crypto-analysis

Use when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review

Zur Installation springen

Repository: hypnguyen1209/offensive-claude
Letzte Quellaktivität: 29. Juni 2026 um 07:22
Erkannte Sprache von SKILL.md: Englisch
Sterne: 343
Forks: 59

Installationsoptionen

Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.

Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.

Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill crypto-analysis

Der Befehl bleibt in einer Zeile. Scrollen Sie horizontal, um ihn vor dem Kopieren vollständig zu prüfen.

Sie bevorzugen eine lokale Kopie? Laden Sie die Dateien herunter, die SkillsMP derzeit vorliegen.

Quelldateien prüfen

Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.

Datei-Explorer

14 Dateien

SKILL.md

Quellanweisungen · Schreibgeschützte Vorschau

Zurück zur Suche Zurück zur Installation

Cryptographic Analysis

When to Activate

Auditing TLS/SSL/SSH configurations and X.509 PKI (cipher suites, downgrade, protocol flaws)

Reviewing crypto implementations in source code or captured traffic

Attacking weak RSA/ECC keys (CTF and real-world weak-key hygiene)

Recovering ECDSA/DSA private keys from reused or biased nonces (lattice/HNP)

Exploiting symmetric/AEAD misuse: padding oracles, GCM nonce reuse, key-commitment

Forging JWT/JOSE tokens (algorithm confusion, none, jwk/jku/kid injection)

Cracking password hashes and grading KDF strength

Assessing post-quantum readiness ("harvest now, decrypt later" exposure)

Technique Map

Technique

ATT&CK

CWE

Reference

Script

TLS cipher/protocol downgrade audit

T1600.001

CWE-326

references/tls-pki-audit.md

scripts/tls_audit.py

Terrapin SSH prefix truncation (CVE-2023-48795)

T1557

CWE-222

references/tls-pki-audit.md

scripts/tls_audit.py

Marvin/Bleichenbacher RSA timing oracle

T1600

CWE-208

references/tls-pki-audit.md

scripts/tls_audit.py

X.509 / CT-log shadow-asset discovery

T1589

CWE-295

references/tls-pki-audit.md

scripts/tls_audit.py

RSA weak-key factoring (Fermat/Wiener/common-modulus)

T1600

CWE-326

references/rsa-attacks.md

scripts/rsa_attack.py

Coppersmith partial-key & ROCA (CVE-2017-15361)

T1600

CWE-310

references/rsa-attacks.md

scripts/rsa_attack.py

Hastad broadcast / batch-GCD

T1600

CWE-326

references/rsa-attacks.md

scripts/rsa_attack.py

ECDSA nonce reuse key recovery

T1552.004

CWE-323

references/ecc-nonce-attacks.md

scripts/ecdsa_lattice.py

Biased-nonce lattice/HNP (Minerva, PuTTY CVE-2024-31497)

T1552.004

CWE-1241

references/ecc-nonce-attacks.md

scripts/ecdsa_lattice.py

Cryptographic Analysis

When to Activate

Auditing TLS/SSL/SSH configurations and X.509 PKI (cipher suites, downgrade, protocol flaws)

Reviewing crypto implementations in source code or captured traffic

Attacking weak RSA/ECC keys (CTF and real-world weak-key hygiene)

Recovering ECDSA/DSA private keys from reused or biased nonces (lattice/HNP)

Exploiting symmetric/AEAD misuse: padding oracles, GCM nonce reuse, key-commitment

Forging JWT/JOSE tokens (algorithm confusion, none, jwk/jku/kid injection)

Cracking password hashes and grading KDF strength

Assessing post-quantum readiness ("harvest now, decrypt later" exposure)

Technique Map

Technique

ATT&CK

CWE

Reference

Script

TLS cipher/protocol downgrade audit

T1600.001

CWE-326

references/tls-pki-audit.md

scripts/tls_audit.py

Terrapin SSH prefix truncation (CVE-2023-48795)

T1557

CWE-222

references/tls-pki-audit.md

scripts/tls_audit.py

Marvin/Bleichenbacher RSA timing oracle

T1600

CWE-208

references/tls-pki-audit.md

scripts/tls_audit.py

X.509 / CT-log shadow-asset discovery

T1589

CWE-295

references/tls-pki-audit.md

scripts/tls_audit.py

RSA weak-key factoring (Fermat/Wiener/common-modulus)

T1600

CWE-326

references/rsa-attacks.md

scripts/rsa_attack.py

Coppersmith partial-key & ROCA (CVE-2017-15361)

T1600

CWE-310

references/rsa-attacks.md

scripts/rsa_attack.py

Hastad broadcast / batch-GCD

T1600

CWE-326

references/rsa-attacks.md

scripts/rsa_attack.py

ECDSA nonce reuse key recovery

T1552.004

CWE-323

references/ecc-nonce-attacks.md

scripts/ecdsa_lattice.py

Biased-nonce lattice/HNP (Minerva, PuTTY CVE-2024-31497)

T1552.004

CWE-1241

references/ecc-nonce-attacks.md

scripts/ecdsa_lattice.py

name	crypto-analysis
description	Use when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review
metadata	{"type":"offensive","phase":"analysis","tools":"testssl.sh, openssl, hashcat, john, RsaCtfTool, sagemath, jwt_tool, ecdsa-lattice","mitre":["T1600","T1600.001","T1557","T1110.002","T1552.004","T1606.001","T1040"]}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0006","TA0009"],"attck_techniques":["T1600","T1600.001","T1557","T1557.001","T1110.002","T1552.004","T1606.001","T1040"]}
depends_on	["recon-osint"]
feeds_into	["exploit-development","web-pentest","network-attack"]
inputs	["tls_config","crypto_implementation","hash_samples","public_keys","jwt_tokens","signature_corpus"]
outputs	["crypto_weakness_report","finding_record","recovered_keys","cracked_credentials"]
references	["references/tls-pki-audit.md","references/rsa-attacks.md","references/ecc-nonce-attacks.md","references/symmetric-aead.md","references/jwt-jose.md","references/hash-pq.md"]
scripts	["scripts/tls_audit.py","scripts/rsa_attack.py","scripts/ecdsa_lattice.py","scripts/padding_oracle.py","scripts/gcm_nonce_reuse.py","scripts/jwt_forge.py","scripts/hash_triage.py"]

name	crypto-analysis
description	Use when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review
metadata	{"type":"offensive","phase":"analysis","tools":"testssl.sh, openssl, hashcat, john, RsaCtfTool, sagemath, jwt_tool, ecdsa-lattice","mitre":["T1600","T1600.001","T1557","T1110.002","T1552.004","T1606.001","T1040"]}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0006","TA0009"],"attck_techniques":["T1600","T1600.001","T1557","T1557.001","T1110.002","T1552.004","T1606.001","T1040"]}
depends_on	["recon-osint"]
feeds_into	["exploit-development","web-pentest","network-attack"]
inputs	["tls_config","crypto_implementation","hash_samples","public_keys","jwt_tokens","signature_corpus"]
outputs	["crypto_weakness_report","finding_record","recovered_keys","cracked_credentials"]
references	["references/tls-pki-audit.md","references/rsa-attacks.md","references/ecc-nonce-attacks.md","references/symmetric-aead.md","references/jwt-jose.md","references/hash-pq.md"]
scripts	["scripts/tls_audit.py","scripts/rsa_attack.py","scripts/ecdsa_lattice.py","scripts/padding_oracle.py","scripts/gcm_nonce_reuse.py","scripts/jwt_forge.py","scripts/hash_triage.py"]

Technique	Telemetry / IOC	Detection (Sigma/EDR)	OPSEC note
TLS scanning / testssl	Burst of handshakes, many cipher renegotiations, malformed ClientHellos	NIDS: high TLS alert rate from one src; Zeek `ssl.log` anomalous cipher offers	Rate-limit, spread across source IPs; passive cert/CT recon leaves no target-side trace
Marvin/ROBOT oracle probing	~10^4–10^6 RSA decrypts, repeated malformed pre-master/CMS	WAF/IDS: spike of TLS decrypt errors, identical-size payloads	Extremely loud; only against authorized hosts; use minimal query budgets
Terrapin MitM	Injected SSH_MSG_IGNORE, sequence-number gap at NEWKEYS	SSH server logs `kex` mismatch; netflow showing on-path device	Requires active MitM; detectable by strict-kex peers; abort if `kex-strict` present
ECDSA nonce harvesting	Bulk signature collection (Git, TLS, SSH, blockchain)	Mostly offline — no target telemetry once sigs captured	Collection is passive; recovery is offline; rotate-key advice in report
CBC padding oracle	Thousands of decrypt requests, alternating valid/invalid padding	Web logs: ~256×blocks requests to one endpoint; Sigma on 4xx burst	Very noisy (256×blocks×msgs); throttle, randomize timing
GCM nonce reuse / partitioning	Repeated (nonce,key) pairs; multi-key ciphertext blobs	App crypto audit; flag reused IVs in logs	Forbidden-attack math is offline once two ciphertexts captured
JWT forgery	Anomalous `alg`, external `jku`/`x5u` fetch, all-zero ES signature	Sigma: JWT with `alg:none`/HS after RS expected; egress to attacker JWKS URL	Each forged token is a single request; minimal noise
Hash cracking	None on target (offline)	N/A unless online spray (then T1110)	Offline; protect loot at rest; never spray live without scope

crypto-analysis

Installationsoptionen

Quelldateien prüfen

Cryptographic Analysis

When to Activate

Technique Map

Cryptographic Analysis

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

crypto-analysis

Quellinformationen

Installationsoptionen

Quelldateien prüfen

Mehr aus diesem Repository

Mehr aus diesem Repository

Cryptographic Analysis

When to Activate

Technique Map

Cryptographic Analysis

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives