flaghunter 0.1.0__tar.gz

flaghunter-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jake Burre
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

flaghunter-0.1.0/PKG-INFO

@@ -0,0 +1,64 @@
+Metadata-Version: 2.4
+Name: flaghunter
+Version: 0.1.0
+Summary: CTF crypto autosolver and pcap hunter. Point it at a challenge file or packet capture and it runs a full attack battery for you.
+Author: Jake Burre
+License: MIT
+Project-URL: Homepage, https://github.com/burrejak22/flaghunter
+Project-URL: Repository, https://github.com/burrejak22/flaghunter
+Keywords: ctf,crypto,pcap,forensics,security,codebreakers
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Information Technology
+Classifier: Topic :: Security
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cryptsmith>=0.1.0
+Dynamic: license-file
+
+# flaghunter
+
+Point it at a CTF crypto challenge or a packet capture and it runs a full attack battery for you, then writes up what it found.
+
+Built on [cryptsmith](https://github.com/burrejak22/cryptsmith), which does all the crypto and pcap heavy lifting. flaghunter is the analyst on top.
+
+## Install
+
+```bash
+pip install flaghunter
+```
+
+## Use
+
+```bash
+# throw a crypto challenge file at it
+flaghunter solve challenge.txt
+
+# hunt a pcap for enrollment keys, flags, and obfuscated blobs
+flaghunter pcap capture.pcap
+
+# custom token pattern, json output
+flaghunter pcap capture.pcap --pattern "FLAG\{[^}]+\}" --format json
+```
+
+## What the pcap hunter does
+
+1. Reassembles TCP streams from the capture
+2. Carves printable strings out of every stream
+3. Hunts tokens matching your pattern (default: 12 char alpha strings, like enrollment keys)
+4. Scores every stream for entropy, then runs single byte xor, repeating key xor, caesar, and layered base64/hex decoding on anything suspicious
+5. Writes a markdown report with stream labels, findings, and decoded candidates
+
+## What the solver does
+
+Reads a challenge file and runs the battery: encoding layers, xor attacks, classical ciphers, hash identification. Ranks everything by english score so the real answer floats to the top.
+
+## Example
+
+Say a capture has a server checking a 12 character alpha enrollment key, and the key is xor obfuscated in the traffic. flaghunter finds the stream, breaks the xor, and hands you the key.
+
+## License
+
+MIT

flaghunter-0.1.0/README.md

@@ -0,0 +1,44 @@
+# flaghunter
+
+Point it at a CTF crypto challenge or a packet capture and it runs a full attack battery for you, then writes up what it found.
+
+Built on [cryptsmith](https://github.com/burrejak22/cryptsmith), which does all the crypto and pcap heavy lifting. flaghunter is the analyst on top.
+
+## Install
+
+```bash
+pip install flaghunter
+```
+
+## Use
+
+```bash
+# throw a crypto challenge file at it
+flaghunter solve challenge.txt
+
+# hunt a pcap for enrollment keys, flags, and obfuscated blobs
+flaghunter pcap capture.pcap
+
+# custom token pattern, json output
+flaghunter pcap capture.pcap --pattern "FLAG\{[^}]+\}" --format json
+```
+
+## What the pcap hunter does
+
+1. Reassembles TCP streams from the capture
+2. Carves printable strings out of every stream
+3. Hunts tokens matching your pattern (default: 12 char alpha strings, like enrollment keys)
+4. Scores every stream for entropy, then runs single byte xor, repeating key xor, caesar, and layered base64/hex decoding on anything suspicious
+5. Writes a markdown report with stream labels, findings, and decoded candidates
+
+## What the solver does
+
+Reads a challenge file and runs the battery: encoding layers, xor attacks, classical ciphers, hash identification. Ranks everything by english score so the real answer floats to the top.
+
+## Example
+
+Say a capture has a server checking a 12 character alpha enrollment key, and the key is xor obfuscated in the traffic. flaghunter finds the stream, breaks the xor, and hands you the key.
+
+## License
+
+MIT

flaghunter-0.1.0/pyproject.toml

@@ -0,0 +1,34 @@
+[build-system]
+requires = ["setuptools>=61"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "flaghunter"
+version = "0.1.0"
+description = "CTF crypto autosolver and pcap hunter. Point it at a challenge file or packet capture and it runs a full attack battery for you."
+readme = "README.md"
+requires-python = ">=3.9"
+license = { text = "MIT" }
+authors = [{ name = "Jake Burre" }]
+keywords = ["ctf", "crypto", "pcap", "forensics", "security", "codebreakers"]
+dependencies = ["cryptsmith>=0.1.0"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Information Technology",
+    "Topic :: Security",
+    "Programming Language :: Python :: 3",
+    "License :: OSI Approved :: MIT License",
+]
+
+[project.scripts]
+flaghunter = "flaghunter.cli:main"
+
+[project.urls]
+Homepage = "https://github.com/burrejak22/flaghunter"
+Repository = "https://github.com/burrejak22/flaghunter"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

flaghunter-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

flaghunter-0.1.0/src/flaghunter/__init__.py

@@ -0,0 +1,6 @@
+"""flaghunter: CTF crypto autosolver and pcap hunter."""
+
+from . import cli, pcaphunt, solver
+
+__version__ = "0.1.0"
+__all__ = ["cli", "pcaphunt", "solver"]

flaghunter-0.1.0/src/flaghunter/cli.py

@@ -0,0 +1,61 @@
+"""flaghunter command line interface."""
+import argparse
+import sys
+
+from .pcaphunt import hunt_pcap, render_json, render_markdown
+from .solver import render_markdown as solve_markdown
+from .solver import solve_file
+
+
+def _cmd_solve(args: argparse.Namespace) -> int:
+    report = solve_file(args.file)
+    print(solve_markdown(report))
+    return 0
+
+
+def _cmd_pcap(args: argparse.Namespace) -> int:
+    try:
+        report = hunt_pcap(args.file, key_len=args.key_len, pattern=args.pattern)
+    except FileNotFoundError:
+        print(f"error: file not found: {args.file}", file=sys.stderr)
+        return 1
+    except ValueError as e:
+        print(f"error: {e}", file=sys.stderr)
+        return 1
+    if args.format == "json":
+        print(render_json(report))
+    else:
+        print(render_markdown(report))
+    return 0
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="flaghunter",
+        description="CTF crypto autosolver and pcap hunter. Runs the attack battery so you don't have to.")
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    solve = sub.add_parser("solve", help="run the attack battery against a challenge file")
+    solve.add_argument("file", help="challenge file to analyze")
+    solve.set_defaults(func=_cmd_solve)
+
+    pcap_cmd = sub.add_parser("pcap", help="hunt a packet capture for tokens and obfuscated blobs")
+    pcap_cmd.add_argument("file", help="pcap file to analyze")
+    pcap_cmd.add_argument("--key-len", type=int, default=12,
+                          help="length of alpha tokens to hunt (default 12)")
+    pcap_cmd.add_argument("--pattern", default=None,
+                          help="custom regex for token hunting, overrides --key-len")
+    pcap_cmd.add_argument("--format", choices=["md", "json"], default="md",
+                          help="report format (default md)")
+    pcap_cmd.set_defaults(func=_cmd_pcap)
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = build_parser()
+    args = parser.parse_args(argv)
+    return args.func(args)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

flaghunter-0.1.0/src/flaghunter/pcaphunt.py

@@ -0,0 +1,178 @@
+"""Pcap hunting: reassemble streams, find tokens, break obfuscated blobs.
+
+The main event for captures with custom protocols and hidden keys, like a
+distribution server checking a 12 character alpha enrollment key.
+"""
+import json
+from dataclasses import dataclass, field
+
+from cryptsmith import analysis, pcap, xor
+from cryptsmith import encoding as enc
+
+from .solver import analyze_blob
+
+
+@dataclass
+class StreamFinding:
+    stream: str
+    kind: str
+    detail: str
+    value: str
+    score: float = 0.0
+
+
+@dataclass
+class PcapReport:
+    source: str
+    streams: int
+    packets: int
+    findings: list[StreamFinding] = field(default_factory=list)
+
+
+def _summarize_stream(s: pcap.TCPStream) -> dict:
+    return {
+        "a_to_b_bytes": len(s.a_to_b),
+        "b_to_a_bytes": len(s.b_to_a),
+        "a_to_b_entropy": round(analysis.shannon_entropy(s.a_to_b), 2) if s.a_to_b else 0.0,
+        "b_to_a_entropy": round(analysis.shannon_entropy(s.b_to_a), 2) if s.b_to_a else 0.0,
+    }
+
+
+# words that suggest the decode is real protocol or challenge text, not luck
+_CONTEXT_KEYWORDS = {
+    "enroll", "key", "flag", "auth", "login", "password", "passwd", "token",
+    "secret", "challenge", "session", "crypto", "decrypt", "encrypt", "admin",
+    "server", "client", "hello", "welcome", "granted", "denied", "payload",
+}
+
+
+def _context_score(data: bytes) -> float:
+    """Score a decode context, tolerant of binary framing.
+
+    Plain english scoring plus a bonus when the context contains security
+    flavored words, which is a strong hint the xor key is right.
+    """
+    text = "".join(chr(b) for b in data if 32 <= b < 127)
+    if len(text) < 8:
+        return float("-inf")
+    score = analysis.english_score(text)
+    low = text.lower()
+    if any(w in low for w in _CONTEXT_KEYWORDS):
+        score += 50.0
+    return score
+
+
+def hunt_pcap(path: str, key_len: int = 12, pattern: str | None = None,
+              min_blob: int = 16) -> PcapReport:
+    """Analyze a pcap: token hunt plus attack battery on suspicious blobs."""
+    reader = pcap.PcapReader(path)
+    packets = sum(1 for _ in reader.packets())
+    streams = pcap.reassemble_streams(pcap.PcapReader(path))
+    report = PcapReport(source=path, streams=len(streams), packets=packets)
+
+    token_hunter = (lambda d: pcap.hunt_pattern(d, pattern)) if pattern else (
+        lambda d: pcap.hunt_alpha_tokens(d, length=key_len))
+
+    for s in streams:
+        payload = s.payload
+
+        # 1. token hunt on the raw payload
+        for token in token_hunter(payload):
+            report.findings.append(StreamFinding(
+                stream=s.label, kind="token",
+                detail=f"candidate {'custom pattern' if pattern else f'{key_len} char alpha'} token",
+                value=token, score=100.0))
+
+        # 2. interesting strings
+        strings = pcap.carve_strings(payload, min_len=6)
+        for st in strings:
+            for token in token_hunter(st.encode("latin1")):
+                if not any(f.value == token for f in report.findings):
+                    report.findings.append(StreamFinding(
+                        stream=s.label, kind="token",
+                        detail="token inside carved string", value=token, score=90.0))
+
+        # 3. attack battery per direction: encodings on strings, xor on opaque runs
+        for direction, blob in (("a->b", s.a_to_b), ("b->a", s.b_to_a)):
+            if len(blob) < min_blob:
+                continue
+            for st in pcap.carve_strings(blob, min_len=12):
+                for chain, decoded in enc.smart_decode(st.encode("latin1")):
+                    try:
+                        text = decoded.decode("utf-8", errors="strict").strip()
+                    except Exception:
+                        continue
+                    if len(text) >= 4 and all(32 <= ord(c) < 127 or c in " \t" for c in text):
+                        for token in token_hunter(text.encode("latin1")):
+                            report.findings.append(StreamFinding(
+                                stream=s.label, kind="decoded-token",
+                                detail=f"token after {chain} decode ({direction})",
+                                value=token, score=95.0))
+            # xor obfuscated token scan: finds 12+ alpha runs under any single
+            # byte xor key, even buried in mixed binary. O(n) bitmask scan.
+            # near miss keys cluster at the same offset, so group them into
+            # one finding per offset and let the analyst pick.
+            groups: dict[int, list[tuple[float, int, str]]] = {}
+            for offset, key, token in pcap.xor_token_scan(blob, min_length=key_len):
+                ctx = blob[max(0, offset - 24):offset + len(token) + 24]
+                ctx_pt = xor.xor_bytes(ctx, bytes([key]))
+                score = _context_score(ctx_pt)
+                groups.setdefault(offset, []).append((score, key, token))
+            for offset, cands in groups.items():
+                cands.sort(key=lambda c: -c[0])
+                lines = [f"0x{k:02x}: {t}" for _, k, t in cands]
+                best = cands[0][0]
+                report.findings.append(StreamFinding(
+                    stream=s.label, kind="xor-token",
+                    detail=(f"{len(cands)} xor keys yield {key_len}+ alpha runs "
+                            f"at offset {offset} ({direction})"),
+                    value="\n".join(lines), score=max(best, 1.0)))
+            # full solver battery as a last resort, strict threshold
+            if analysis.shannon_entropy(blob) > 5.5 and len(blob) >= 32:
+                for f in analyze_blob(blob, max_findings=3):
+                    if f.score > 40 and f.plaintext:
+                        report.findings.append(StreamFinding(
+                            stream=s.label, kind=f"auto-{f.method}",
+                            detail=f"{f.detail} ({direction})",
+                            value=f.plaintext[:200], score=min(f.score, 80.0)))
+
+    # dedupe, keep highest score per (stream, kind, value)
+    seen: dict[tuple, StreamFinding] = {}
+    for f in report.findings:
+        k = (f.stream, f.kind, f.value)
+        if k not in seen or f.score > seen[k].score:
+            seen[k] = f
+    report.findings = sorted(seen.values(), key=lambda f: -f.score)
+    return report
+
+
+def render_markdown(report: PcapReport) -> str:
+    lines = ["# flaghunter pcap report", "",
+             f"source: `{report.source}`",
+             f"packets: {report.packets}, tcp streams: {report.streams}", ""]
+    if not report.findings:
+        lines.append("no tokens or decodable blobs found.")
+        return "\n".join(lines)
+    lines.append(f"## findings ({len(report.findings)})")
+    lines.append("")
+    for i, f in enumerate(report.findings, 1):
+        lines.append(f"### {i}. [{f.kind}] {f.detail}")
+        lines.append(f"stream: `{f.stream}`")
+        lines.append("```")
+        lines.append(f.value)
+        lines.append("```")
+        lines.append("")
+    return "\n".join(lines)
+
+
+def render_json(report: PcapReport) -> str:
+    return json.dumps({
+        "source": report.source,
+        "packets": report.packets,
+        "streams": report.streams,
+        "findings": [
+            {"stream": f.stream, "kind": f.kind, "detail": f.detail,
+             "value": f.value, "score": round(f.score, 1)}
+            for f in report.findings
+        ],
+    }, indent=2)

flaghunter-0.1.0/src/flaghunter/solver.py

@@ -0,0 +1,123 @@
+"""Attack battery for crypto challenge files.
+
+Reads a challenge blob and runs every cheap attack, ranking results so the
+real answer floats to the top.
+"""
+from dataclasses import dataclass, field
+
+from cryptsmith import analysis, classical, encoding, hashid, xor
+
+
+@dataclass
+class Finding:
+    method: str
+    detail: str
+    plaintext: str
+    score: float
+
+
+@dataclass
+class SolveReport:
+    source: str
+    findings: list[Finding] = field(default_factory=list)
+
+    def top(self, n: int = 10) -> list[Finding]:
+        return sorted(self.findings, key=lambda f: -f.score)[:n]
+
+
+def _printable(data: bytes) -> str | None:
+    try:
+        text = data.decode("utf-8")
+    except Exception:
+        try:
+            text = data.decode("latin1")
+        except Exception:
+            return None
+    if not text or sum(32 <= ord(c) < 127 or c in "\n\r\t" for c in text) / len(text) < 0.85:
+        return None
+    return text
+
+
+def analyze_blob(data: bytes, max_findings: int = 25) -> list[Finding]:
+    """Run the full battery against one blob of bytes."""
+    findings: list[Finding] = []
+
+    def add(method: str, detail: str, raw: bytes):
+        text = _printable(raw)
+        if text is None:
+            return
+        score = analysis.english_score(text)
+        if score == float("-inf"):
+            return
+        findings.append(Finding(method, detail, text.strip()[:500], score))
+
+    # 1. layered encodings
+    for chain, decoded in encoding.smart_decode(data):
+        add("encoding", f"decoded via {chain}", decoded)
+
+    text = _printable(data)
+
+    # 2. hash id on standalone hex digests
+    if text:
+        for token in text.split():
+            names = hashid.identify(token.strip())
+            if names:
+                findings.append(Finding("hashid", f"{token.strip()[:64]} looks like {', '.join(names)}",
+                                        token.strip()[:200], 0.0))
+
+    # 3. single byte xor (worth trying on almost anything)
+    if len(data) >= 8:
+        for key, pt, score in xor.single_byte_xor_break(data, top=2):
+            if score > 5:
+                findings.append(Finding("xor", f"single byte key 0x{key:02x}", pt.decode("latin1").strip()[:500], score))
+
+    # 4. repeating key xor on longer blobs
+    if len(data) >= 60:
+        try:
+            for key, pt, score in xor.repeating_key_xor_break(data)[:2]:
+                if score > 20:
+                    findings.append(Finding("xor", f"repeating key {key!r}", pt.decode("latin1").strip()[:500], score))
+        except Exception:
+            pass
+
+    # 5. classical ciphers on texty input
+    if text and sum(c.isalpha() for c in text) / max(len(text), 1) > 0.6 and len(text) >= 20:
+        for shift, pt, score in classical.caesar_bruteforce(text, top=1):
+            if score > 5:
+                findings.append(Finding("caesar", f"shift {shift}", pt.strip()[:500], score))
+        for a, b, pt, score in classical.affine_bruteforce(text, top=1):
+            if score > 10:
+                findings.append(Finding("affine", f"a={a} b={b}", pt.strip()[:500], score))
+
+    # 6. notes on randomness
+    entropy = analysis.shannon_entropy(data)
+    if entropy > 7.5 and len(data) >= 32:
+        findings.append(Finding("note", f"high entropy ({entropy:.2f} bits/byte), likely encrypted or compressed",
+                                "", -100.0))
+
+    findings.sort(key=lambda f: -f.score)
+    return findings[:max_findings]
+
+
+def solve_file(path: str) -> SolveReport:
+    with open(path, "rb") as f:
+        data = f.read()
+    return SolveReport(source=path, findings=analyze_blob(data))
+
+
+def render_markdown(report: SolveReport) -> str:
+    lines = [f"# flaghunter solve report", "", f"source: `{report.source}`", ""]
+    if not report.findings:
+        lines.append("no promising findings. the blob resisted the battery.")
+        return "\n".join(lines)
+    lines.append(f"## top findings ({len(report.findings)})")
+    lines.append("")
+    for i, f in enumerate(report.top(), 1):
+        lines.append(f"### {i}. {f.method} (score {f.score:.1f})")
+        lines.append(f"*{f.detail}*")
+        if f.plaintext:
+            lines.append("```")
+            lines.append(f.plaintext)
+            lines.append("```")
+        lines.append("")
+    return "\n".join(lines)

flaghunter-0.1.0/src/flaghunter.egg-info/PKG-INFO

@@ -0,0 +1,64 @@
+Metadata-Version: 2.4
+Name: flaghunter
+Version: 0.1.0
+Summary: CTF crypto autosolver and pcap hunter. Point it at a challenge file or packet capture and it runs a full attack battery for you.
+Author: Jake Burre
+License: MIT
+Project-URL: Homepage, https://github.com/burrejak22/flaghunter
+Project-URL: Repository, https://github.com/burrejak22/flaghunter
+Keywords: ctf,crypto,pcap,forensics,security,codebreakers
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Information Technology
+Classifier: Topic :: Security
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cryptsmith>=0.1.0
+Dynamic: license-file
+
+# flaghunter
+
+Point it at a CTF crypto challenge or a packet capture and it runs a full attack battery for you, then writes up what it found.
+
+Built on [cryptsmith](https://github.com/burrejak22/cryptsmith), which does all the crypto and pcap heavy lifting. flaghunter is the analyst on top.
+
+## Install
+
+```bash
+pip install flaghunter
+```
+
+## Use
+
+```bash
+# throw a crypto challenge file at it
+flaghunter solve challenge.txt
+
+# hunt a pcap for enrollment keys, flags, and obfuscated blobs
+flaghunter pcap capture.pcap
+
+# custom token pattern, json output
+flaghunter pcap capture.pcap --pattern "FLAG\{[^}]+\}" --format json
+```
+
+## What the pcap hunter does
+
+1. Reassembles TCP streams from the capture
+2. Carves printable strings out of every stream
+3. Hunts tokens matching your pattern (default: 12 char alpha strings, like enrollment keys)
+4. Scores every stream for entropy, then runs single byte xor, repeating key xor, caesar, and layered base64/hex decoding on anything suspicious
+5. Writes a markdown report with stream labels, findings, and decoded candidates
+
+## What the solver does
+
+Reads a challenge file and runs the battery: encoding layers, xor attacks, classical ciphers, hash identification. Ranks everything by english score so the real answer floats to the top.
+
+## Example
+
+Say a capture has a server checking a 12 character alpha enrollment key, and the key is xor obfuscated in the traffic. flaghunter finds the stream, breaks the xor, and hands you the key.
+
+## License
+
+MIT

flaghunter-0.1.0/src/flaghunter.egg-info/SOURCES.txt

@@ -0,0 +1,14 @@
+LICENSE
+README.md
+pyproject.toml
+src/flaghunter/__init__.py
+src/flaghunter/cli.py
+src/flaghunter/pcaphunt.py
+src/flaghunter/solver.py
+src/flaghunter.egg-info/PKG-INFO
+src/flaghunter.egg-info/SOURCES.txt
+src/flaghunter.egg-info/dependency_links.txt
+src/flaghunter.egg-info/entry_points.txt
+src/flaghunter.egg-info/requires.txt
+src/flaghunter.egg-info/top_level.txt
+tests/test_flaghunter.py

flaghunter-0.1.0/src/flaghunter.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

flaghunter-0.1.0/src/flaghunter.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+flaghunter = flaghunter.cli:main

flaghunter-0.1.0/src/flaghunter.egg-info/requires.txt

@@ -0,0 +1 @@
+cryptsmith>=0.1.0

flaghunter-0.1.0/src/flaghunter.egg-info/top_level.txt

@@ -0,0 +1 @@
+flaghunter

flaghunter-0.1.0/tests/test_flaghunter.py

@@ -0,0 +1,106 @@
+import base64
+import os
+import struct
+import tempfile
+
+from cryptsmith import xor
+
+from flaghunter import pcaphunt, solver
+
+
+def _write(path, data: bytes):
+    with open(path, "wb") as f:
+        f.write(data)
+
+
+def _build_pcap(path, packets):
+    def frame(src_ip, dst_ip, sport, dport, seq, payload):
+        eth = b"\x00" * 12 + struct.pack("!H", 0x0800)
+        total = 20 + 20 + len(payload)
+        ip = struct.pack("!BBHHHBBH4s4s", 0x45, 0, total, 0, 0, 64, 6, 0,
+                         bytes(map(int, src_ip.split("."))), bytes(map(int, dst_ip.split("."))))
+        tcp = struct.pack("!HHIIHHHH", sport, dport, seq, 0, 0x5000, 0, 0, 0)
+        return eth + ip + tcp + payload
+
+    with open(path, "wb") as f:
+        f.write(struct.pack("<IHHIIII", 0xA1B2C3D4, 2, 4, 0, 0, 65535, 1))
+        for (s, sp, d, dp, seq, payload) in packets:
+            p = frame(s, d, sp, dp, seq, payload)
+            f.write(struct.pack("<IIII", 0, 0, len(p), len(p)) + p)
+
+
+def test_solver_breaks_single_byte_xor():
+    pt = b"the secret enrollment key is hidden right here in this message"
+    ct = xor.xor_bytes(pt, b"\x99")
+    with tempfile.NamedTemporaryFile(delete=False) as t:
+        _write(t.name, ct)
+        path = t.name
+    try:
+        report = solver.solve_file(path)
+        assert any(f.method == "xor" and "hidden right here" in f.plaintext
+                   for f in report.findings)
+    finally:
+        os.unlink(path)
+
+
+def test_solver_peels_base64_layers():
+    inner = base64.b64encode(b"flag{layered_encoding_win}").decode()
+    outer = base64.b64encode(inner.encode()).decode()
+    with tempfile.NamedTemporaryFile(delete=False, suffix=".txt") as t:
+        _write(t.name, outer.encode())
+        path = t.name
+    try:
+        report = solver.solve_file(path)
+        assert any(f.method == "encoding" and "flag{layered_encoding_win}" in f.plaintext
+                   for f in report.findings)
+    finally:
+        os.unlink(path)
+
+
+def test_pcap_hunt_finds_plaintext_enrollment_key():
+    with tempfile.NamedTemporaryFile(suffix=".pcap", delete=False) as t:
+        path = t.name
+    try:
+        _build_pcap(path, [
+            ("10.0.0.5", 1337, "10.0.0.9", 9000, 1, b"HELLO distsrv v1"),
+            ("10.0.0.5", 1337, "10.0.0.9", 9000, 17, b"ENROLL ZxCvBnMkLjHg"),
+            ("10.0.0.9", 9000, "10.0.0.5", 1337, 1, b"OK enrolled"),
+        ])
+        report = pcaphunt.hunt_pcap(path)
+        assert report.streams == 1
+        tokens = [f.value for f in report.findings if f.kind == "token"]
+        assert "ZxCvBnMkLjHg" in tokens
+    finally:
+        os.unlink(path)
+
+
+def test_pcap_hunt_breaks_xor_obfuscated_key():
+    key = b"QwErTyUiOpAs"
+    blob = xor.xor_bytes(b"enrollment key follows: " + key + b" end", b"\x42")
+    with tempfile.NamedTemporaryFile(suffix=".pcap", delete=False) as t:
+        path = t.name
+    try:
+        _build_pcap(path, [
+            ("10.0.0.5", 1337, "10.0.0.9", 9000, 1, b"\x01\x02hello"),
+            ("10.0.0.9", 9000, "10.0.0.5", 1337, 1, blob),
+        ])
+        report = pcaphunt.hunt_pcap(path)
+        values = [f.value for f in report.findings]
+        assert any("QwErTyUiOpAs" in v for v in values), values
+        kinds = [f.kind for f in report.findings if "QwErTyUiOpAs" in f.value]
+        assert "xor-token" in kinds
+    finally:
+        os.unlink(path)
+
+
+def test_pcap_hunt_custom_pattern():
+    with tempfile.NamedTemporaryFile(suffix=".pcap", delete=False) as t:
+        path = t.name
+    try:
+        _build_pcap(path, [
+            ("10.0.0.5", 1337, "10.0.0.9", 9000, 1, b"here is FLAG{you_found_me} bye"),
+        ])
+        report = pcaphunt.hunt_pcap(path, pattern=r"FLAG\{[^}]+\}")
+        assert any(f.value == "FLAG{you_found_me}" for f in report.findings)
+    finally:
+        os.unlink(path)