crypto-decode

name	crypto-decode
description	Cipher detection + automated decryption via Ciphey, Cyberchef recipes, hashcat hash-ID, format conversion, common encoding chains.
metadata	{"when_to_use":"cipher decrypt decode base64 hex caesar rot vigenere xor unknown encoding identify ciphey hashid","mitre_attack":"T1140","subdomain":"cryptanalysis","upstream_url":"https://github.com/bee-san/Ciphey + https://github.com/Ciphey/Ares (Rust successor)"}

Crypto / Decode Playbook

When you have unknown ciphertext (CTF flag, leaked DB field, captured token, encoded payload), the right tool depends on the cipher class.

1. Identify FIRST

Unknown text → automated cracker

# Ciphey — original (Python, slowed maintenance)
ciphey -t "$CIPHERTEXT"

# Ares — Rust rewrite (faster, current)
ares -t "$CIPHERTEXT"

A*-search across 16+ decoders (base64, base85, hex, Caesar, ROT-N, Atbash, Vigenere, XOR-known-plaintext, URL encoding, binary, morse, brainfuck, esolang, leetspeak, etc.) + BERT plaintext detector to know when to stop.

Hash → identify type

hashid -m '$2a$12$....'             # bcrypt 12 rounds
hashid -m '5f4dcc3b5aa765d61d8327deb882cf99'  # MD5
hash-identifier

Specific format checks

# JWT
echo $TOKEN | cut -d. -f1-2 | tr '_-' '/+' | base64 -d 2>/dev/null

# Hex → bytes
echo "$HEX" | xxd -r -p

# Base64 → bytes (handle URL-safe)
echo "$B64" | tr '_-' '/+' | base64 -d 2>/dev/null

# Multi-encoded (unwind layers)
echo "$BLOB" | base64 -d | base64 -d | xxd -r -p

2. Classical cipher quick-checks

Cipher	Signature
Base64	[A-Za-z0-9+/=]+, len multiple of 4
Base32	[A-Z2-7=]+
Hex	[0-9a-fA-F]+, even length
Caesar/ROT	only A-Z + spaces, freq-attack ready
Vigenere	A-Z, multiple-of-key-length repeating bigrams
Substitution	A-Z, IC ≈ 0.066 (English)
Vernam/OTP	random-looking bytes, no statistical signal
XOR fixed-key	bytes w/ printable XOR'd against pattern (file headers leak)
Hill	small block size, matrix-based

3. CyberChef recipe library

CyberChef (gchq.github.io/CyberChef) is the GUI workhorse but recipes can be exported as JSON and chained programmatically:

# Common chains
"From Base64 / Magic / To Hex"
"From Hex / XOR (Brute) / Magic"
"AES Decrypt(KEY) / From Hex / Strings"

CLI version: cyberchef-cli (community port).

4. Hash cracking quick-ref

Mode	Hash type
0	MD5
100	SHA-1
1400	SHA-256
1700	SHA-512
1000	NTLM
13100	Kerberos TGS-REP (etype 23)
19700	Kerberos TGS-REP (etype 18)
18200	Kerberos AS-REP
16500	JWT (HS256)
3200	bcrypt
7400	sha256crypt $5$
1800	sha512crypt $6$
22000	WPA-EAPOL+PMKID
7100	macOS v10.8+ (PBKDF2-SHA512)
8200	1Password Cloud Keychain

hashcat -m <mode> hashes.txt rockyou.txt -r best64.rule
john --format=<format> hashes.txt --wordlist=rockyou.txt

5. Token / blob unfolding workflow

For a mystery token captured in HTTP traffic:

1. ciphey/ares → reveal base layer
2. If structured (JSON / proto3 / msgpack) → parse
3. If still encoded → repeat step 1
4. Look for HMAC / signature suffix → identify symmetric key candidates
5. If symmetric encryption suspected → try AES-CBC/GCM w/ common keys
   (app-name, "secret", env vars exposed elsewhere)

6. Atlas integration

Wrap as MCP tool:

# atlas/tools/crypto/decode.py — skeleton
def crypto_decode(ciphertext: str, hint: str = None, timeout: int = 30) -> dict:
    """Try ares first (fast), fallback to ciphey, return best decode."""
    import subprocess
    cmd = ["ares", "-t", ciphertext]
    if hint:
        cmd += ["--language", hint]
    r = subprocess.run(cmd, timeout=timeout, capture_output=True, text=True)
    return {
        "tool": "ares",
        "output": r.stdout,
        "confidence": _parse_ares_confidence(r.stdout),
    }

Promote to KG when classification succeeds:

kg_add_node(kind="artifact", label=f"decoded:{hash}",
            props={"plaintext": result, "encoding_chain": chain})

7. Severity (depends on what was decoded)

Decoded content	Severity
Plaintext password	Critical (depends on user role)
API key / private key	Critical
Internal hostname / IP	Medium
Session token	High-Critical
Encryption key	Critical

Cross-references

• Upstream: https://github.com/bee-san/Ciphey, https://github.com/bee-san/Ares
• JWT-specific (different layer): skills/exploit/web/jwt/SKILL.md
• AD hashes: skills/ad/dcsync/SKILL.md

Known exemplars

• CTF flag formats (90% are base64, hex, or rot-N layers)
• Mobile reverse engineering: API keys often base64-XORed in strings
• IoT firmware: AES-CBC w/ hardcoded keys recoverable via Ciphey + ghidra
• Phishing email obfuscation: nested encoding chains common