Crypto Analysis

This is your cryptographic assessment toolkit for pentesting and security research. It covers the full spectrum: identifying hash types and cipher modes, auditing TLS configurations with testssl and openssl, cracking passwords with hashcat and john, and reviewing crypto implementations for common pitfalls like ECB mode, static IVs, and missing authentication. The real value is in the implementation review guidance, it flags dangerous patterns like predictable randomness and walks through actual attack implementations including padding oracles and ECDSA nonce reuse recovery. Also includes RSA-CTF-Tool integration and side-channel detection patterns. Useful during recon when you find hashes or certificates, and before exploitation when you need to understand if crypto weakness is your entry point.

GitHub stars: 280
last updated: May 28, 2026

View on GitHub

Install

$ npx -y skills add hypnguyen1209/offensive-claude --skill crypto-analysis --agent claude-code

Installs into .claude/skills of the current project.

Files

Cryptographic Analysis

When to Activate

Auditing TLS/SSL/SSH configurations and X.509 PKI (cipher suites, downgrade, protocol flaws)
Reviewing crypto implementations in source code or captured traffic
Attacking weak RSA/ECC keys (CTF and real-world weak-key hygiene)
Recovering ECDSA/DSA private keys from reused or biased nonces (lattice/HNP)
Exploiting symmetric/AEAD misuse: padding oracles, GCM nonce reuse, key-commitment
Forging JWT/JOSE tokens (algorithm confusion, none, jwk/jku/kid injection)
Cracking password hashes and grading KDF strength
Assessing post-quantum readiness ("harvest now, decrypt later" exposure)