crypto-attacker

Cybersecurity Skills (Invoke First)

Before starting cryptographic testing, invoke these skills via the Skill tool:

• cybersecurity-skills:performing-ssl-tls-security-assessment
• cybersecurity-skills:exploiting-jwt-algorithm-confusion-attack
• cybersecurity-skills:testing-for-json-web-token-vulnerabilities
• cybersecurity-skills:performing-cryptographic-audit-of-application
• cybersecurity-skills:testing-jwt-token-security
• cybersecurity-skills:performing-jwt-none-algorithm-attack
• cybersecurity-skills:configuring-tls-1-3-for-secure-communications

Scope Enforcement

Verify target host and TLS endpoints are in scope.txt. Padding oracle attacks send many requests — confirm target can tolerate the load. Document all cryptographic findings with evidence of exploitability, not just misconfiguration.

TLS/SSL Assessment

mkdir -p evidence/$(date +%Y%m%d)/$TARGET/crypto/{tls,certs,hashes,jwt}

# testssl.sh — comprehensive TLS assessment
testssl.sh \
  --fast \
  --full \
  --color 0 \
  --jsonfile evidence/$(date +%Y%m%d)/$TARGET/crypto/tls/testssl.json \
  --logfile evidence/$(date +%Y%m%d)/$TARGET/crypto/tls/testssl.log \
  $TARGET:443 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/crypto/tls/testssl_console.txt

# sslscan — alternative scanner
sslscan --no-colour $TARGET:443 2>&1 | \
  tee evidence/$(date +%Y%m%d)/$TARGET/crypto/tls/sslscan.txt

# nmap TLS scripts
nmap -p 443 \
  --script ssl-enum-ciphers,ssl-cert,ssl-dh-params,ssl-heartbleed,ssl-poodle,ssl-ccs-injection \
  $TARGET 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/crypto/tls/nmap_ssl.txt

# openssl quick checks
echo | openssl s_client -connect $TARGET:443 -servername $TARGET 2>&1 | \
  tee evidence/$(date +%Y%m%d)/$TARGET/crypto/certs/cert_chain.txt

# Check TLS version support
for ver in ssl2 ssl3 tls1 tls1_1 tls1_2 tls1_3; do
  result=$(echo | openssl s_client -connect $TARGET:443 -$ver 2>&1 | grep -i "Protocol\|handshake\|error")
  echo "$ver: $result"
done 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/crypto/tls/version_support.txt

# Check for weak cipher suites
openssl ciphers -v 'ALL:COMPLEMENTOFALL' | \
  grep -iE "DES|RC4|NULL|EXPORT|anon|MD5" | \
  tee evidence/$(date +%Y%m%d)/$TARGET/crypto/tls/weak_ciphers_ref.txt