crypto-recon-report

name	crypto-recon-report
description	Final report writer for crypto-recon pipeline. Compiles all specialist findings into a structured markdown report saved to output/[domain]/final/[domain].md

Crypto Recon — Report Writer

Purpose

Compile all findings from all 10 specialist agents into a single, structured, comprehensive report. Write it to output/[domain]/final/[domain].md. No icons in filename. No emoji in report content.

Input

You receive the complete findings from all specialists:

• crypto-recon-hash findings
• crypto-recon-symmetric findings
• crypto-recon-asymmetric findings
• crypto-recon-mac findings
• crypto-recon-kdf findings
• crypto-recon-encoding findings
• crypto-recon-signing findings
• crypto-recon-jwt-oauth findings
• crypto-recon-libraries findings
• crypto-recon-custom findings

Output Path

output/[domain]/final/[domain].md

Example for http://example.com/:

output/example.com/final/example.com.md

Create the final/ directory if it does not exist.

Report Structure

# Crypto Recon Report: [domain]

**Target:** [full URL]
**Date:** [YYYY-MM-DD]
**Files analyzed:** [N] JS files ([X] KB total)
**Specialists run:** 10

---

## Executive Summary

[3-5 sentences describing what crypto this app uses overall, highest-priority findings, and recommended action for user]

---

## Crypto Library Ecosystem

[Table from crypto-recon-libraries]

| Library | Version | Used For |
|---------|---------|----------|
| CryptoJS | 4.1.1 | MD5, AES, Base64 |
| ...      | ...     | ...      |

---

## Findings by Category

### Hash Functions
[All findings from crypto-recon-hash]

### Symmetric Encryption
[All findings from crypto-recon-symmetric]

### Asymmetric Cryptography
[All findings from crypto-recon-asymmetric]

### MAC / HMAC
[All findings from crypto-recon-mac]

### Key Derivation
[All findings from crypto-recon-kdf]

### Encoding & Obfuscation
[All findings from crypto-recon-encoding]

### API Request Signing
[All findings from crypto-recon-signing]

### JWT / OAuth / Tokens
[All findings from crypto-recon-jwt-oauth]

### Custom & Obfuscated Crypto
[All findings from crypto-recon-custom]

---

## Call Graph

[Combined call graph from all findings — show how crypto functions connect]

HTTP Request Layer (axios.interceptors) └── generateSignParams(data) ├── uuid.v4().hex → random nonce ├── filterNull(data) → remove empty fields ├── sortKeys(filtered) → alphabetical ├── JSON.stringify(sorted) → canonical string └── md5(canonical).upper() → signature └── CryptoJS.MD5()

Login Flow └── encryptPassword(pwd) └── JSEncrypt.setPublicKey(HARDCODED_RSA_KEY) └── RSA-2048 OAEP encryption

---

## Hardcoded Secrets Found

[CRITICAL section — list every hardcoded key, secret, password verbatim]

| Type | Value | Location | Used For |
|------|-------|----------|---------|
| HMAC key | "x7k9mNpQ2rSvWyZ3" | common.modules:3201 | All API signing |
| RSA pub key | [PEM...] | page-login:891 | Login encryption |
| JWT secret | "my_jwt_secret_2024" | index.js:5501 | Session auth |

---

## Security Assessment

[Summarize any security issues found — weak algos, hardcoded keys, bad patterns]

| Severity | Issue | Location |
|---------|-------|---------|
| CRITICAL | Hardcoded HMAC secret in JS | common.modules:3201 |
| HIGH | DES-ECB with static key | page-login:891 |
| MEDIUM | Client-side password hashing (SHA256, no salt) | page-login:302 |
| LOW | Math.random() used for nonce (not crypto-grade) | index.js:9101 |

---

## Reconstruction Targets

[List findings suitable for Python reconstruction, in priority order]

1. **generateSignParams** (crypto-recon-signing, SG1) — MD5 request signing — HIGH confidence
2. **encryptPassword** (crypto-recon-symmetric, S2) — DES-ECB login — HIGH confidence
3. **hashUserKey** (crypto-recon-kdf, K2) — HMAC key derivation — MEDIUM confidence

To reconstruct: `crypto-recon-reconstruct` with finding [ID]

---

## Files Analyzed

| File | Size | Findings |
|------|------|---------|
| index-5ef15b56.js | 84.3 KB | 7 |
| common.modules-6d4292d1.js | 212.1 KB | 14 |
| page-login-abc123.js | 31.2 KB | 5 |
| ... | ... | ... |

---

## WASM Files (Not Analyzed)

[List any .wasm files that require binary RE tools]

| File | Size | Notes |
|------|------|-------|
| runtime.wasm | 2.1 MB | Requires Ghidra or wabt for analysis |

---

*Report generated by crypto-recon-report*
*Full scan: [N] seconds*

Writing Rules

1. No emoji anywhere in the report
2. No special splash characters in filename
3. All hardcoded secrets must appear VERBATIM in the "Hardcoded Secrets" section
4. Every finding must include file + line number
5. Confidence levels must be consistent with specialist reports
6. Executive summary must be accurate — do not overstate or understate
7. If a specialist found nothing → write "[Category]: No findings" (do not skip the section)
8. The call graph section is required — even if simple

After Writing

Confirm to orchestrator:

Report written: output/[domain]/final/[domain].md
Size: [N] lines
Sections: [N] findings across [N] categories
Hardcoded secrets: [N] found
Reconstruction targets: [N] available