crypto-analysis

Use when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review

Ir a la instalación

Repositorio: hypnguyen1209/offensive-claude
Última actividad en el origen: 29 de junio de 2026 a las 07:22
Idioma detectado de SKILL.md: inglés
Estrellas: 343
Forks: 59

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill crypto-analysis

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

Explorador de archivos

14 archivos

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

reverse-engineering

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

2026-07-30

privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

2026-06-30

threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

2026-06-30

Ver todos los de este repositorio

Cryptographic Analysis

When to Activate

Auditing TLS/SSL/SSH configurations and X.509 PKI (cipher suites, downgrade, protocol flaws)

Reviewing crypto implementations in source code or captured traffic

Attacking weak RSA/ECC keys (CTF and real-world weak-key hygiene)

Recovering ECDSA/DSA private keys from reused or biased nonces (lattice/HNP)

Exploiting symmetric/AEAD misuse: padding oracles, GCM nonce reuse, key-commitment

Forging JWT/JOSE tokens (algorithm confusion, none, jwk/jku/kid injection)

Cracking password hashes and grading KDF strength

Assessing post-quantum readiness ("harvest now, decrypt later" exposure)

Technique Map

Technique

ATT&CK

CWE

Reference

Script

TLS cipher/protocol downgrade audit

T1600.001

CWE-326

references/tls-pki-audit.md

scripts/tls_audit.py

Terrapin SSH prefix truncation (CVE-2023-48795)

T1557

CWE-222

references/tls-pki-audit.md

scripts/tls_audit.py

Marvin/Bleichenbacher RSA timing oracle

T1600

CWE-208

references/tls-pki-audit.md

scripts/tls_audit.py

X.509 / CT-log shadow-asset discovery

T1589

CWE-295

references/tls-pki-audit.md

scripts/tls_audit.py

RSA weak-key factoring (Fermat/Wiener/common-modulus)

T1600

CWE-326

references/rsa-attacks.md

scripts/rsa_attack.py

Coppersmith partial-key & ROCA (CVE-2017-15361)

T1600

CWE-310

references/rsa-attacks.md

scripts/rsa_attack.py

Hastad broadcast / batch-GCD

T1600

CWE-326

references/rsa-attacks.md

scripts/rsa_attack.py

ECDSA nonce reuse key recovery

T1552.004

CWE-323

references/ecc-nonce-attacks.md

scripts/ecdsa_lattice.py

Biased-nonce lattice/HNP (Minerva, PuTTY CVE-2024-31497)

T1552.004

CWE-1241

references/ecc-nonce-attacks.md

scripts/ecdsa_lattice.py

Cryptographic Analysis

When to Activate

Auditing TLS/SSL/SSH configurations and X.509 PKI (cipher suites, downgrade, protocol flaws)

Reviewing crypto implementations in source code or captured traffic

Attacking weak RSA/ECC keys (CTF and real-world weak-key hygiene)

Recovering ECDSA/DSA private keys from reused or biased nonces (lattice/HNP)

Exploiting symmetric/AEAD misuse: padding oracles, GCM nonce reuse, key-commitment

Forging JWT/JOSE tokens (algorithm confusion, none, jwk/jku/kid injection)

Cracking password hashes and grading KDF strength

Assessing post-quantum readiness ("harvest now, decrypt later" exposure)

Technique Map

Technique

ATT&CK

CWE

Reference

Script

TLS cipher/protocol downgrade audit

T1600.001

CWE-326

references/tls-pki-audit.md

scripts/tls_audit.py

Terrapin SSH prefix truncation (CVE-2023-48795)

T1557

CWE-222

references/tls-pki-audit.md

scripts/tls_audit.py

Marvin/Bleichenbacher RSA timing oracle

T1600

CWE-208

references/tls-pki-audit.md

scripts/tls_audit.py

X.509 / CT-log shadow-asset discovery

T1589

CWE-295

references/tls-pki-audit.md

scripts/tls_audit.py

RSA weak-key factoring (Fermat/Wiener/common-modulus)

T1600

CWE-326

references/rsa-attacks.md

scripts/rsa_attack.py

Coppersmith partial-key & ROCA (CVE-2017-15361)

T1600

CWE-310

references/rsa-attacks.md

scripts/rsa_attack.py

Hastad broadcast / batch-GCD

T1600

CWE-326

references/rsa-attacks.md

scripts/rsa_attack.py

ECDSA nonce reuse key recovery

T1552.004

CWE-323

references/ecc-nonce-attacks.md

scripts/ecdsa_lattice.py

Biased-nonce lattice/HNP (Minerva, PuTTY CVE-2024-31497)

T1552.004

CWE-1241

references/ecc-nonce-attacks.md

scripts/ecdsa_lattice.py

name	crypto-analysis
description	Use when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review
metadata	{"type":"offensive","phase":"analysis","tools":"testssl.sh, openssl, hashcat, john, RsaCtfTool, sagemath, jwt_tool, ecdsa-lattice","mitre":["T1600","T1600.001","T1557","T1110.002","T1552.004","T1606.001","T1040"]}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0006","TA0009"],"attck_techniques":["T1600","T1600.001","T1557","T1557.001","T1110.002","T1552.004","T1606.001","T1040"]}
depends_on	["recon-osint"]
feeds_into	["exploit-development","web-pentest","network-attack"]
inputs	["tls_config","crypto_implementation","hash_samples","public_keys","jwt_tokens","signature_corpus"]
outputs	["crypto_weakness_report","finding_record","recovered_keys","cracked_credentials"]
references	["references/tls-pki-audit.md","references/rsa-attacks.md","references/ecc-nonce-attacks.md","references/symmetric-aead.md","references/jwt-jose.md","references/hash-pq.md"]
scripts	["scripts/tls_audit.py","scripts/rsa_attack.py","scripts/ecdsa_lattice.py","scripts/padding_oracle.py","scripts/gcm_nonce_reuse.py","scripts/jwt_forge.py","scripts/hash_triage.py"]

name	crypto-analysis
description	Use when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review
metadata	{"type":"offensive","phase":"analysis","tools":"testssl.sh, openssl, hashcat, john, RsaCtfTool, sagemath, jwt_tool, ecdsa-lattice","mitre":["T1600","T1600.001","T1557","T1110.002","T1552.004","T1606.001","T1040"]}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0006","TA0009"],"attck_techniques":["T1600","T1600.001","T1557","T1557.001","T1110.002","T1552.004","T1606.001","T1040"]}
depends_on	["recon-osint"]
feeds_into	["exploit-development","web-pentest","network-attack"]
inputs	["tls_config","crypto_implementation","hash_samples","public_keys","jwt_tokens","signature_corpus"]
outputs	["crypto_weakness_report","finding_record","recovered_keys","cracked_credentials"]
references	["references/tls-pki-audit.md","references/rsa-attacks.md","references/ecc-nonce-attacks.md","references/symmetric-aead.md","references/jwt-jose.md","references/hash-pq.md"]
scripts	["scripts/tls_audit.py","scripts/rsa_attack.py","scripts/ecdsa_lattice.py","scripts/padding_oracle.py","scripts/gcm_nonce_reuse.py","scripts/jwt_forge.py","scripts/hash_triage.py"]

Technique	Telemetry / IOC	Detection (Sigma/EDR)	OPSEC note
TLS scanning / testssl	Burst of handshakes, many cipher renegotiations, malformed ClientHellos	NIDS: high TLS alert rate from one src; Zeek `ssl.log` anomalous cipher offers	Rate-limit, spread across source IPs; passive cert/CT recon leaves no target-side trace
Marvin/ROBOT oracle probing	~10^4–10^6 RSA decrypts, repeated malformed pre-master/CMS	WAF/IDS: spike of TLS decrypt errors, identical-size payloads	Extremely loud; only against authorized hosts; use minimal query budgets
Terrapin MitM	Injected SSH_MSG_IGNORE, sequence-number gap at NEWKEYS	SSH server logs `kex` mismatch; netflow showing on-path device	Requires active MitM; detectable by strict-kex peers; abort if `kex-strict` present
ECDSA nonce harvesting	Bulk signature collection (Git, TLS, SSH, blockchain)	Mostly offline — no target telemetry once sigs captured	Collection is passive; recovery is offline; rotate-key advice in report
CBC padding oracle	Thousands of decrypt requests, alternating valid/invalid padding	Web logs: ~256×blocks requests to one endpoint; Sigma on 4xx burst	Very noisy (256×blocks×msgs); throttle, randomize timing
GCM nonce reuse / partitioning	Repeated (nonce,key) pairs; multi-key ciphertext blobs	App crypto audit; flag reused IVs in logs	Forbidden-attack math is offline once two ciphertexts captured
JWT forgery	Anomalous `alg`, external `jku`/`x5u` fetch, all-zero ES signature	Sigma: JWT with `alg:none`/HS after RS expected; egress to attacker JWKS URL	Each forged token is a single request; minimal noise
Hash cracking	None on target (offline)	N/A unless online spray (then T1110)	Offline; protect loot at rest; never spray live without scope

crypto-analysis

Opciones de instalación

Revisa los archivos de origen

Cryptographic Analysis

When to Activate

Technique Map

Cryptographic Analysis

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

crypto-analysis

Datos de origen

Opciones de instalación

Revisa los archivos de origen

Más de este repositorio

Más de este repositorio

Cryptographic Analysis

When to Activate

Technique Map

Cryptographic Analysis

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives