crypto-analysis

Use when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review

Ir para a instalação

Repositório: hypnguyen1209/offensive-claude
Última atividade na origem: 29 de junho de 2026 às 07:22
Idioma detectado do SKILL.md: inglês
Estrelas: 343
Forks: 59

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill crypto-analysis

O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.

Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

Explorador de arquivos

14 arquivos

SKILL.md

Instruções da origem · Visualização somente leitura

Voltar à pesquisa Voltar à instalação

reverse-engineering

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

2026-07-30

privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

2026-06-30

threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

2026-06-30

Ver todas deste repositório

Cryptographic Analysis

When to Activate

Auditing TLS/SSL/SSH configurations and X.509 PKI (cipher suites, downgrade, protocol flaws)

Reviewing crypto implementations in source code or captured traffic

Attacking weak RSA/ECC keys (CTF and real-world weak-key hygiene)

Recovering ECDSA/DSA private keys from reused or biased nonces (lattice/HNP)

Exploiting symmetric/AEAD misuse: padding oracles, GCM nonce reuse, key-commitment

Forging JWT/JOSE tokens (algorithm confusion, none, jwk/jku/kid injection)

Cracking password hashes and grading KDF strength

Assessing post-quantum readiness ("harvest now, decrypt later" exposure)

Technique Map

Technique

ATT&CK

CWE

Reference

Script

TLS cipher/protocol downgrade audit

T1600.001

CWE-326

references/tls-pki-audit.md

scripts/tls_audit.py

Terrapin SSH prefix truncation (CVE-2023-48795)

T1557

CWE-222

references/tls-pki-audit.md

scripts/tls_audit.py

Marvin/Bleichenbacher RSA timing oracle

T1600

CWE-208

references/tls-pki-audit.md

scripts/tls_audit.py

X.509 / CT-log shadow-asset discovery

T1589

CWE-295

references/tls-pki-audit.md

scripts/tls_audit.py

RSA weak-key factoring (Fermat/Wiener/common-modulus)

T1600

CWE-326

references/rsa-attacks.md

scripts/rsa_attack.py

Coppersmith partial-key & ROCA (CVE-2017-15361)

T1600

CWE-310

references/rsa-attacks.md

scripts/rsa_attack.py

Hastad broadcast / batch-GCD

T1600

CWE-326

references/rsa-attacks.md

scripts/rsa_attack.py

ECDSA nonce reuse key recovery

T1552.004

CWE-323

references/ecc-nonce-attacks.md

scripts/ecdsa_lattice.py

Biased-nonce lattice/HNP (Minerva, PuTTY CVE-2024-31497)

T1552.004

CWE-1241

references/ecc-nonce-attacks.md

scripts/ecdsa_lattice.py

Cryptographic Analysis

When to Activate

Auditing TLS/SSL/SSH configurations and X.509 PKI (cipher suites, downgrade, protocol flaws)

Reviewing crypto implementations in source code or captured traffic

Attacking weak RSA/ECC keys (CTF and real-world weak-key hygiene)

Recovering ECDSA/DSA private keys from reused or biased nonces (lattice/HNP)

Exploiting symmetric/AEAD misuse: padding oracles, GCM nonce reuse, key-commitment

Forging JWT/JOSE tokens (algorithm confusion, none, jwk/jku/kid injection)

Cracking password hashes and grading KDF strength

Assessing post-quantum readiness ("harvest now, decrypt later" exposure)

Technique Map

Technique

ATT&CK

CWE

Reference

Script

TLS cipher/protocol downgrade audit

T1600.001

CWE-326

references/tls-pki-audit.md

scripts/tls_audit.py

Terrapin SSH prefix truncation (CVE-2023-48795)

T1557

CWE-222

references/tls-pki-audit.md

scripts/tls_audit.py

Marvin/Bleichenbacher RSA timing oracle

T1600

CWE-208

references/tls-pki-audit.md

scripts/tls_audit.py

X.509 / CT-log shadow-asset discovery

T1589

CWE-295

references/tls-pki-audit.md

scripts/tls_audit.py

RSA weak-key factoring (Fermat/Wiener/common-modulus)

T1600

CWE-326

references/rsa-attacks.md

scripts/rsa_attack.py

Coppersmith partial-key & ROCA (CVE-2017-15361)

T1600

CWE-310

references/rsa-attacks.md

scripts/rsa_attack.py

Hastad broadcast / batch-GCD

T1600

CWE-326

references/rsa-attacks.md

scripts/rsa_attack.py

ECDSA nonce reuse key recovery

T1552.004

CWE-323

references/ecc-nonce-attacks.md

scripts/ecdsa_lattice.py

Biased-nonce lattice/HNP (Minerva, PuTTY CVE-2024-31497)

T1552.004

CWE-1241

references/ecc-nonce-attacks.md

scripts/ecdsa_lattice.py

name	crypto-analysis
description	Use when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review
metadata	{"type":"offensive","phase":"analysis","tools":"testssl.sh, openssl, hashcat, john, RsaCtfTool, sagemath, jwt_tool, ecdsa-lattice","mitre":["T1600","T1600.001","T1557","T1110.002","T1552.004","T1606.001","T1040"]}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0006","TA0009"],"attck_techniques":["T1600","T1600.001","T1557","T1557.001","T1110.002","T1552.004","T1606.001","T1040"]}
depends_on	["recon-osint"]
feeds_into	["exploit-development","web-pentest","network-attack"]
inputs	["tls_config","crypto_implementation","hash_samples","public_keys","jwt_tokens","signature_corpus"]
outputs	["crypto_weakness_report","finding_record","recovered_keys","cracked_credentials"]
references	["references/tls-pki-audit.md","references/rsa-attacks.md","references/ecc-nonce-attacks.md","references/symmetric-aead.md","references/jwt-jose.md","references/hash-pq.md"]
scripts	["scripts/tls_audit.py","scripts/rsa_attack.py","scripts/ecdsa_lattice.py","scripts/padding_oracle.py","scripts/gcm_nonce_reuse.py","scripts/jwt_forge.py","scripts/hash_triage.py"]

name	crypto-analysis
description	Use when assessing cryptography — TLS/PKI auditing, RSA/ECC key attacks, ECDSA nonce lattice recovery, symmetric/AEAD misuse, JWT/JOSE forgery, hash cracking, post-quantum migration review
metadata	{"type":"offensive","phase":"analysis","tools":"testssl.sh, openssl, hashcat, john, RsaCtfTool, sagemath, jwt_tool, ecdsa-lattice","mitre":["T1600","T1600.001","T1557","T1110.002","T1552.004","T1606.001","T1040"]}
kill_chain	{"phase":["recon","exploit"],"step":[1,4],"attck_tactics":["TA0043","TA0006","TA0009"],"attck_techniques":["T1600","T1600.001","T1557","T1557.001","T1110.002","T1552.004","T1606.001","T1040"]}
depends_on	["recon-osint"]
feeds_into	["exploit-development","web-pentest","network-attack"]
inputs	["tls_config","crypto_implementation","hash_samples","public_keys","jwt_tokens","signature_corpus"]
outputs	["crypto_weakness_report","finding_record","recovered_keys","cracked_credentials"]
references	["references/tls-pki-audit.md","references/rsa-attacks.md","references/ecc-nonce-attacks.md","references/symmetric-aead.md","references/jwt-jose.md","references/hash-pq.md"]
scripts	["scripts/tls_audit.py","scripts/rsa_attack.py","scripts/ecdsa_lattice.py","scripts/padding_oracle.py","scripts/gcm_nonce_reuse.py","scripts/jwt_forge.py","scripts/hash_triage.py"]

Technique	Telemetry / IOC	Detection (Sigma/EDR)	OPSEC note
TLS scanning / testssl	Burst of handshakes, many cipher renegotiations, malformed ClientHellos	NIDS: high TLS alert rate from one src; Zeek `ssl.log` anomalous cipher offers	Rate-limit, spread across source IPs; passive cert/CT recon leaves no target-side trace
Marvin/ROBOT oracle probing	~10^4–10^6 RSA decrypts, repeated malformed pre-master/CMS	WAF/IDS: spike of TLS decrypt errors, identical-size payloads	Extremely loud; only against authorized hosts; use minimal query budgets
Terrapin MitM	Injected SSH_MSG_IGNORE, sequence-number gap at NEWKEYS	SSH server logs `kex` mismatch; netflow showing on-path device	Requires active MitM; detectable by strict-kex peers; abort if `kex-strict` present
ECDSA nonce harvesting	Bulk signature collection (Git, TLS, SSH, blockchain)	Mostly offline — no target telemetry once sigs captured	Collection is passive; recovery is offline; rotate-key advice in report
CBC padding oracle	Thousands of decrypt requests, alternating valid/invalid padding	Web logs: ~256×blocks requests to one endpoint; Sigma on 4xx burst	Very noisy (256×blocks×msgs); throttle, randomize timing
GCM nonce reuse / partitioning	Repeated (nonce,key) pairs; multi-key ciphertext blobs	App crypto audit; flag reused IVs in logs	Forbidden-attack math is offline once two ciphertexts captured
JWT forgery	Anomalous `alg`, external `jku`/`x5u` fetch, all-zero ES signature	Sigma: JWT with `alg:none`/HS after RS expected; egress to attacker JWKS URL	Each forged token is a single request; minimal noise
Hash cracking	None on target (offline)	N/A unless online spray (then T1110)	Offline; protect loot at rest; never spray live without scope

crypto-analysis

Opções de instalação

Revise os arquivos de origem

Cryptographic Analysis

When to Activate

Technique Map

Cryptographic Analysis

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

crypto-analysis

Informações da origem

Opções de instalação

Revise os arquivos de origem

Mais deste repositório

Cryptographic Analysis

When to Activate

Technique Map

Mais deste repositório

Cryptographic Analysis

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives