crypto-analysis

Use when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review

Jump to install

Repository: hypnguyen1209/offensive-claude
Last source activity: June 29, 2026 at 07:22
Detected SKILL.md language: English
Stars: 343
Forks: 59

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill crypto-analysis

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

14 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

reverse-engineering

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

2026-07-30

privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

2026-06-30

threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

2026-06-30

View all from this repository

Cryptographic Analysis

When to Activate

Auditing TLS/SSL/SSH configurations and X.509 PKI (cipher suites, downgrade, protocol flaws)

Reviewing crypto implementations in source code or captured traffic

Attacking weak RSA/ECC keys (CTF and real-world weak-key hygiene)

Recovering ECDSA/DSA private keys from reused or biased nonces (lattice/HNP)

Exploiting symmetric/AEAD misuse: padding oracles, GCM nonce reuse, key-commitment

Forging JWT/JOSE tokens (algorithm confusion, none, jwk/jku/kid injection)

Cracking password hashes and grading KDF strength

Assessing post-quantum readiness ("harvest now, decrypt later" exposure)

Technique Map

Technique

ATT&CK

CWE

Reference

Script

TLS cipher/protocol downgrade audit

T1600.001

CWE-326

references/tls-pki-audit.md

scripts/tls_audit.py

Terrapin SSH prefix truncation (CVE-2023-48795)

T1557

CWE-222

references/tls-pki-audit.md

scripts/tls_audit.py

Marvin/Bleichenbacher RSA timing oracle

T1600

CWE-208

references/tls-pki-audit.md

scripts/tls_audit.py

X.509 / CT-log shadow-asset discovery

T1589

CWE-295

references/tls-pki-audit.md

scripts/tls_audit.py

RSA weak-key factoring (Fermat/Wiener/common-modulus)

T1600

CWE-326

references/rsa-attacks.md

scripts/rsa_attack.py

Coppersmith partial-key & ROCA (CVE-2017-15361)

T1600

CWE-310

references/rsa-attacks.md

scripts/rsa_attack.py

Hastad broadcast / batch-GCD

T1600

CWE-326

references/rsa-attacks.md

scripts/rsa_attack.py

ECDSA nonce reuse key recovery

T1552.004

CWE-323

references/ecc-nonce-attacks.md

scripts/ecdsa_lattice.py

Biased-nonce lattice/HNP (Minerva, PuTTY CVE-2024-31497)

T1552.004

CWE-1241

references/ecc-nonce-attacks.md

scripts/ecdsa_lattice.py

Cryptographic Analysis

When to Activate

Auditing TLS/SSL/SSH configurations and X.509 PKI (cipher suites, downgrade, protocol flaws)

Reviewing crypto implementations in source code or captured traffic

Attacking weak RSA/ECC keys (CTF and real-world weak-key hygiene)

Recovering ECDSA/DSA private keys from reused or biased nonces (lattice/HNP)

Exploiting symmetric/AEAD misuse: padding oracles, GCM nonce reuse, key-commitment

Forging JWT/JOSE tokens (algorithm confusion, none, jwk/jku/kid injection)

Cracking password hashes and grading KDF strength

Assessing post-quantum readiness ("harvest now, decrypt later" exposure)

Technique Map

Technique

ATT&CK

CWE

Reference

Script

TLS cipher/protocol downgrade audit

T1600.001

CWE-326

references/tls-pki-audit.md

scripts/tls_audit.py

Terrapin SSH prefix truncation (CVE-2023-48795)

T1557

CWE-222

references/tls-pki-audit.md

scripts/tls_audit.py

Marvin/Bleichenbacher RSA timing oracle

T1600

CWE-208

references/tls-pki-audit.md

scripts/tls_audit.py

X.509 / CT-log shadow-asset discovery

T1589

CWE-295

references/tls-pki-audit.md

scripts/tls_audit.py

RSA weak-key factoring (Fermat/Wiener/common-modulus)

T1600

CWE-326

references/rsa-attacks.md

scripts/rsa_attack.py

Coppersmith partial-key & ROCA (CVE-2017-15361)

T1600

CWE-310

references/rsa-attacks.md

scripts/rsa_attack.py

Hastad broadcast / batch-GCD

T1600

CWE-326

references/rsa-attacks.md

scripts/rsa_attack.py

ECDSA nonce reuse key recovery

T1552.004

CWE-323

references/ecc-nonce-attacks.md

scripts/ecdsa_lattice.py

Biased-nonce lattice/HNP (Minerva, PuTTY CVE-2024-31497)

T1552.004

CWE-1241

references/ecc-nonce-attacks.md

scripts/ecdsa_lattice.py

name	crypto-analysis
description	Use when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review
metadata	{"type":"offensive","phase":"analysis","tools":"testssl.sh, openssl, hashcat, john, RsaCtfTool, sagemath, jwt_tool, ecdsa-lattice","mitre":["T1600","T1600.001","T1557","T1110.002","T1552.004","T1606.001","T1040"]}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0006","TA0009"],"attck_techniques":["T1600","T1600.001","T1557","T1557.001","T1110.002","T1552.004","T1606.001","T1040"]}
depends_on	["recon-osint"]
feeds_into	["exploit-development","web-pentest","network-attack"]
inputs	["tls_config","crypto_implementation","hash_samples","public_keys","jwt_tokens","signature_corpus"]
outputs	["crypto_weakness_report","finding_record","recovered_keys","cracked_credentials"]
references	["references/tls-pki-audit.md","references/rsa-attacks.md","references/ecc-nonce-attacks.md","references/symmetric-aead.md","references/jwt-jose.md","references/hash-pq.md"]
scripts	["scripts/tls_audit.py","scripts/rsa_attack.py","scripts/ecdsa_lattice.py","scripts/padding_oracle.py","scripts/gcm_nonce_reuse.py","scripts/jwt_forge.py","scripts/hash_triage.py"]

name	crypto-analysis
description	Use when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review
metadata	{"type":"offensive","phase":"analysis","tools":"testssl.sh, openssl, hashcat, john, RsaCtfTool, sagemath, jwt_tool, ecdsa-lattice","mitre":["T1600","T1600.001","T1557","T1110.002","T1552.004","T1606.001","T1040"]}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0006","TA0009"],"attck_techniques":["T1600","T1600.001","T1557","T1557.001","T1110.002","T1552.004","T1606.001","T1040"]}
depends_on	["recon-osint"]
feeds_into	["exploit-development","web-pentest","network-attack"]
inputs	["tls_config","crypto_implementation","hash_samples","public_keys","jwt_tokens","signature_corpus"]
outputs	["crypto_weakness_report","finding_record","recovered_keys","cracked_credentials"]
references	["references/tls-pki-audit.md","references/rsa-attacks.md","references/ecc-nonce-attacks.md","references/symmetric-aead.md","references/jwt-jose.md","references/hash-pq.md"]
scripts	["scripts/tls_audit.py","scripts/rsa_attack.py","scripts/ecdsa_lattice.py","scripts/padding_oracle.py","scripts/gcm_nonce_reuse.py","scripts/jwt_forge.py","scripts/hash_triage.py"]

Technique	Telemetry / IOC	Detection (Sigma/EDR)	OPSEC note
TLS scanning / testssl	Burst of handshakes, many cipher renegotiations, malformed ClientHellos	NIDS: high TLS alert rate from one src; Zeek `ssl.log` anomalous cipher offers	Rate-limit, spread across source IPs; passive cert/CT recon leaves no target-side trace
Marvin/ROBOT oracle probing	~10^4–10^6 RSA decrypts, repeated malformed pre-master/CMS	WAF/IDS: spike of TLS decrypt errors, identical-size payloads	Extremely loud; only against authorized hosts; use minimal query budgets
Terrapin MitM	Injected SSH_MSG_IGNORE, sequence-number gap at NEWKEYS	SSH server logs `kex` mismatch; netflow showing on-path device	Requires active MitM; detectable by strict-kex peers; abort if `kex-strict` present
ECDSA nonce harvesting	Bulk signature collection (Git, TLS, SSH, blockchain)	Mostly offline — no target telemetry once sigs captured	Collection is passive; recovery is offline; rotate-key advice in report
CBC padding oracle	Thousands of decrypt requests, alternating valid/invalid padding	Web logs: ~256×blocks requests to one endpoint; Sigma on 4xx burst	Very noisy (256×blocks×msgs); throttle, randomize timing
GCM nonce reuse / partitioning	Repeated (nonce,key) pairs; multi-key ciphertext blobs	App crypto audit; flag reused IVs in logs	Forbidden-attack math is offline once two ciphertexts captured
JWT forgery	Anomalous `alg`, external `jku`/`x5u` fetch, all-zero ES signature	Sigma: JWT with `alg:none`/HS after RS expected; egress to attacker JWKS URL	Each forged token is a single request; minimal noise
Hash cracking	None on target (offline)	N/A unless online spray (then T1110)	Offline; protect loot at rest; never spray live without scope

crypto-analysis

Install options

Review the source files

Cryptographic Analysis

When to Activate

Technique Map

Cryptographic Analysis

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

crypto-analysis

Source facts

Install options

Review the source files

More from this repository

Cryptographic Analysis

When to Activate

Technique Map

Cryptographic Analysis

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

More from this repository