crypto-analysis

Use when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review

Aller à l'installation

Dépôt: hypnguyen1209/offensive-claude
Dernière activité de la source: 29 juin 2026 à 07:22
Langue détectée de SKILL.md: anglais
Étoiles: 343
Forks: 59

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill crypto-analysis

La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.

Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

Explorateur de fichiers

14 fichiers

SKILL.md

Instructions source · Aperçu en lecture seule

Retour à la recherche Retour à l’installation

Cryptographic Analysis

When to Activate

Auditing TLS/SSL/SSH configurations and X.509 PKI (cipher suites, downgrade, protocol flaws)

Reviewing crypto implementations in source code or captured traffic

Attacking weak RSA/ECC keys (CTF and real-world weak-key hygiene)

Recovering ECDSA/DSA private keys from reused or biased nonces (lattice/HNP)

Exploiting symmetric/AEAD misuse: padding oracles, GCM nonce reuse, key-commitment

Forging JWT/JOSE tokens (algorithm confusion, none, jwk/jku/kid injection)

Cracking password hashes and grading KDF strength

Assessing post-quantum readiness ("harvest now, decrypt later" exposure)

Technique Map

Technique

ATT&CK

CWE

Reference

Script

TLS cipher/protocol downgrade audit

T1600.001

CWE-326

references/tls-pki-audit.md

scripts/tls_audit.py

Terrapin SSH prefix truncation (CVE-2023-48795)

T1557

CWE-222

references/tls-pki-audit.md

scripts/tls_audit.py

Marvin/Bleichenbacher RSA timing oracle

T1600

CWE-208

references/tls-pki-audit.md

scripts/tls_audit.py

X.509 / CT-log shadow-asset discovery

T1589

CWE-295

references/tls-pki-audit.md

scripts/tls_audit.py

RSA weak-key factoring (Fermat/Wiener/common-modulus)

T1600

CWE-326

references/rsa-attacks.md

scripts/rsa_attack.py

Coppersmith partial-key & ROCA (CVE-2017-15361)

T1600

CWE-310

references/rsa-attacks.md

scripts/rsa_attack.py

Hastad broadcast / batch-GCD

T1600

CWE-326

references/rsa-attacks.md

scripts/rsa_attack.py

ECDSA nonce reuse key recovery

T1552.004

CWE-323

references/ecc-nonce-attacks.md

scripts/ecdsa_lattice.py

Biased-nonce lattice/HNP (Minerva, PuTTY CVE-2024-31497)

T1552.004

CWE-1241

references/ecc-nonce-attacks.md

scripts/ecdsa_lattice.py

Cryptographic Analysis

When to Activate

Auditing TLS/SSL/SSH configurations and X.509 PKI (cipher suites, downgrade, protocol flaws)

Reviewing crypto implementations in source code or captured traffic

Attacking weak RSA/ECC keys (CTF and real-world weak-key hygiene)

Recovering ECDSA/DSA private keys from reused or biased nonces (lattice/HNP)

Exploiting symmetric/AEAD misuse: padding oracles, GCM nonce reuse, key-commitment

Forging JWT/JOSE tokens (algorithm confusion, none, jwk/jku/kid injection)

Cracking password hashes and grading KDF strength

Assessing post-quantum readiness ("harvest now, decrypt later" exposure)

Technique Map

Technique

ATT&CK

CWE

Reference

Script

TLS cipher/protocol downgrade audit

T1600.001

CWE-326

references/tls-pki-audit.md

scripts/tls_audit.py

Terrapin SSH prefix truncation (CVE-2023-48795)

T1557

CWE-222

references/tls-pki-audit.md

scripts/tls_audit.py

Marvin/Bleichenbacher RSA timing oracle

T1600

CWE-208

references/tls-pki-audit.md

scripts/tls_audit.py

X.509 / CT-log shadow-asset discovery

T1589

CWE-295

references/tls-pki-audit.md

scripts/tls_audit.py

RSA weak-key factoring (Fermat/Wiener/common-modulus)

T1600

CWE-326

references/rsa-attacks.md

scripts/rsa_attack.py

Coppersmith partial-key & ROCA (CVE-2017-15361)

T1600

CWE-310

references/rsa-attacks.md

scripts/rsa_attack.py

Hastad broadcast / batch-GCD

T1600

CWE-326

references/rsa-attacks.md

scripts/rsa_attack.py

ECDSA nonce reuse key recovery

T1552.004

CWE-323

references/ecc-nonce-attacks.md

scripts/ecdsa_lattice.py

Biased-nonce lattice/HNP (Minerva, PuTTY CVE-2024-31497)

T1552.004

CWE-1241

references/ecc-nonce-attacks.md

scripts/ecdsa_lattice.py

name	crypto-analysis
description	Use when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review
metadata	{"type":"offensive","phase":"analysis","tools":"testssl.sh, openssl, hashcat, john, RsaCtfTool, sagemath, jwt_tool, ecdsa-lattice","mitre":["T1600","T1600.001","T1557","T1110.002","T1552.004","T1606.001","T1040"]}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0006","TA0009"],"attck_techniques":["T1600","T1600.001","T1557","T1557.001","T1110.002","T1552.004","T1606.001","T1040"]}
depends_on	["recon-osint"]
feeds_into	["exploit-development","web-pentest","network-attack"]
inputs	["tls_config","crypto_implementation","hash_samples","public_keys","jwt_tokens","signature_corpus"]
outputs	["crypto_weakness_report","finding_record","recovered_keys","cracked_credentials"]
references	["references/tls-pki-audit.md","references/rsa-attacks.md","references/ecc-nonce-attacks.md","references/symmetric-aead.md","references/jwt-jose.md","references/hash-pq.md"]
scripts	["scripts/tls_audit.py","scripts/rsa_attack.py","scripts/ecdsa_lattice.py","scripts/padding_oracle.py","scripts/gcm_nonce_reuse.py","scripts/jwt_forge.py","scripts/hash_triage.py"]

name	crypto-analysis
description	Use when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review
metadata	{"type":"offensive","phase":"analysis","tools":"testssl.sh, openssl, hashcat, john, RsaCtfTool, sagemath, jwt_tool, ecdsa-lattice","mitre":["T1600","T1600.001","T1557","T1110.002","T1552.004","T1606.001","T1040"]}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0006","TA0009"],"attck_techniques":["T1600","T1600.001","T1557","T1557.001","T1110.002","T1552.004","T1606.001","T1040"]}
depends_on	["recon-osint"]
feeds_into	["exploit-development","web-pentest","network-attack"]
inputs	["tls_config","crypto_implementation","hash_samples","public_keys","jwt_tokens","signature_corpus"]
outputs	["crypto_weakness_report","finding_record","recovered_keys","cracked_credentials"]
references	["references/tls-pki-audit.md","references/rsa-attacks.md","references/ecc-nonce-attacks.md","references/symmetric-aead.md","references/jwt-jose.md","references/hash-pq.md"]
scripts	["scripts/tls_audit.py","scripts/rsa_attack.py","scripts/ecdsa_lattice.py","scripts/padding_oracle.py","scripts/gcm_nonce_reuse.py","scripts/jwt_forge.py","scripts/hash_triage.py"]

Technique	Telemetry / IOC	Detection (Sigma/EDR)	OPSEC note
TLS scanning / testssl	Burst of handshakes, many cipher renegotiations, malformed ClientHellos	NIDS: high TLS alert rate from one src; Zeek `ssl.log` anomalous cipher offers	Rate-limit, spread across source IPs; passive cert/CT recon leaves no target-side trace
Marvin/ROBOT oracle probing	~10^4–10^6 RSA decrypts, repeated malformed pre-master/CMS	WAF/IDS: spike of TLS decrypt errors, identical-size payloads	Extremely loud; only against authorized hosts; use minimal query budgets
Terrapin MitM	Injected SSH_MSG_IGNORE, sequence-number gap at NEWKEYS	SSH server logs `kex` mismatch; netflow showing on-path device	Requires active MitM; detectable by strict-kex peers; abort if `kex-strict` present
ECDSA nonce harvesting	Bulk signature collection (Git, TLS, SSH, blockchain)	Mostly offline — no target telemetry once sigs captured	Collection is passive; recovery is offline; rotate-key advice in report
CBC padding oracle	Thousands of decrypt requests, alternating valid/invalid padding	Web logs: ~256×blocks requests to one endpoint; Sigma on 4xx burst	Very noisy (256×blocks×msgs); throttle, randomize timing
GCM nonce reuse / partitioning	Repeated (nonce,key) pairs; multi-key ciphertext blobs	App crypto audit; flag reused IVs in logs	Forbidden-attack math is offline once two ciphertexts captured
JWT forgery	Anomalous `alg`, external `jku`/`x5u` fetch, all-zero ES signature	Sigma: JWT with `alg:none`/HS after RS expected; egress to attacker JWKS URL	Each forged token is a single request; minimal noise
Hash cracking	None on target (offline)	N/A unless online spray (then T1110)	Offline; protect loot at rest; never spray live without scope

crypto-analysis

Options d'installation

Vérifiez les fichiers source

Cryptographic Analysis

When to Activate

Technique Map

Cryptographic Analysis

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

crypto-analysis

Informations de source

Options d'installation

Vérifiez les fichiers source

Plus depuis ce dépôt

Plus depuis ce dépôt

Cryptographic Analysis

When to Activate

Technique Map

Cryptographic Analysis

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives