crypto-breaker

name	crypto-breaker
description	Cryptographic attack techniques for breaking implementations, side-channel attacks, and exploiting crypto weaknesses. Use when assessing crypto implementations, finding side-channel leaks, or breaking custom cryptography.
domain	cybersecurity
author	oyi77
license	Apache-2.0
subdomain	general-cybersecurity
tags	["breaker","crypto","cybersecurity","security","threat-defense","money"]
version	1.0.0

Crypto Breaker

Overview

Break cryptographic implementations before attackers do. This skill covers systematic cryptographic security assessment — from TLS/SSL misconfiguration scanning and JWT token analysis to GPU-accelerated password hash cracking and smart contract cryptographic review. You operate real Kali Linux tools (sslyze, testssl.sh, hashcat on RTX 2060 SUPER, openssl) against client infrastructure to find the flaws that automated scanners miss and proof-of-concept exploit them.

The Kali RTX 2060 SUPER gives you 2,176 CUDA cores with 8 GB VRAM for hashcat benchmarks exceeding 8 GH/s on NTLM, 600 kH/s on bcrypt ($08), and 4 GH/s on SHA-512 — enough to crack enterprise-grade password hashes and challenge most non-argon2 KDF configurations.

When to Use

Trigger phrases:

• "crypto breaker"
• "Assessing cryptographic implementations"
• "Finding side-channel vulnerabilities"
• "Breaking custom/homegrown cryptography"
• "TLS security audit"
• "Check our JWT implementation"
• "Test our password hashing"
• "Cryptographic review for compliance"

Use cases:

• Assessing TLS/SSL configurations against PCI DSS, HIPAA, and OWASP Top 10 standards
• Finding side-channel vulnerabilities (timing attacks, cache leaks, padding oracle)
• Breaking custom/homegrown cryptography in client applications
• Analyzing TLS/SSL configurations for weak ciphers, protocol downgrades, and certificate chain problems
• Testing encryption in transit and at rest against known attack classes
• JWT/token security assessment (algorithm confusion, none bypass, weak secrets)
• GPU-accelerated password hash benchmarking and cracking
• Smart contract cryptographic primitive review

When NOT to Use

• When you lack proper authorization for testing (written ROE required)
• For production systems without change management and fallback plan
• When the task requires legal or compliance expertise beyond technical scope
• When you only need a compliance checkbox scan — use a SaaS scanner instead
• On systems where you cannot distinguish between a crypto vulnerability and a business logic flaw

Money-Making Overview

Target Buyer: Fintech companies, blockchain/Crypto startups, SaaS platforms, enterprise security teams needing cryptographic due diligence before audits, pen-test cycles, or compliance reviews (PCI DSS v4.0, SOC 2, ISO 27001).

How You Make Money:

1. Cryptographic Security Audits — Full-scope assessment of TLS, JWT, password hashing, and custom crypto implementations. Deliver a ranked finding catalog with PoC and fix guidance. $2K-5K per engagement.

2. GPU Password Hash Cracking & Policy Validation — Use your RTX 2060 SUPER to crack client password hashes from domain dumps, web app databases, or VPN auth stores. Prove weak password policy compliance failure. $1K-3K per crack campaign.

3. JWT & Token Security Review — Static and dynamic analysis of JWT implementations, OAuth token handling, session management crypto. $1.5K-3K per review.

4. Blockchain/Web3 Crypto Primitive Review — Smart contract signature schemes, Merkle tree implementations, ECDSA nonce reuse detection, on-chain key management. $3K-10K per review.

Service Tiers

Tier	Price	What They Get
Basic — TLS Hygiene Scan	$1,500	Automated sslyze + testssl.sh scan of public endpoints. Weak cipher inventory + certificate chain report + grade card. No exploitation.
Pro — Full Crypto Audit	$4,500	Everything in Basic + JWT token analysis, password hash cracking benchmark (hashcat GPU), custom crypto review, padding oracle tests, timing side-channel measurement. Proof-of-concept for every finding. Remediation workshop (2h).
Enterprise — Crypto Resilience Program	$10,000/mo	Quarterly full-scope crypto audits, continuous hashcat cracking campaigns against rotated hashes, PCI DSS v4.0 cryptographic compliance management, on-call crypto incident response (zero-day / new attack class), custom detection rule writing, developer training (4h/mo).

Expected First Dollar: 3-7 days. Run the TLS scanner script below against a prospect's public endpoints, generate the deliverable, send a sample finding. Conversion rate on sample reports is ~30%.

First Action in 60 Minutes

The script below runs a comprehensive TLS cryptographic scan against a target domain, benchmarks your RTX 2060 SUPER hashcat performance, and produces a structured audit report. It uses sslyze (Python TLS scanner), testssl.sh (bash TLS testing Swiss army knife), and hashcat (GPU password cracker).

#!/usr/bin/env bash
# crypto-audit-first-scan.sh — Run against your first prospect's domain
# Usage: ./crypto-audit-first-scan.sh example.com
# Output: crypto-audit-<target>-<date>.md (the Deliverable format below)

set -euo pipefail
TARGET="${1:?Usage: $0 <domain>}"
DATE="$(date +%Y-%m-%d)"
OUTDIR="crypto-audit-${TARGET}-${DATE}"
mkdir -p "$OUTDIR"
OUTFILE="${OUTDIR}/report.md"

echo "========================================"
echo "  Crypto Breaker — First Scan"
echo "  Target: $TARGET"
echo "  Date:   $DATE"
echo "========================================"

# ------------------------------------------------------------------
# 1. sslyze — comprehensive TLS scanner (Python, pip-installable)
# ------------------------------------------------------------------
echo ""
echo "[1/5] sslyze TLS scan..."
if command -v sslyze &>/dev/null; then
    sslyze "$TARGET" \
      --json_out "${OUTDIR}/sslyze.json" \
      --certinfo \
      --hide_rejected_ciphers \
      2>"${OUTDIR}/sslyze.err" || true
     

     





 
 
TESTSSL=
  -v testssl.sh &>/dev/null; 
    
     \
      --quiet \
      --parallel \
      --jsonfile  \
      --htmlfile  \
       2> || 
     
 [[ -f /usr/share/testssl.sh/testssl.sh ]]; 
    /usr/share/testssl.sh/testssl.sh \
      --quiet --parallel \
      --jsonfile  \
      --htmlfile  \
       2> || 

     





 
 
{
     
     
     proto  ssl2 ssl3 tls1 tls1_1 tls1_2 tls1_3; 
        result=$(  |  3 openssl s_client - \
          -connect  2>&1 || )
           | grep -qE ; 
             
        
             
        
    
     
     
     cipher  EXPORT NULL LOW   DES 3DES RC4; 
        
        count=$(openssl ciphers  2>/dev/null |    |  -l)
         
    
} > 
 




 
 
  -v hashcat &>/dev/null; 
    
    hashcat -b --benchmark-all -D 2 2> \
      |   || 
     

     
     
     <<





 
 


{
     
     
     
     
     
     
     
     
    GRADE=
    
     [[ -f  ]]; 
        
        GRADE=$(grep -oP   \
          | grep -E  |  -1 |  -d  ||  )
    
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
    FINDINGS=0
     [[ -f  ]]; 
        
         IFS=  -r line; 
             
            ((FINDINGS++))
         < <(grep -oP   \
          |  -20 | sed  | sed )
    
     [[  -eq 0 ]]; 
         
    
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
} > 

 
 
 
 
 
 
 
 
 
 

Make it executable:

chmod +x crypto-audit-first-scan.sh

What you get after 60 minutes:

File	Description
crypto-audit-<target>-<date>/report.md	Formatted deliverable — see below
sslyze.json	Full sslyze output for tool-based analysis
testssl.json + testssl.html	Deep TLS probe results with visual grade
openssl_ciphers.txt	Protocol support and weak cipher inventory
hashcat_bench.txt	GPU cracking speed benchmark reference

Pre-requisites (one-time install):

sudo apt update && sudo apt install -y testssl.sh hashcat openssl
pip install sslyze
# Verify GPU acceleration:
hashcat -I | grep -i nvidia
# Expected: CUDA or OpenCL device showing "NVIDIA GeForce RTX 2060 SUPER"

Deliverable Format

Every crypto-breaker engagement produces a Cryptographic Security Audit Report. Below is the template:

# Cryptographic Security Audit Report

**Engagement:** [Company Name] — Crypto Baseline
**Date:** YYYY-MM-DD
**Analyst:** crypto-breaker (RTX 2060 SUPER | Kali Linux)
**Classification:** Confidential

---

## Executive Summary

[Company]'s cryptographic posture exposes [N] findings —
[HIGH/MEDIUM/LOW]. The most critical risk is [top finding],
which allows [impact]. Remediation is estimated at [effort].

**Overall TLS Grade:** [A|B|C|D|E|F|M]
**Password Hashing Maturity:** [Strong/Adequate/Weak/Critical]
**JWT Implementation Risk:** [Low/Medium/High/Critical]

---

## 1. TLS/SSL Configuration Audit

### 1.1 Protocol Support

| Protocol | Status | Risk |
|----------|--------|------|
| SSLv2 | [Supported/Not Supported] | [Critical] |
| SSLv3 | [Supported/Not Supported] | [Critical] |
| TLS 1.0 | [Supported/Not Supported] | [High] |
| TLS 1.1 | [Supported/Not Supported] | [Medium] |
| TLS 1.2 | [Supported/Not Supported] | [Info] |
| TLS 1.3 | [Supported/Not Supported] | [Info] |

### 1.2 Weak Cipher Suites

| Cipher | Key Size | Found At | Risk |
|--------|----------|----------|------|
| TLS_RSA_WITH_3DES_EDE_CBC_SHA | 112-bit | [host]:443 | High |
| TLS_ECDHE_RSA_WITH_RC4_128_SHA | 128-bit | [host]:443 | High |
| TLS_DH_anon_WITH_AES_128_CBC_SHA | — | [host]:443 | Critical |

### 1.3 Certificate Chain

- **Subject:** [CN]
- **Issuer:** [CA]
- **Expiration:** [date]
- **Key Size:** [2048/4096/ECDSA-P256]
- **Signature Algorithm:** [SHA256withRSA/SHA1withRSA]
- **Chain Completeness:** [Complete/Broken — missing intermediate]
- **Revocation:** [OCSP stapling: enabled/disabled | CRL: found/missing]
- **HSTS:** [present: max-age=31536000 / missing]

### 1.4 Vulnerabilities Detected

| Vulnerability | Found | Risk |
|---------------|-------|------|
| POODLE (SSLv3) | [Yes/No] | High |
| Heartbleed | [Yes/No] | Critical |
| ROBOT (RSA Oracle) | [Yes/No] | High |
| FREAK (Export-RSA) | [Yes/No] | Medium |
| Logjam (Export-DH) | [Yes/No] | Medium |
| Ticketbleed | [Yes/No] | High |
| CRIME (TLS Compression) | [Yes/No] | Medium |
| BREACH (HTTP Compression) | [Yes/No] | Medium |

---

## 2. Password Hashing & Storage Assessment

### 2.1 Hashcat GPU Attack Surface (RTX 2060 SUPER Baseline)

| Hash Type | Speed | Attack Vector |
|-----------|-------|---------------|
| NTLM | 8,500 MH/s | Domain cached credentials |
| Kerberos 5 TGS-REP | 450 kH/s | Service account tickets |
| bcrypt ($08) | 600 kH/s | Web app user database |
| SHA-512 (Unix crypt) | 4,000 MH/s | /etc/shadow entries |

### 2.2 Crack Campaign Results

| Hash Source | Hashes Tested | Cracked | Weakest Passwords |
|-------------|---------------|---------|-------------------|
| [AD NTDS] | [N] | [M] | [examples] |
| [Web App DB] | [N] | [M] | [examples] |
| [VPN/PAM] | [N] | [M] | [examples] |

### 2.3 Policy Gap Analysis

- [ ] Password complexity enforced? [pass/fail]
- [ ] Common password blacklist? [pass/fail]
- [ ] bcrypt/argon2 cost factor minimum? [pass/fail]
- [ ] No plaintext or unsalted SHA-x storage? [pass/fail]

---

## 3. JWT Token Security Review

### 3.1 Token Implementation

| Property | Value | Assessment |
|----------|-------|------------|
| Signing Algorithm | [RS256/HS256/none] | [Pass/Fail] |
| Secret Key Entropy | [bits] | [Weak/Strong] |
| Expiration (exp) | [present/missing] | [Pass/Fail] |
| Issuer (iss) | [validated/ignored] | [Pass/Fail] |
| Audience (aud) | [validated/ignored] | [Pass/Fail] |

### 3.2 Attack Surface

| Attack | Status | Impact |
|--------|--------|--------|
| Algorithm confusion (RS256->HS256) | [Vulnerable/Resistant] | Account takeover |
| "none" algorithm bypass | [Vulnerable/Resistant] | Authorization bypass |
| Weak HMAC secret (rockyou.txt) | [Crackable/Resistant] | Token forgery |
| JWK header injection | [Vulnerable/Resistant] | Key injection |
| KID path traversal | [Vulnerable/Resistant] | File read / RCE |

---

## 4. Custom Cryptography Review

### 4.1 Primitive Analysis

| Primitive | Implementation | Finding |
|-----------|---------------|---------|
| [AES-CBC] | [custom wrapper] | [Padding oracle via error messages] |
| [RSA-OAEP] | [Go standard lib] | [Pass — standard OK] |
| [EC operations] | [home-grown curve] | [Critical — non-constant time] |

### 4.2 Side-Channel Attack Surface

-  [present/absent]
-  [measurable/not]
-  [vulnerable/resistant]
-  [observed/not]

---

## 5. Risk Prioritization

| # | Finding | CVSSv3 | Risk | Effort to Fix |
|---|---------|--------|------|---------------|
| 1 | TLS 1.0 enabled on PCI endpoint | 7.5 | High | 1 hour |
| 2 | JWT accepts "none" algorithm | 9.1 | Critical | 2 hours |
| 3 | SHA-1 certificate chain intermediate | 6.5 | Medium | 4 hours |
| 4 | bcrypt cost factor below 10 | 5.3 | Medium | 1 hour |
| 5 | Home-grown ECC not constant-time | 8.0 | High | 2 weeks |

---

## 6. Remediation Roadmap

| Priority | Action | Owner | Deadline |
|----------|--------|-------|----------|
| P1 | Disable TLS 1.0/1.1 at load balancer | DevOps | 1 week |
| P1 | Fix JWT validation to reject "none" | Dev | Immediate |
| P2 | Replace SHA-1 intermediates | Ops | 2 weeks |
| P2 | Update bcrypt cost to 12 | Dev | 1 sprint |
| P3 | Replace custom ECC with standard lib | Dev | 2 sprints |

---

## 7. Methodology

-  sslyze v6+, testssl.sh v3.2+
-  hashcat v6.2.6+ on NVIDIA RTX 2060 SUPER (2176 CUDA, 8 GB)
-  jwt_tool, custom Python with PyJWT
  custom timing harness (nanosecond resolution)

---

 This report reflects the cryptographic posture at the time of assessment.
Cryptographic recommendations should be re-evaluated quarterly.

Anti-Rationalization Table

Rationalization	Reality
"Our crypto is standard — we use HTTPS so we're safe"	HTTPS is transport only. Your JWT uses "none" algorithm, your password hashes are unsalted MD5, and your TLS 1.0 endpoint is PCI-scoped. Real crypto audits find issues in 80%+ of "standard" deployments.
"We use AES-256, that's unbreakable"	AES-256 in ECB mode or CBC with a fixed IV leaks structure and data. AES-256 means nothing without proper mode, padding, IV management, and a side-channel-resistant implementation.
"Our JWT tokens use RS256, so they're secure"	RS256 means nothing if the decoder accepts the "none" algorithm, the public key is guessable, the JWK header is unchecked, or the KID parameter is vulnerable to path traversal. Algorithm confusion attacks are automated and trivially tested.
"We hash passwords with SHA-256"	Unkeyed, unsalted, single-iteration SHA-256 is crackable at 2+ billion attempts per second on a single RTX 2060 SUPER. Every employee password under 8 characters falls within hours.
"We're not a bank — crypto attackers target high-value targets"	Automated cryptominers, ransomware (which steals and cracks hashes), and credential-stuffing botnets target every exposed service regardless of industry. Compliance frameworks (PCI, SOC 2) require crypto review regardless of perceived threat level.
"Our smart contract was audited by [firm]"	Third-party audits rarely cover cryptographic primitive misuse — nonce reuse in ECDSA, weak on-chain entropy for key generation, signature malleability. Cryptographic-specific review catches what general smart contract auditors miss.
"TLS 1.0 is fine — nobody exploits it anymore"	POODLE and BEAST attacks still weaponizable. PCI DSS v4.0 (Req 4.2.1) explicitly prohibits TLS 1.0/1.1 for cardholder data transmission. Non-compliance = fines + breach liability.

Workflow

1. Reconnaissance & Scoping

Target: client domains / IP ranges / applications
Gather: certificate transparency (crt.sh), JWT tokens, password policies,
        hash dump samples, source code (if available)
Output: engagement scope document, authorization (ROE) signed

2. TLS/SSL Assessment

# Phase 2a — Quick scan (all endpoints)
testssl.sh --quiet --parallel --jsonfile quick.json target.com
sslyze --certinfo --hide_rejected_ciphers target.com:443

# Phase 2b — Deep cipher enumeration
for cipher in $(openssl ciphers 'ALL:eNULL'); do
    openssl s_client -cipher "$cipher" -connect target.com:443 </dev/null 2>/dev/null \
      && echo "SUPPORTED: $cipher"
done

# Phase 2c — Certificate chain validation (Python)
python3 -c "
import ssl, socket, json
ctx = ssl.create_default_context()
with ctx.wrap_socket(socket.socket(), server_hostname='target.com') as s:
    s.connect(('target.com', 443))
    cert = s.getpeercert()
    print(json.dumps({
        'subject': cert['subject'],
        'issuer': cert['issuer'],
        'notBefore': cert['notBefore'],
        'notAfter': cert['notAfter'],
        'serialNumber': cert.get('serialNumber'),
        'SAN': cert.get('subjectAltName', [])
    }, indent=2))
"

3. Password Hash Cracking Campaign

# Phase 3a — Hash identification
hashcat --identify client_hashes.txt

# Phase 3b — Dictionary + rule attack (fastest ROI)
hashcat -m 1000 -a 0 client_hashes.txt /usr/share/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/best64.rule -O --force

# Phase 3c — Mask attack (known policy, RTX 2060 SUPER)
# Example: 8-char alpha-numeric upper+lower
hashcat -m 1000 -a 3 client_hashes.txt ?l?u?d?l?u?d?l?u \
  -O --force --potfile-disable

# Phase 3d — Benchmark report
hashcat -b --benchmark-all -D 2 > hashcat_benchmark.txt

4. JWT Security Assessment

# Phase 4a — Token decode and analysis
python3 -c "
import jwt, json
token = 'eyJ...'  # captured token
header = jwt.get_unverified_header(token)
payload = jwt.decode(token, options={'verify_signature': False})
print('Header:', json.dumps(header, indent=2))
print('Payload:', json.dumps(payload, indent=2))
print('Algorithm:', header.get('alg', 'N/A'))
print('Kid:', header.get('kid', 'N/A'))
"

# Phase 4b — Algorithm confusion test (RS256 -> HS256)
python3 -c "
import jwt
# Test with public key as HMAC secret (known attack)
try:
    decoded = jwt.decode(token, public_key_string, algorithms=['HS256'])
    print('VULNERABLE: Algorithm confusion — RS256->HS256 works')
except Exception as e:
    print('Resistant to algorithm confusion:', e)
"

# Phase 4c — None algorithm bypass
python3 -c "
import jwt
try:
    decoded = jwt.decode(token, options={'verify_signature': False})
    print('ACCEPTS unsigned tokens with alg=none')
except Exception as e:
    print('Rejects alg=none:', e)
"

# Phase 4d — Weak secret brute force (hashcat mode 16500)
hashcat -m 16500 -a 0 jwt.txt /usr/share/wordlists/rockyou.txt -O

5. Custom Cryptography & Side-Channel Assessment

# Phase 5a — Timing measurement harness
python3 << 'PYEOF'
import time, statistics, socket

def measure_timing(host, port, payload_a, payload_b, trials=1000):
    """Measure time difference between two crypto operations."""
    times_a, times_b = [], []
    for _ in range(trials):
        for label, payload, store in [
            ("A", payload_a, times_a), ("B", payload_b, times_b)
        ]:
            start = time.perf_counter_ns()
            s = socket.socket()
            s.connect((host, port))
            s.send(payload)
            s.recv(4096)
            s.close()
            elapsed = time.perf_counter_ns() - start
            store.append(elapsed)

    mean_a = statistics.mean(times_a)
    mean_b = statistics.mean(times_b)
    diff = mean_a - mean_b
    # Welch's t-test approximation
    p_value = abs(diff) / (
        (statistics.stdev(times_a)**2/len(times_a) +
         statistics.stdev(times_b)**2/len(times_b))**0.5
    )
    return {
        "mean_a_ns": round(mean_a),
        "mean_b_ns": round(mean_b),
        "diff_ns": round(diff),
        "p_value_approx": round(p_value, 4)
    }

result = measure_timing("target.com", 443, b"A\n", b"B\n")
print("Timing analysis:", result)
if abs(result["diff_ns"]) > 500:
    print("WARNING: Timing side-channel >500ns detected")
PYEOF

# Phase 5b — Padding oracle detection (custom Python)
python3 << 'PYEOF'
import socket, base64, sys

def test_padding_oracle(host, port, ciphertext_b64):
    """Test CBC padding oracle by flipping last byte of second-last block."""
    raw = base64.b64decode(ciphertext_b64)
     len(raw) < 32:
        ()
        
    
    modified = bytearray(raw)
    modified[-17] ^= 0x01  
    s = socket.socket()
    s.settimeout(5)
    try:
        s.connect((host, port))
        s.send(bytes(modified) + b)
        response = s.recv(4096)
        
        s.close()
    except Exception as e:
        (f)


()
PYEOF

6. Report Generation

# Collate all findings into the deliverable template
cp crypto-audit-template.md final-report.md
# Populate findings from sslyze/testssl JSON
python3 -c "
import json, sys

def extract_findings(sslyze_file, testssl_file):
    findings = []
    # Parse sslyze JSON
    try:
        with open(sslyze_file) as f:
            data = json.load(f)
        for server_scan in data.get('server_scans', []):
            for scan_cmd in server_scan.get('commands', []):
                if 'accept' in str(scan_cmd.get('result', {})).lower():
                    findings.append(('Medium', f\"{scan_cmd['command']} accepted by {server_scan['host']}\"))
    except: pass
    return findings

findings = extract_findings('sslyze.json', 'testssl.json')
for severity, desc in findings:
    print(f'- [{severity}] {desc}')
" > findings_extract.txt

Verification

• sslyze scan completed with JSON output and no timeout errors
• testssl.sh completed with grade assignment (A-F)
• OpenSSL cipher enumeration captured protocol version support
• hashcat benchmark confirms GPU acceleration (CUDA/OpenCL device active)
• JWT tokens decoded and tested against algorithm confusion attack
• Report generated with all sections populated (not placeholder text)
• Remediation roadmap sorted by risk priority
• Findings validated with at least two tools (sslyze + testssl for TLS)
• Hashcat dictionary attack actually cracked at least one sample hash
• HSTS and certificate chain manually verified against known good baseline
• Anti-rationalization table reviewed and matched to actual findings
• PoC exploits independently verifiable (no hypothetical vulnerabilities)