ctf-crypto by ljagiello/ctf-skills
npx skills add https://github.com/ljagiello/ctf-skills --skill ctf-cryptoCTF 密码学挑战快速参考。每种技术在此处都有一行描述;完整细节和代码请参阅支持文件。
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
(ct - pt) mod 26 推导密钥。对于未知密钥长度,使用 Kasiski 检验(重复序列距离的 GCD)C1 XOR C2 XOR known_P = unknown_P;当没有已知明文时,使用 crib dragging完整代码示例请参见 classic-ciphers.md。
new_sig = old_sig XOR block_difflen(set(sbox)) < 256)允许通过 4,097 次查询恢复密钥(state >> 1) XOR next_state 以获取 LSB=1 的转换,从而直接恢复抽头掩码。自相关滑动找到正确长度。参见 stream-ciphers.md。SHA256(public_key) XOR seed 派生的 AES 密钥无需私钥即可完全恢复;“混合” RSA+AES 不提供安全性。参见 modern-ciphers.md。完整代码示例请参见 modern-ciphers.md。
f.small_roots()or 短路在 Y != 0 时跳过昂贵的 PBKDF2,创建快/慢时序预言机。完整的三步攻击(约 1024 次迭代用于 1024 位 RSA)。使用已知快/已知慢样本校准时序边界。g(0) = 0;为 msg = 0 (mod P) 构造后缀,签名 = 0r = flag mod f,过滤互质,CRT 组合p=q 使服务器计算错误的 phi=(p-1)^2 而不是 p*(p-1);测试解密失败,泄露密文nthroot_mod 计算每个素数的 e 次方根,枚举 CRT 组合(对于小的 k,3^k 可行)phi(n) 的任何倍数(例如,e*d-1)都可以通过 Miller-Rabin 平方根技术实现分解;每次尝试成功概率 ≥ 1/2p = kp*B + tp 在 n 中创建混合基结构;暴力破解 kp*kq(2^24)以分解e' = e/g,计算 d' = e'^(-1) mod phi,部分解密到 m^g,然后在整数上取 g 次方根完整代码示例请参见 rsa-attacks.md 和 advanced-math.md。
p-1 或曲线阶的所有因子都很小)。Sage:discrete_log(Mod(h,p), Mod(g,p))。参见 advanced-math.md。r 通过模运算泄露随机数 k 和私钥 d。检查重复的 r 值key = master * uid mod l 时,辅因子 h=8 泄露秘密标量比特;查询 2 的幂,检查 y 坐标一致性b* = max(Mb[i] - M[i][j]) 直接从公钥矩阵恢复共享秘密完整代码示例请参见 ecc-attacks.md、advanced-math.md 和 exotic-crypto.md。
[q*I | 0; A^T | I] 构造格,使用 fpylll CVP.babai 找到最近向量,投影到三元组 {-1,0,1}。注意服务器描述与实际编码之间的字节序不匹配。完整的 LWE 求解代码和多层模式请参见 advanced-math.md。
nx.coloring.greedy_color(G, strategy='saturation_largest_first')counter < N 检查完整代码示例和求解器模式请参见 zkp-and-advanced.md。
c = A*x+b (mod M),M 为合数(例如,65=5*13)。通过独热向量进行选择明文恢复,每个素因子进行 CRT 求逆。参见 modern-ciphers.md。m*s < 2^128 上的二分搜索。约 128 次查询以恢复 AES 密钥。服务器揭示有效/无效填充 → 无需密钥即可解密任何 CBC 密文。每 16 字节块约 4096 次查询。使用 PadBuster 或 padding-oracle Python 库。参见 modern-ciphers.md。
RSA PKCS#1 v1.5 填充验证预言机 → 自适应选择密文明文恢复。RSA-2048 约需 10K 次查询。通过时序影响 TLS 实现。参见 modern-ciphers.md。
n 位哈希碰撞约需 2^(n/2) 次尝试。中间相遇攻击以 O(2^k) 而非 O(2^(2k)) 破解双重加密。参见 modern-ciphers.md。
CRC32 是线性的——附加 4 个选定字节以强制任何目标 CRC32,无需秘密即可伪造 CRC32(msg || secret) 签名。参见 modern-ciphers.md。
通过每次预言机查询扩展密文一个比特,通过奇偶性泄露明文。操纵 BBS 平方序列以产生有效的扩展密文。参见 modern-ciphers.md。
利用 Merkle-Damgard 哈希(hash(SECRET || user_data))——附加任意数据并在不知道秘密的情况下计算有效哈希。使用 hashpump 或 hashpumpy。参见 modern-ciphers.md。
加密前的压缩通过密文长度变化泄露明文。发送选定的明文;匹配的 n-gram 压缩得更短。与 CRIME/BREACH 同类。参见 modern-ciphers.md。
RC4 的第二输出字节偏向 0x00(概率 1/128 对比 1/256)。约 2048 个样本即可将 RC4 与随机区分开。参见 stream-ciphers.md。
无填充 RSA:S(a) * S(b) mod n = S(a*b) mod n。如果预言机将目标消息列入黑名单,则对其因子签名并相乘。参见 rsa-attacks.md。
phi = (p-1)*(q-1), d = inverse(e, phi), m = pow(c, d, n)。完整示例请参见 rsa-attacks.md。from pwn import xor; xor(ct, key)。XOR 变体请参见 classic-ciphers.md。模式: 二进制使用 srand(time(NULL)) + rand() 生成密钥/XOR 掩码。Python 的 random 模块使用不同的 PRNG。使用 ctypes.CDLL('./libc.so.6') 直接调用 C 语言的 srand(int(time())) 和 rand(),重现完全相同的序列。XOR 解密示例和时序技巧请参见 prng.md。
模式: V8 JavaScript 引擎使用 xs128p PRNG 实现 Math.random()。给定 5-10 个连续的 Math.floor(CONST * Math.random()) 输出,使用 Z3 QF_BV 求解器恢复内部状态(state0, state1)并预测未来值。值必须反转(LIFO 缓存)。工具:d0nutptr/v8_rand_buster。参见 prng.md。
模式: 服务器暴露 random.random() 浮点数。标准的逆态需要 624 × 32 位整数,但浮点数每个只产生约 8 个可用比特。预计算的 GF(2) 魔法矩阵(not_random 库)从 3360+ 个浮点数观察中恢复完整的 MT 状态。用于预测从 random.random() 派生的密码重置令牌、会话 ID 或 CSRF 令牌。参见 prng.md。
x = r * x * (1 - x), r ≈ 3.99-4.0;通过暴力破解高精度小数恢复种子struct.pack("<f", x);与密文进行 XOR完整代码请参见 prng.md。
pip install pycryptodome z3-solver sympy gmpy2sage -python script.py(ECC、Coppersmith、格攻击必需)python RsaCtfTool.py -n <n> -e <e> --uncipher <c> —— 自动化 RSA 攻击套件(尝试 Wiener、Hastad、Fermat、Pollard 等多种攻击)每周安装次数
579
仓库
GitHub Stars
664
首次出现
2026年2月1日
安全审计
安装于
codex567
opencode564
github-copilot552
gemini-cli550
amp550
kimi-cli549
Quick reference for crypto CTF challenges. Each technique has a one-liner here; see supporting files for full details with code.
(ct - pt) mod 26. Kasiski examination for unknown key length (GCD of repeated sequence distances)C1 XOR C2 XOR known_P = unknown_P; crib dragging when no plaintext knownSee classic-ciphers.md for full code examples.
new_sig = old_sig XOR block_difflen(set(sbox)) < 256) enables 4,097-query key recovery(state >> 1) XOR next_state for LSB=1 transitions to directly recover tap mask. Autocorrelation sliding finds correct length. See stream-ciphers.md.See modern-ciphers.md for full code examples.
f.small_roots() in SageMathor short-circuit skips expensive PBKDF2 when Y != 0, creating fast/slow timing oracle. Full 3-step attack (~1024 iterations for 1024-bit RSA). Calibrate timing bounds with known-fast/known-slow samples.g(0) = 0 for polynomial hash; craft suffix for msg = 0 (mod P), signature = 0See rsa-attacks.md and advanced-math.md for full code examples.
p-1 or curve order are small). Sage: discrete_log(Mod(h,p), Mod(g,p)). See advanced-math.md.r in two signatures leaks nonce k and private key d via modular arithmetic. Check for repeated valuesSee ecc-attacks.md, advanced-math.md, and exotic-crypto.md for full code examples.
[q*I | 0; A^T | I], use fpylll CVP.babai to find closest vector, project to ternary {-1,0,1}. Watch for endianness mismatches between server description and actual encoding.See advanced-math.md for full LWE solving code and multi-layer patterns.
nx.coloring.greedy_color(G, strategy='saturation_largest_first')counter < N checksSee zkp-and-advanced.md for full code examples and solver patterns.
c = A*x+b (mod M), M composite (e.g., 65=5*13). Chosen-plaintext recovery via one-hot vectors, CRT inversion per prime factor. See modern-ciphers.md.m*s < 2^128. ~128 queries to recover AES key.Server reveals valid/invalid padding → decrypt any CBC ciphertext without key. ~4096 queries per 16-byte block. Use PadBuster or padding-oracle Python library. See modern-ciphers.md.
RSA PKCS#1 v1.5 padding validation oracle → adaptive chosen-ciphertext plaintext recovery. ~10K queries for RSA-2048. Affects TLS implementations via timing. See modern-ciphers.md.
n-bit hash collision in ~2^(n/2) attempts. Meet-in-the-middle breaks double encryption in O(2^k) instead of O(2^(2k)). See modern-ciphers.md.
CRC32 is linear — append 4 chosen bytes to force any target CRC32, forging CRC32(msg || secret) signatures without the secret. See modern-ciphers.md.
Extend ciphertext by one bit per oracle query to leak plaintext via parity. Manipulate BBS squaring sequence to produce valid extended ciphertexts. See modern-ciphers.md.
Exploits Merkle-Damgard hashes (hash(SECRET || user_data)) — append arbitrary data and compute valid hash without knowing the secret. Use hashpump or hashpumpy. See modern-ciphers.md.
Compression before encryption leaks plaintext via ciphertext length changes. Send chosen plaintexts; matching n-grams compress shorter. Same class as CRIME/BREACH. See modern-ciphers.md.
RC4's second output byte is biased toward 0x00 (probability 1/128 vs 1/256). Distinguishes RC4 from random with ~2048 samples. See stream-ciphers.md.
Unpadded RSA: S(a) * S(b) mod n = S(a*b) mod n. If oracle blacklists target message, sign its factors and multiply. See rsa-attacks.md.
phi = (p-1)*(q-1), d = inverse(e, phi), m = pow(c, d, n). See rsa-attacks.md for full examples.from pwn import xor; xor(ct, key). See classic-ciphers.md for XOR variants.Pattern: Binary uses srand(time(NULL)) + rand() for keys/XOR masks. Python's random module uses a different PRNG. Use ctypes.CDLL('./libc.so.6') to call C's srand(int(time())) and rand() directly, reproducing the exact sequence. See prng.md for XOR decryption examples and timing tips.
Pattern: V8 JavaScript engine uses xs128p PRNG for Math.random(). Given 5-10 consecutive outputs of Math.floor(CONST * Math.random()), recover internal state (state0, state1) with Z3 QF_BV solver and predict future values. Values must be reversed (LIFO cache). Tool: d0nutptr/v8_rand_buster. See prng.md.
Pattern: Server exposes random.random() floats. Standard untemper needs 624 × 32-bit integers, but floats yield only ~8 usable bits each. A precomputed GF(2) magic matrix (not_random library) recovers the full MT state from 3360+ float observations. Use to predict password reset tokens, session IDs, or CSRF tokens derived from random.random(). See prng.md.
x = r * x * (1 - x), r ≈ 3.99-4.0; seed recovery by brute-forcing high-precision decimalsstruct.pack("<f", x) per iteration; XOR with ciphertextSee prng.md for full code.
pip install pycryptodome z3-solver sympy gmpy2sage -python script.py (required for ECC, Coppersmith, lattice attacks)python RsaCtfTool.py -n <n> -e <e> --uncipher <c> — automated RSA attack suite (tries Wiener, Hastad, Fermat, Pollard, and many more)Weekly Installs
579
Repository
GitHub Stars
664
First Seen
Feb 1, 2026
Security Audits
Gen Agent Trust HubPassSocketWarnSnykPass
Installed on
codex567
opencode564
github-copilot552
gemini-cli550
amp550
kimi-cli549
Docker专家技能:容器优化、安全加固、多阶段构建与生产部署最佳实践
8,800 周安装
AI图像生成工具 - 50+模型一键生成图片 | FLUX、Gemini、Grok等
16 周安装
Alchemy Web3技能:区块链数据查询API,支持以太坊、Polygon、Solana等80+链
19 周安装
Claude setperms 工具:一键配置开发环境权限和现代CLI工具
21 周安装
系统性调试指南:遵循4阶段流程,高效定位并修复根本原因
20 周安装
data-driven-testing 测试技能已弃用 | 测试最佳实践替代方案 | 0xbigboss/claude-code
58 周安装
specalign规范对齐工具:自动检测代码与文档差异,确保开发一致性
58 周安装
SHA256(public_key) XOR seed is fully recoverable without private key; "hybrid" RSA+AES provides no security. See modern-ciphers.md.r = flag mod f, filter coprime, CRT combinep=q so server computes wrong phi=(p-1)^2 instead of p*(p-1); test decryption fails, leaking ciphertextnthroot_mod, enumerate CRT combinations (3^k feasible for small k)phi(n) (e.g., e*d-1) enables factoring via Miller-Rabin square root technique; succeeds with prob ≥ 1/2 per attemptp = kp*B + tp with small kp create mixed-radix structure in n; brute-force kp*kq (2^24) to factore' = e/g, compute d' = e'^(-1) mod phi, partial decrypt to m^g, then take g-th root over integersrkey = master * uid mod l; query powers of 2, check y-coordinate consistencyb* = max(Mb[i] - M[i][j]) recovers shared secret directly from public matrices