CTF Crypto Solver

• Outcome: Review
• Latest audit: Aug 27, 2026 · 3:25 PM UTC
• Version: 1.0.0

Overview

This is a CTF crypto-solving skill, but it includes runnable real-world exploit and credential-recovery playbooks without clear authorization boundaries.

Install only if you intend to use it in authorized CTF, lab, or defensive research settings. Keep it out of general browsing or real-service workflows, avoid using it with real wallets, accounts, cookies, private keys, or third-party systems, and review any generated scripts before running them against a network target.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This section gives operational guidance for ECC fault-injection and bit-by-bit private-key recovery with no boundary-setting, safety warning, or limitation to offline/authorized CTF scenarios. In a crypto-solving skill, such instructions materially lower the barrier to adapting the technique against real devices or services, so the finding is a true security concern in documentation content.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This passage provides direct private-key recovery and signature-forgery workflow for DSA via MD5-collision-induced nonce reuse, including tooling references and recovery formulas, but does not warn about the sensitivity of recovered keys or the illegality of forgery outside sanctioned environments. Because the skill is explicitly a crypto challenge solver, the context explains the presence of such material but also makes it more readily reusable for misuse against weak real-world systems.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This section provides explicit instructions for repeated querying of an external service to average away noise and recover protected data. Even though framed as a CTF technique, it normalizes oracle-style extraction against live targets and lacks any warning about authorization, rate limits, or use only in sandboxed challenge environments.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: This section gives practical brute-force workflow for reconstructing a BIP39 mnemonic and deriving entropy, which directly applies to wallet seed recovery and theft. In the context of an agent skill meant to help solve crypto problems, inclusion of ready-to-run seed phrase brute-force guidance materially increases misuse risk because BIP39 mnemonics are real-world financial credentials.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This file contains detailed, operational exploitation guidance for multiple cryptographic attacks, including session forgery, protocol bypass, key recovery, and oracle abuse. Even though the stated context is CTF training, the material is directly transferable to real systems and lacks clear authorization, ethics, or defensive-use boundaries, which increases misuse risk in an agent skill.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This section provides concrete, step-by-step offensive guidance that chains a padding oracle into CBC bitflipping to achieve command injection and explicitly references RCE-style outcomes. In an agent skill, that materially increases misuse risk because the content can be operationalized directly by an automated assistant without any user-facing boundary, warning, or restriction.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Across the file, the markdown contains numerous practical instructions for key recovery, authentication bypass, decryption oracles, forgery, and privilege escalation, often with runnable code snippets. Although the stated context is CTF crypto solving, the techniques are broadly transferable to real systems, and the lack of misuse warnings or scope controls makes the skill more dangerous in an agent setting.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This file is a comprehensive offensive crypto exploitation guide containing practical instructions, code snippets, tools, and workflows for padding oracles, MAC forgery, ciphertext forgery, nonce-reuse abuse, and signature forgery. Even though the stated context is CTF solving, the content is directly transferable to real systems and lacks any authorization, safety-boundary, or responsible-use guidance, which increases dual-use risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This section gives step-by-step instructions for recovering Python MT state from exposed `random.random()` outputs and then forging a password reset token and reset URL for a target account. Even in a CTF-focused skill, that is directly transferable to real systems and lacks guardrails about authorization, lawful use, or the fact that password reset prediction enables account takeover.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This document contains detailed, operational instructions for exploiting RSA implementations and abusing crypto oracles, including code snippets and attack workflows, but provides no explicit authorized-use, training-only, or dual-use warning. While framed as CTF material, the techniques closely map to real-world cryptographic weaknesses and can be repurposed against vulnerable systems, increasing misuse risk.

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match

Content

2. For each position, try all 256 byte values and compare the encrypted block:

```python
from pwn import *
import cryptanalib as ca  # FeatherDuster's cryptanalib

def oracle(pt):

• Confidence: 82% confidence
• Finding: The import of pwntools (`from pwn import *`) appears in a working exploit automation example for an AES-ECB chosen-plaintext attack. While common in CTFs, it signals executable exploit tooling embedded in the skill, lowering the barrier to operational abuse when combined with the surrounding oracle/exfiltration instructions.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/ctf-crypto/modern-ciphers-2.md:476