Menu
Specialist agent for detecting ALL key derivation functions in downloaded JS files. Part of crypto-recon pipeline.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Download all JS/WASM/CSS assets from a target URL using cloudscraper. Saves to output/[domain]/. Called by crypto-recon-orchestrator.
Specialist for EVM blockchain cryptography — EIP-712, personal_sign, ABI encoding, keccak256, ethers.js/wagmi/viem/web3.js. EVM chains only (Ethereum, Polygon, BSC, Arbitrum, etc.). For non-EVM use crypto-recon-web3-solana, crypto-recon-web3-cosmos, or crypto-recon-web3-starknet.
Verifies reconstructed APK signing logic against live app traffic. Uses HAR test vectors or ADB+mitmproxy. Extends crypto-recon-debugging for Android context.
Specialist for finding ALL cryptography in decompiled Android APK — Java source (jadx) and Smali bytecode (apktool). Covers OkHttp interceptors, Retrofit, HMAC, AES, MD5, custom signing, ProGuard-obfuscated code.
Master orchestrator for Android APK reverse engineering. Fully autonomous — decompiles APK, spawns 11 parallel specialists, collects findings, writes report, reconstructs Python code. No intermediate stops. Accepts .apk/.apkm/.xapk + optional HAR.
Builds a complete, clean, standalone Python script for a full API flow (login, register, place bet, etc). Accepts input from reconstruct_*.py files AND from APK flow mappers (Retrofit catalog, auth chain trace, API endpoint list). Called automatically after analysis — no user prompting needed. Uses superpowers executing-plans and verification-before-completion.
| name | crypto-recon-kdf |
| description | Specialist agent for detecting ALL key derivation functions in downloaded JS files. Part of crypto-recon pipeline. |
kdf-patterns.md — Complete KDF catalog: PBKDF2, HKDF, bcrypt, scrypt, Argon2 — JS and Android patterns, parameter extraction, Python reconstruction, AES-from-password patternFind every Key Derivation Function (KDF) and password hashing scheme used in the target's JavaScript. Document parameters (iterations, salt, output length) and key usage.
PBKDF2(, pbkdf2(
CryptoJS.PBKDF2(
subtle.deriveBits({name: 'PBKDF2'
subtle.deriveKey({name: 'PBKDF2'
crypto.pbkdf2(
crypto.pbkdf2Sync(
pbkdf2Sync(
iterations: ← parameter nearby
bcrypt.hash(, bcrypt.compare(, bcrypt.hashSync(
bcryptjs, bcrypt-js
$2b$, $2a$ ← bcrypt hash prefix in strings
genSaltSync(, genSalt(
scrypt(, Scrypt(
subtle.deriveBits({name: 'scrypt' ← not in Web Crypto standard but some libs
crypto.scrypt(, crypto.scryptSync(
N:, r:, p: ← scrypt parameters nearby
argon2.hash(, argon2.verify(
argon2-browser
argon2id, argon2i, argon2d
$argon2id$ ← Argon2 hash prefix
memoryCost:, timeCost:, parallelism:
HKDF(, hkdf(
subtle.deriveKey({name: 'HKDF'
subtle.deriveBits({name: 'HKDF'
hkdf-expand, hkdf-extract
ConcatKDF, concatKDF
x963kdf
// SHA-based "KDF" — not a proper KDF but common
sha256(password + salt)
sha512(username + password)
md5(password) ← raw password MD5, no KDF
evpBytesToKey( ← OpenSSL-style KDF, used by CryptoJS
CryptoJS.algo.EvpKDF(
nist-sp-800-108
kbkdf
Identify KDF algorithm and security level
Extract all parameters
Determine what key is derived for
Find the password/secret input
Check for hardcoded salts — a static salt defeats the purpose of a KDF
| Condition | Flag |
|---|---|
| PBKDF2 with < 10000 iterations | WEAK: increase iterations |
| Static/hardcoded salt | FLAW: defeats purpose |
| MD5 or SHA1 as hash in PBKDF2 | SUBOPTIMAL |
| Raw hash without KDF (sha256(password)) | CRITICAL WEAKNESS |
| bcrypt cost < 10 | LOW COST: easy to brute force |
| No salt at all | CRITICAL: rainbow table vulnerable |
KDF FINDINGS
============
[K1] PBKDF2-SHA256 — HIGH
File: common.modules-6d4292d1.js
Line: 2001
Function: deriveSessionKey(password, salt)
Algorithm: PBKDF2
Hash: SHA-256
Iterations: 100000
Salt: Random 16 bytes from crypto.getRandomValues
KeyLen: 32 bytes (for AES-256)
Usage: Derived key used in AES-256-CBC encryption
Callers: initSession:3001
Notes: Parameters are acceptable. Salt is properly random.
[K2] Simple SHA256 KDF — MEDIUM
File: page-login-abc123.js
Line: 302
Function: hashUserKey(userId, secret)
Algorithm: SHA256(userId + ":" + hardcoded_secret)
Salt: HARDCODED: ":x9k2mNpQ" ← static salt
KeyLen: 32 bytes (hex output)
Usage: Used as HMAC key for request signing
Callers: buildSignature:441
Notes: Not a proper KDF. Static salt is a weakness.
Salt value: ":x9k2mNpQ"