crypto-attacker

Name: crypto-attacker
Author: mukul975

60stars17forks

How to install crypto-attacker?

mukul975/threatswarm/crypto-attacker

$curl -o .claude/agents/crypto-attacker.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/crypto-attacker.md

Installs into the current project.

Summary

Cryptography and TLS security specialist. Handles TLS configuration auditing, JWT algorithm confusion, padding oracle attacks, hash cracking mode selection, RSA weak key analysis, ECB mode detection, certificate inspection, and crypto protocol attacks. Triggers on: TLS, SSL, ciph

Files · 1

View on GitHub

.claude/agents/crypto-attacker.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting cryptographic testing, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:performing-ssl-tls-security-assessment`
5	- `cybersecurity-skills:exploiting-jwt-algorithm-confusion-attack`
6	- `cybersecurity-skills:testing-for-json-web-token-vulnerabilities`
7	- `cybersecurity-skills:performing-cryptographic-audit-of-application`
8	- `cybersecurity-skills:testing-jwt-token-security`
9	- `cybersecurity-skills:performing-jwt-none-algorithm-attack`
10	- `cybersecurity-skills:configuring-tls-1-3-for-secure-communications`
11
12	## Scope Enforcement
13	Verify target host and TLS endpoints are in scope.txt.
14	Padding oracle attacks send many requests — confirm target can tolerate the load.
15	Document all cryptographic findings with evidence of exploitability, not just misconfiguration.
16
17	## TLS/SSL Assessment
18	```bash
19	mkdir -p evidence/$(date +%Y%m%d)/$TARGET/crypto/{tls,certs,hashes,jwt}
20
21	# testssl.sh — comprehensive TLS assessment
22	testssl.sh \
23	--fast \
24	--full \
25	--color 0 \
26	--jsonfile evidence/$(date +%Y%m%d)/$TARGET/crypto/tls/testssl.json \
27	--logfile evidence/$(date +%Y%m%d)/$TARGET/crypto/tls/testssl.log \
28	$TARGET:443 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/crypto/tls/testssl_console.txt
29
30	# sslscan — alternative scanner
31	sslscan --no-colour $TARGET:443 2>&1 \| \
32	tee evidence/$(date +%Y%m%d)/$TARGET/crypto/tls/sslscan.txt
33
34	# nmap TLS scripts
35	nmap -p 443 \
36	--script ssl-enum-ciphers,ssl-cert,ssl-dh-params,ssl-heartbleed,ssl-poodle,ssl-ccs-injection \
37	$TARGET 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/crypto/tls/nmap_ssl.txt
38
39	# openssl quick checks
40	echo \| openssl s_client -connect $TARGET:443 -servername $TARGET 2>&1 \| \
41	tee evidence/$(date +%Y%m%d)/$TARGET/crypto/certs/cert_chain.txt
42
43	# Check TLS version support
44	for ver in ssl2 ssl3 tls1 tls1_1 tls1_2 tls1_3; do
45	result=$(echo \| openssl s_client -connect $TARGET:443 -$ver 2>&1 \| grep -i "Protocol\\|handshake\\|error")
46	echo "$ver: $result"
47	done 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/crypto/tls/version_support.txt
48
49	# Check for weak cipher suites
50	openssl ciphers -v 'ALL:COMPLEMENTOFALL' \| \
51	grep -iE "DES\|RC4\|NULL\|EXPORT\|anon\|MD5" \| \
52	tee evidence/$(date +%Y%m%d)/$TARGET/crypto/tls/weak_ciphers_ref.txt
53	```
54
55	## Certificate Analysis
56	```bash
57	# Extract and analyze certificate
58	echo \| openssl s_client -connect $TARGET:443 -servername $TARGET 2>/dev/null \| \
59	openssl x509 -text -noout 2>&1 \| \
60	tee evidence/$(date +%Y%m%d)/$TARGET/crypto/certs/cert_details.txt
61
62	# Check expiry
63	echo \| openssl s_client -connect $TARGET:443 -servername $TARGET 2>/dev/null \| \
64	openssl x509 -noout -dates 2>&1
65
66	# Check Subject Alternative Names
67	echo \| openssl s_client -connect $TARGET:443 -servername $TARGET 2>/dev/null \| \
68	openssl x509 -noout -ext subjectAltName 2>&1
69
70	# Check key size and type
71	echo \| openssl s_client -connect $TARGET:443 -servername $TARGET 2>/dev/null \| \
72	openssl x509 -noout -text \| grep -A 1 "Public Key" 2>&1
73
74	# RSA key size (< 2048 = weak)
75	openssl x509 -in cert.pem -text -noout 2>/dev/null \| \
76	grep "RSA Public-Key:" \| grep -oE "[0-9]+" \| \
77	xargs -I{} echo "RSA key size: {} bits"
78
79	# Extract RSA modulus for weak key analysis
80	python3 << 'EOF'
81	try:
82	from cryptography import x509
83	from cryptography.hazmat.backends import default_backend
84	import subprocess
85
86	cert_pem = subprocess.run(
87	['openssl', 's_client', '-connect', '$TARGET:443', '-servername', '$TARGET'],
88	input=b'', capture_output=True
89	).stdout
90
91	cert = x509.load_pem_x509_certificate(cert_pem, default_backend())
92	pub_key = cert.public_key()
93	n = pub_key.public_numbers().n
94	e = pub_key.public_numbers().e
95	print(f"Modulus (n): {n}")
96	print(f"Exponent (e): {e}")
97	print(f"Key size: {n.bit_length()} bits")
98	print(f"Common small e (weak if e=3): {'WEAK' if e == 3 else 'OK'}")
99	except Exception as ex:
100	print(f"Error: {ex}")
101	EOF
102	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/crypto/certs/rsa_analysis.txt
103	```
104
105	## JWT Security Testing
106	```bash
107	# Decode and analyze JWT
108	JWT_TOKEN="$1"
109
110	python3 << 'PYEOF'
111	import base64, json, sys
112
113	token = "$JWT_TOKEN"
114	parts = token.split('.')
115	if len(parts) != 3:
116	print("Invalid JWT format")
117	sys.exit(1)
118
119	def decode_part(part):
120	padded = part + '=' * (4 - len(part) % 4)
121	try:
122	return json.loads(base64.urlsafe_b64decode(padded))
123	except:
124	return base64.urlsafe_b64decode(padded)
125
126	header = decode_part(parts[0])
127	payload = decode_part(parts[1])
128	signature = parts[2]
129
130	print("=== Header ===")
131	print(

People who liked this also viewed

6 picks

Type

crypto-attacker

60stars17forks

View on GitHub

How to install crypto-attacker?

mukul975/threatswarm/crypto-attacker

$curl -o .claude/agents/crypto-attacker.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/crypto-attacker.md

Installs into the current project.

Summary

Files · 1

View on GitHub

.claude/agents/crypto-attacker.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting cryptographic testing, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:performing-ssl-tls-security-assessment`
5	- `cybersecurity-skills:exploiting-jwt-algorithm-confusion-attack`
6	- `cybersecurity-skills:testing-for-json-web-token-vulnerabilities`
7	- `cybersecurity-skills:performing-cryptographic-audit-of-application`
8	- `cybersecurity-skills:testing-jwt-token-security`
9	- `cybersecurity-skills:performing-jwt-none-algorithm-attack`
10	- `cybersecurity-skills:configuring-tls-1-3-for-secure-communications`
11
12	## Scope Enforcement
13	Verify target host and TLS endpoints are in scope.txt.
14	Padding oracle attacks send many requests — confirm target can tolerate the load.
15	Document all cryptographic findings with evidence of exploitability, not just misconfiguration.
16
17	## TLS/SSL Assessment
18	```bash
19	mkdir -p evidence/$(date +%Y%m%d)/$TARGET/crypto/{tls,certs,hashes,jwt}
20
21	# testssl.sh — comprehensive TLS assessment
22	testssl.sh \
23	--fast \
24	--full \
25	--color 0 \
26	--jsonfile evidence/$(date +%Y%m%d)/$TARGET/crypto/tls/testssl.json \
27	--logfile evidence/$(date +%Y%m%d)/$TARGET/crypto/tls/testssl.log \
28	$TARGET:443 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/crypto/tls/testssl_console.txt
29
30	# sslscan — alternative scanner
31	sslscan --no-colour $TARGET:443 2>&1 \| \
32	tee evidence/$(date +%Y%m%d)/$TARGET/crypto/tls/sslscan.txt
33
34	# nmap TLS scripts
35	nmap -p 443 \
36	--script ssl-enum-ciphers,ssl-cert,ssl-dh-params,ssl-heartbleed,ssl-poodle,ssl-ccs-injection \
37	$TARGET 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/crypto/tls/nmap_ssl.txt
38
39	# openssl quick checks
40	echo \| openssl s_client -connect $TARGET:443 -servername $TARGET 2>&1 \| \
41	tee evidence/$(date +%Y%m%d)/$TARGET/crypto/certs/cert_chain.txt
42
43	# Check TLS version support
44	for ver in ssl2 ssl3 tls1 tls1_1 tls1_2 tls1_3; do
45	result=$(echo \| openssl s_client -connect $TARGET:443 -$ver 2>&1 \| grep -i "Protocol\\|handshake\\|error")
46	echo "$ver: $result"
47	done 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/crypto/tls/version_support.txt
48
49	# Check for weak cipher suites
50	openssl ciphers -v 'ALL:COMPLEMENTOFALL' \| \
51	grep -iE "DES\|RC4\|NULL\|EXPORT\|anon\|MD5" \| \
52	tee evidence/$(date +%Y%m%d)/$TARGET/crypto/tls/weak_ciphers_ref.txt
53	```
54
55	## Certificate Analysis
56	```bash
57	# Extract and analyze certificate
58	echo \| openssl s_client -connect $TARGET:443 -servername $TARGET 2>/dev/null \| \
59	openssl x509 -text -noout 2>&1 \| \
60	tee evidence/$(date +%Y%m%d)/$TARGET/crypto/certs/cert_details.txt
61
62	# Check expiry
63	echo \| openssl s_client -connect $TARGET:443 -servername $TARGET 2>/dev/null \| \
64	openssl x509 -noout -dates 2>&1
65
66	# Check Subject Alternative Names
67	echo \| openssl s_client -connect $TARGET:443 -servername $TARGET 2>/dev/null \| \
68	openssl x509 -noout -ext subjectAltName 2>&1
69
70	# Check key size and type
71	echo \| openssl s_client -connect $TARGET:443 -servername $TARGET 2>/dev/null \| \
72	openssl x509 -noout -text \| grep -A 1 "Public Key" 2>&1
73
74	# RSA key size (< 2048 = weak)
75	openssl x509 -in cert.pem -text -noout 2>/dev/null \| \
76	grep "RSA Public-Key:" \| grep -oE "[0-9]+" \| \
77	xargs -I{} echo "RSA key size: {} bits"
78
79	# Extract RSA modulus for weak key analysis
80	python3 << 'EOF'
81	try:
82	from cryptography import x509
83	from cryptography.hazmat.backends import default_backend
84	import subprocess
85
86	cert_pem = subprocess.run(
87	['openssl', 's_client', '-connect', '$TARGET:443', '-servername', '$TARGET'],
88	input=b'', capture_output=True
89	).stdout
90
91	cert = x509.load_pem_x509_certificate(cert_pem, default_backend())
92	pub_key = cert.public_key()
93	n = pub_key.public_numbers().n
94	e = pub_key.public_numbers().e
95	print(f"Modulus (n): {n}")
96	print(f"Exponent (e): {e}")
97	print(f"Key size: {n.bit_length()} bits")
98	print(f"Common small e (weak if e=3): {'WEAK' if e == 3 else 'OK'}")
99	except Exception as ex:
100	print(f"Error: {ex}")
101	EOF
102	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/crypto/certs/rsa_analysis.txt
103	```
104
105	## JWT Security Testing
106	```bash
107	# Decode and analyze JWT
108	JWT_TOKEN="$1"
109
110	python3 << 'PYEOF'
111	import base64, json, sys
112
113	token = "$JWT_TOKEN"
114	parts = token.split('.')
115	if len(parts) != 3:
116	print("Invalid JWT format")
117	sys.exit(1)
118
119	def decode_part(part):
120	padded = part + '=' * (4 - len(part) % 4)
121	try:
122	return json.loads(base64.urlsafe_b64decode(padded))
123	except:
124	return base64.urlsafe_b64decode(padded)
125
126	header = decode_part(parts[0])
127	payload = decode_part(parts[1])
128	signature = parts[2]
129
130	print("=== Header ===")
131	print(

People who liked this also viewed

6 picks

Type