Handle encoded strings and cryptographic data with tool-based conversions. Decode layered formats, calculate hashes, encrypt or decrypt with AES and RSA, and inspect JWT tokens, which carry encoded headers and data used in authentication.
编码解码与加解密工具 — base64/URL/Hex/HTML实体编码解码，MD5/SHA哈希，AES/DES/RSA加解密，JWT解析，Caesar/ROT13密码，栅栏/Vigenere密码，Unicode转义，Morse电码等
Review the instructions the agent will receive before you install.
针对渗透测试中常见的编码、加密、混淆场景，提供全面的编解码和加解密能力。
重要：遇到任何编码/加密字符串时，优先使用 crypto_decode 工具进行解码，而非靠直觉猜测。
crypto_decode 工具解码，不要自行脑补| 编码类型 | 特征 | 示例 |
|---|---|---|
| Base64 | A-Za-z0-9+/= 结尾常有 = 填充 | TnNTY1RmLnBocA== |
| Base32 | A-Z2-7= | OBZHK5DFN2A==== |
| Hex | 0-9a-f 偶数长度 | 4e73536354662e706870 |
| URL编码 | %XX 格式 | %2F%61%64%6D%69%6E |
| HTML实体 | &#xNN; 或 &#NNN; | <script> |
| Unicode转义 | \uXXXX 或 \UXXXXXXXX | \u003c\u0073\u0063 |
| JWT | 三段 . 分隔的 base64 | eyJhbG... |
crypto_decode 工具指定对应操作| 类型 | 输出长度 | 特征 |
|---|---|---|
| MD5 | 32 hex | e10adc3949ba59abbe56e057f20f883e |
| SHA1 | 40 hex | aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d |
| SHA256 | 64 hex | 2c26b46b68ffc68ff99b453c1d30413413422d7064... |
| SHA512 | 128 hex | 更长的hex字符串 |
| NTLM | 32 hex | Windows hash |
| MySQL5 | 41字符 | *E6CC90B878B948C35E92B003C792C46758BF4 |
| 类型 | 特征 | 破解方法 |
|---|---|---|
| Caesar/ROT13 | 字母位移 | 暴力25种位移 |
| Vigenere | 多表替换 | Kasiski/频率分析 |
| 栅栏密码 | 字符分组重组 | 尝试常见栏数 |
| 培根密码 | AB 五元组 | 查表 |
| Morse | .- 点划 | 查表 |
none 算法绕过、RS256→HS256 算法混淆crypto_decode 工具当遇到需要编码/解码/加密/解密的操作时，调用此工具：
crypto_decode(operation="base64_decode", input="TnNTY1RmLnBocA==")
支持的操作列表：
base64_encode, base32_encode, hex_encode, url_encode, html_encode, unicode_encode, rot13_encode, morse_encode, caesar_encode, base58_encodebase64_decode, base32_decode, hex_decode, url_decode, html_decode, unicode_decode, rot13_decode, morse_decode, caesar_decode, base58_decodemd5_hash, sha1_hash, sha256_hash, sha512_hashaes_encrypt, aes_decrypt, des_encrypt, des_decrypt, rsa_encrypt, rsa_decryptjwt_decode, jwt_encodeauto_decode (自动识别编码类型并解码)当遇到密码学攻击场景（已知加密算法，需要恢复明文或密钥）时，优先使用
ctf-cryptoSkill：
| 攻击场景 | 路由到 ctf-crypto | 参考文档 |
|---|---|---|
| RSA 小指数/共模/Wiener | ctf-crypto | references/rsa-attacks-cheatsheet.md |
| AES Padding Oracle/ECB 翻转 | ctf-crypto | references/aes-and-block-cipher-attacks.md |
| ECC 小子群/离散对数 | ctf-crypto | references/ecc-attacks-cheatsheet.md |
| PRNG/MT19937 预测 | ctf-crypto | references/prng-and-stream-cipher-attacks.md |
| 古典密码（Vigenere/XOR） | ctf-crypto | references/classic-cipher-attacks.md |
| 格攻击/LWE | ctf-crypto | references/lattice-and-lwe-attacks.md |
本 Skill 侧重编解码操作工具，密码学具体攻击方法和参数请参考 ctf-crypto。
references/encoding-cheatsheet.md — 编码识别速查表references/crypto-attacks.md — 密码学攻击手法references/crypto-attacks-roadmap.md — 密码学攻击分类路由（根据题目特征选择攻击方法）No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Assess AI agents and MCP tools for malicious instructions, tool misuse, permission violations, and data leaks. The skill organizes checks across applications, identity, data, deployment, and models, with references for each risk area.
Test Android app security by operating the app and inspecting network traffic first, then analyzing APK code or observing functions during execution when needed. Verify vulnerabilities and produce a report with screenshots, traffic evidence, and code review findings.
Analyze traffic from Android apps, browser JavaScript, and desktop clients to prepare requests for replay in Burp. Investigate signatures, encryption, and session dependencies when they block replay, and retain working request samples with supporting observations.
Analyze CTF cryptography challenges by identifying the cipher and matching known parameters to possible attacks. It provides formulas, attack parameters, and Python snippets for RSA, AES, elliptic curves, random number generators, classical ciphers, and lattice problems.
Find relevant references for CTF miscellaneous challenges, including restricted execution environments, layered encodings, hidden data in media, and game or virtual machine analysis. It also covers CTFd platform operations and Linux privilege escalation.
Solve CTF web challenges using concrete test inputs, request templates, and PHP code review checklists. The reference covers type comparisons, command injection, template injection, deserialization, source extraction, and common locations for challenge flags.