Skip to content
Get packs

Offensive Crypto Attacks

Find and exploit misused crypto in apps: padding oracles, ECB, weak MACs, RSA and PRNG flaws.

Source Download skill
Repository
SnailSploit/Claude-Red
Stars
10,230
Licence
MIT
Files
1 file

What it does

This skill gives an AI agent a structured playbook for finding and exploiting cryptographic mistakes in applications, such as encrypted cookies or signed tokens that developers implemented incorrectly. It covers attacks like padding oracle decryption, ECB block tricks, hash length extension, weak RSA setups, predictable random number generators and nonce reuse in AES-GCM. It also includes example code for padbuster and custom Python exploit scripts, and asks the agent to document root causes and fixes.

Great for

  • Security professionals doing authorized penetration tests or CTF challenges
  • Students learning how common crypto implementation bugs are exploited
  • Developers who want to understand attacks so they can audit their own code

Skip it if

  • Attacking systems you do not own or have written permission to test, because the techniques are illegal to use against third parties
  • Production-critical targets without a rules-of-engagement agreement, since the scripts send many crafted requests that can disrupt services

Try asking

  • “Test whether the session cookie on my staging app is vulnerable to a padding oracle attack and document the fix”
  • “Walk me through how ECB mode leaks data in this encryption oracle and write a byte-at-a-time decryption script”
  • “Check whether our API signs requests with a SHA256 MAC that is open to length extension and show the remediation”
  • “Review this RSA setup for small exponent or common modulus weaknesses and map findings to CWE-327”
Step-by-step guide: how to use Offensive Crypto AttacksInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    offensive-crypto-attacks.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip offensive-crypto-attacks.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip offensive-crypto-attacks.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use it against systems you are authorized to test, and state the scope in your prompt so the agent stays within it
  • Give the agent the exact token or ciphertext format and any error responses so it can identify the oracle quickly
  • Ask for the remediation section too, such as switching to AES-GCM with random IVs and constant-time comparisons, so the output is useful for fixing the bug

What's inside

  • SKILL.md

Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.