crypto-decode

# Crypto / Decode Playbook When you have unknown ciphertext (CTF flag, leaked DB field, captured token, encoded payload), the right tool depends on the cipher class. ## 1. Identify FIRST ### Unknown text → automated cracker ```bash # Ciphey — original (Python, slowed maintenance) ciphey -t "$CIPHERTEXT" # Ares — Rust rewrite (faster, current) ares -t "$CIPHERTEXT" ``` A*-search across 16+ decoders (base64, base85, hex, Caesar, ROT-N, Atbash, Vigenere, XOR-known-plaintext, URL encoding, binary, morse, brainfuck, esolang, leetspeak, etc.) + BERT plaintext detector to know when to stop. ### Hash → identify type ```bash hashid -m '$2a$12$....' # bcrypt 12 rounds hashid -m '5f4dcc3b5aa765d61d8327deb882cf99' # MD5 hash-identifier ``` ### Specific format checks ```bash # JWT echo $TOKEN | cut -d. -f1-2 | tr '_-' '/+' | base64 -d 2>/dev/null # Hex → bytes echo "$HEX" | xxd -r -p # Base64 → bytes (handle URL-safe) echo "$B64" | tr '_-' '/+' | base64 -d 2>/dev/null # Multi-encoded (unwind layers) echo "$BLOB" | base64 -d | base64 -d | xxd -r -p ``` ## 2. Classical cipher quick-checks | Cipher | Signature | |---|---| | Base64 | `[A-Za-z0-9+/=]+`, len multiple of 4 | | Base32 | `[A-Z2-7=]+` | | Hex | `[0-9a-fA-F]+`, even length | | Caesar/ROT | only A-Z + spaces, freq-attack ready | | Vigenere | A-Z, multiple-of-key-length repeating bigrams | | Substitution | A-Z, IC ≈ 0.066 (English) | | Vernam/OTP | random-looking bytes, no statistical signal | | XOR fixed-key | bytes w/ printable XOR'd against pattern (file headers leak) | | Hill | small block size, matrix-based | ## 3. CyberChef recipe library CyberChef (gchq.github.io/CyberChef) is the GUI workhorse but recipes can be exported as JSON and chained programmatically: ```bash # Common chains "From Base64 / Magic / To Hex" "From Hex / XOR (Brute) / Magic" "AES Decrypt(KEY) / From Hex / Strings" ``` CLI version: `cyberchef-cli` (community port). ## 4. Hash cracking quick-ref | Mode | Hash type | |---|---| | 0 | MD5 | | 100 | SHA-1 | | 1400 | SHA-256 | | 1700 | SHA-512 | | 1000 | NTLM | | 13100 | Kerberos TGS-REP (etype 23) | | 19700 | Kerberos TGS-REP (etype 18) | | 18200 | Kerberos AS-REP | | 16500 | JWT (HS256) | | 3200 | bcrypt | | 7400 | sha256crypt $5$ | | 1800 | sha512crypt $6$ | | 22000 | WPA-EAPOL+PMKID | | 7100 | macOS v10.8+ (PBKDF2-SHA512) | | 8200 | 1Password Cloud Keychain | ```bash hashcat -m <mode> hashes.txt rockyou.txt -r best64.rule john --format=<format> hashes.txt --wordlist=rockyou.txt ``` ## 5. Token / blob unfolding workflow For a mystery token captured in HTTP traffic: ``` 1. ciphey/ares → reveal base layer 2. If structured (JSON / proto3 / msgpack) → parse 3. If still encoded → repeat step 1 4. Look for HMAC / signature suffix → identify symmetric key candidates 5. If symmetric encryption suspected → try AES-CBC/GCM w/ common keys (app-name, "secret", env vars exposed elsewhere) ``` ## 6. Decepticon integration Wrap as MCP tool: ```python # decepticon/tools/crypto/decode.py — skeleton def crypto_decode(ciphertext: str, hint: str = None, timeout: int = 30) -> dict: """Try ares first (fast), fallback to ciphey, return best decode.""" import subprocess cmd = ["ares", "-t", ciphertext] if hint: cmd += ["--language", hint] r = subprocess.run(cmd, timeout=timeout, capture_output=True, text=True) return { "tool": "ares", "output": r.stdout, "confidence": _parse_ares_confidence(r.stdout), } ``` Promote to KG when classification succeeds: ```python kg_add_node(kind="artifact", label=f"decoded:{hash}", props={"plaintext": result, "encoding_chain": chain}) ``` ## 7. Severity (depends on what was decoded) | Decoded content | Severity | |---|---| | Plaintext password | Critical (depends on user role) | | API key / private key | Critical | | Internal hostname / IP | Medium | | Session token | High-Critical | | Encryption key | Critical | ## Cross-references - Upstream: https://github.com/bee-san/Ciphey, https://github.com/bee-san/Ares - JWT-specific (different layer): `skills/exploit/web/jwt/SKILL.md` - AD hashes: `skills/ad/dcsync/SKILL.md` ## Known exemplars - CTF flag formats (90% are base64, hex, or rot-N layers) - Mobile reverse engineering: API keys often base64-XORed in strings - IoT firmware: AES-CBC w/ hardcoded keys recoverable via Ciphey + ghidra - Phishing email obfuscation: nested encoding chains common