills\u002Fexploit\u002Fweb\u002Fjwt\u002FSKILL.md`\n- AD hashes: `skills\u002Fad\u002Fdcsync\u002FSKILL.md`\n\n## Known exemplars\n- CTF flag formats (90% are base64, hex, or rot-N layers)\n- Mobile reverse engineering: API keys often base64-XORed in strings\n- IoT firmware: AES-CBC w\u002F hardcoded keys recoverable via Ciphey + ghidra\n- Phishing email obfuscation: nested encoding chains common\n","# Crypto \u002F Decode Playbook\n\nWhen you have unknown ciphertext (CTF flag, leaked DB field, captured\ntoken, encoded payload), the right tool depends on the cipher class.\n\n## 1. Identify FIRST\n\n### Unknown text → automated cracker\n```bash\n# Ciphey — original (Python, slowed maintenance)\nciphey -t \"$CIPHERTEXT\"\n\n# Ares — Rust rewrite (faster, current)\nares -t \"$CIPHERTEXT\"\n```\nA*-search across 16+ decoders (base64, base85, hex, Caesar, ROT-N,\nAtbash, Vigenere, XOR-known-plaintext, URL encoding, binary, morse,\nbrainfuck, esolang, leetspeak, etc.) + BERT plaintext detector to know\nwhen to stop.\n\n### Hash → identify type\n```bash\nhashid -m '$2a$12$....'             # bcrypt 12 rounds\nhashid -m '5f4dcc3b5aa765d61d8327deb882cf99'  # MD5\nhash-identifier\n```\n\n### Specific format checks\n```bash\n# JWT\necho $TOKEN | cut -d. -f1-2 | tr '_-' '\u002F+' | base64 -d 2>\u002Fdev\u002Fnull\n\n# Hex → bytes\necho \"$HEX\" | xxd -r -p\n\n# Base64 → bytes (handle URL-safe)\necho \"$B64\" | tr '_-' '\u002F+' | base64 -d 2>\u002Fdev\u002Fnull\n\n# Multi-encoded (unwind layers)\necho \"$BLOB\" | base64 -d | base64 -d | xxd -r -p\n```\n\n## 2. Classical cipher quick-checks\n\n| Cipher | Signature |\n|---|---|\n| Base64 | `[A-Za-z0-9+\u002F=]+`, len multiple of 4 |\n| Base32 | `[A-Z2-7=]+` |\n| Hex | `[0-9a-fA-F]+`, even length |\n| Caesar\u002FROT | only A-Z + spaces, freq-attack ready |\n| Vigenere | A-Z, multiple-of-key-length repeating bigrams |\n| Substitution | A-Z, IC ≈ 0.066 (English) |\n| Vernam\u002FOTP | random-looking bytes, no statistical signal |\n| XOR fixed-key | bytes w\u002F printable XOR'd against pattern (file headers leak) |\n| Hill | small block size, matrix-based |\n\n## 3. CyberChef recipe library\n\nCyberChef (gchq.github.io\u002FCyberChef) is the GUI workhorse but recipes\ncan be exported as JSON and chained programmatically:\n```bash\n# Common chains\n\"From Base64 \u002F Magic \u002F To Hex\"\n\"From Hex \u002F XOR (Brute) \u002F Magic\"\n\"AES Decrypt(KEY) \u002F From Hex \u002F Strings\"\n```\n\nCLI version: `cyberchef-cli` (community port).\n\n## 4. Hash cracking quick-ref\n\n| Mode | Hash type |\n|---|---|\n| 0 | MD5 |\n| 100 | SHA-1 |\n| 1400 | SHA-256 |\n| 1700 | SHA-512 |\n| 1000 | NTLM |\n| 13100 | Kerberos TGS-REP (etype 23) |\n| 19700 | Kerberos TGS-REP (etype 18) |\n| 18200 | Kerberos AS-REP |\n| 16500 | JWT (HS256) |\n| 3200 | bcrypt |\n| 7400 | sha256crypt $5$ |\n| 1800 | sha512crypt $6$ |\n| 22000 | WPA-EAPOL+PMKID |\n| 7100 | macOS v10.8+ (PBKDF2-SHA512) |\n| 8200 | 1Password Cloud Keychain |\n\n```bash\nhashcat -m \u003Cmode> hashes.txt rockyou.txt -r best64.rule\njohn --format=\u003Cformat> hashes.txt --wordlist=rockyou.txt\n```\n\n## 5. Token \u002F blob unfolding workflow\n\nFor a mystery token captured in HTTP traffic:\n```\n1. ciphey\u002Fares → reveal base layer\n2. If structured (JSON \u002F proto3 \u002F msgpack) → parse\n3. If still encoded → repeat step 1\n4. Look for HMAC \u002F signature suffix → identify symmetric key candidates\n5. If symmetric encryption suspected → try AES-CBC\u002FGCM w\u002F common keys\n   (app-name, \"secret\", env vars exposed elsewhere)\n```\n\n## 6. Raptix integration\n\nWrap as MCP tool:\n```python\n# raptix\u002Ftools\u002Fcrypto\u002Fdecode.py — skeleton\ndef crypto_decode(ciphertext: str, hint: str = None, timeout: int = 30) -> dict:\n    \"\"\"Try ares first (fast), fallback to ciphey, return best decode.\"\"\"\n    import subprocess\n    cmd = [\"ares\", \"-t\", ciphertext]\n    if hint:\n        cmd += [\"--language\", hint]\n    r = subprocess.run(cmd, timeout=timeout, capture_output=True, text=True)\n    return {\n        \"tool\": \"ares\",\n        \"output\": r.stdout,\n        \"confidence\": _parse_ares_confidence(r.stdout),\n    }\n```\n\nNote in your findings record when classification succeeds (your role\nhas no direct KG write tool — the auto-ingest pipeline and the\norchestrator own graph writes):\n```\ndecoded:\u003Chash> → plaintext \u003Cresult> via \u003Cchain>\n```\n\n## 7. Severity (depends on what was decoded)\n\n| Decoded content | Severity |\n|---|---|\n| Plaintext password | Critical (depends on user role) |\n| API key \u002F private key | Critical |\n| Internal hostname \u002F IP | Medium |\n| Session token | High-Critical |\n| Encryption key | Critical |\n\n## Cross-references\n- Upstream: https:\u002F\u002Fgithub.com\u002Fbee-san\u002FCiphey, https:\u002F\u002Fgithub.com\u002Fbee-san\u002FAres\n- JWT-specific (different layer): `skills\u002Fexploit\u002Fweb\u002Fjwt\u002FSKILL.md`\n- AD hashes: `skills\u002Fad\u002Fdcsync\u002FSKILL.md`\n\n## Known exemplars\n- CTF flag formats (90% are base64, hex, or rot-N layers)\n- Mobile reverse engineering: API keys often base64-XORed in strings\n- IoT firmware: AES-CBC w\u002F hardcoded keys recoverable via Ciphey + ghidra\n- Phishing email obfuscation: nested encoding chains common\n",{"name":5,"metadata":24,"description":7},{"subdomain":25,"when_to_use":26,"mitre_attack":27,"upstream_url":28},"cryptanalysis","cipher decrypt decode base64 hex caesar rot vigenere xor unknown encoding identify ciphey hashid","T1140","https:\u002F\u002Fgithub.com\u002Fbee-san\u002FCiphey + https:\u002F\u002Fgithub.com\u002FCiphey\u002FAres (Rust successor)","master","8e5d356b795eae2edd4a26509a4b8968e2c4c251","packages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fexploit\u002Fcrypto","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix","https:\u002F\u002Fgithub.com\u002FAkapi895","2026-11-06 17:46:09",{"source":8,"skillName":5,"commands":36,"prompt":46,"zipAvailable":47},[37,40,43],{"tool":38,"command":39},"npx","npx skills add Akapi895\u002Fraptix --skill crypto-decode",{"tool":41,"command":42},"bunx","bunx skills add Akapi895\u002Fraptix --skill crypto-decode",{"tool":44,"command":45},"pnpm","pnpm dlx skills add Akapi895\u002Fraptix --skill crypto-decode","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fexploit\u002Fcrypto\u002FSKILL.md",true,[],[50,57,64,71,78,85],{"skillNo":51,"name":52,"nameZh":6,"description":53,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":54,"categories":55,"keywords":56,"publishedAt":19},"01M7DGM32SRP4FZSPYWY621BKQ","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":58,"name":59,"nameZh":6,"description":60,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":61,"categories":62,"keywords":63,"publishedAt":19},"01M7DGKXXVDTY0KBZZR83VFPZX","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":65,"name":66,"nameZh":6,"description":67,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":68,"categories":69,"keywords":70,"publishedAt":19},"01M7DGKSV77ENX3D6TG2HQX9MK","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":75,"categories":76,"keywords":77,"publishedAt":19},"01M7DGKJ9R6YTFRFBSEAJRGGKF","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":79,"name":80,"nameZh":6,"description":81,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":84,"publishedAt":19},"01M7DGKCFZGKK2EQMWZM1A18S8","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":91,"publishedAt":19},"01M7DGK76MKZQWBXTZN82W7214","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002FAkapi895\u002Fraptix\u002Fblob\u002Fmaster\u002Fpackages\u002Fraptix-skills\u002Fraptix_skills\u002Fdefs\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]