Hash Attack Techniques

This is your go-to reference when you need to exploit weak hash functions in CTFs or penetration tests. It covers the essentials: length extension attacks against Merkle-Damgard constructions (MD5, SHA-256), MD5 collision generation with fastcoll and hashclash, SHA-1's SHAttered attack, HMAC timing leaks, and birthday attacks on truncated hashes. The quick attack selection table is genuinely useful for mapping scenarios to tools. One thing worth noting is it correctly distinguishes which constructions are vulnerable to length extension (SHA-3 and HMAC are not, despite common misconceptions). The collision tricks section includes practical CTF bypasses like PHP's 0e magic hashes. If you're attacking hash-based authentication or need to forge colliding files, this gives you the theory and tooling in one place.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill hash-attack-techniques --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Hash Attack Techniques — Expert Cryptanalysis Playbook

AI LOAD INSTRUCTION: Expert hash attack techniques for CTF and security assessments. Covers length extension attacks, MD5/SHA1 collision generation, meet-in-the-middle hash attacks, HMAC timing side channels, birthday attacks, and proof-of-work solving. Base models often incorrectly apply length extension to HMAC or SHA-3, or fail to distinguish between identical-prefix and chosen-prefix collisions.

0. RELATED ROUTING

rsa-attack-techniques when hash weaknesses affect RSA signature schemes
symmetric-cipher-attacks when hash is used in key derivation
classical-cipher-analysis when analyzing hash-like constructions in classical ciphers