# Crypto Decode

> Cipher detection + automated decryption via Ciphey, Cyberchef recipes, hashcat hash-ID, format conversion, common encoding chains.

- Skill: `purpleailab/crypto-decode` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/crypto-decode`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/crypto-decode/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/crypto-decode

---


# Crypto / Decode Playbook

When you have unknown ciphertext (CTF flag, leaked DB field, captured
token, encoded payload), the right tool depends on the cipher class.

## 1. Identify FIRST

### Unknown text → automated cracker
```bash
# Ciphey — original (Python, slowed maintenance)
ciphey -t "$CIPHERTEXT"

# Ares — Rust rewrite (faster, current)
ares -t "$CIPHERTEXT"
```
A*-search across 16+ decoders (base64, base85, hex, Caesar, ROT-N,
Atbash, Vigenere, XOR-known-plaintext, URL encoding, binary, morse,
brainfuck, esolang, leetspeak, etc.) + BERT plaintext detector to know
when to stop.

### Hash → identify type
```bash
hashid -m '$2a$12$....'             # bcrypt 12 rounds
hashid -m '5f4dcc3b5aa765d61d8327deb882cf99'  # MD5
hash-identifier
```

### Specific format checks
```bash
# JWT
echo $TOKEN | cut -d. -f1-2 | tr '_-' '/+' | base64 -d 2>/dev/null

# Hex → bytes
echo "$HEX" | xxd -r -p

# Base64 → bytes (handle URL-safe)
echo "$B64" | tr '_-' '/+' | base64 -d 2>/dev/null

# Multi-encoded (unwind layers)
echo "$BLOB" | base64 -d | base64 -d | xxd -r -p
```

## 2. Classical cipher quick-checks

| Cipher | Signature |
|---|---|
| Base64 | `[A-Za-z0-9+/=]+`, len multiple of 4 |
| Base32 | `[A-Z2-7=]+` |
| Hex | `[0-9a-fA-F]+`, even length |
| Caesar/ROT | only A-Z + spaces, freq-attack ready |
| Vigenere | A-Z, multiple-of-key-length repeating bigrams |
| Substitution | A-Z, IC ≈ 0.066 (English) |
| Vernam/OTP | random-looking bytes, no statistical signal |
| XOR fixed-key | bytes w/ printable XOR'd against pattern (file headers leak) |
| Hill | small block size, matrix-based |

## 3. CyberChef recipe library

CyberChef (gchq.github.io/CyberChef) is the GUI workhorse but recipes
can be exported as JSON and chained programmatically:
```bash
# Common chains
"From Base64 / Magic / To Hex"
"From Hex / XOR (Brute) / Magic"
"AES Decrypt(KEY) / From Hex / Strings"
```

CLI version: `cyberchef-cli` (community port).

## 4. Hash cracking quick-ref

| Mode | Hash type |
|---|---|
| 0 | MD5 |
| 100 | SHA-1 |
| 1400 | SHA-256 |
| 1700 | SHA-512 |
| 1000 | NTLM |
| 13100 | Kerberos TGS-REP (etype 23) |
| 19700 | Kerberos TGS-REP (etype 18) |
| 18200 | Kerberos AS-REP |
| 16500 | JWT (HS256) |
| 3200 | bcrypt |
| 7400 | sha256crypt $5$ |
| 1800 | sha512crypt $6$ |
| 22000 | WPA-EAPOL+PMKID |
| 7100 | macOS v10.8+ (PBKDF2-SHA512) |
| 8200 | 1Password Cloud Keychain |

```bash
hashcat -m <mode> hashes.txt rockyou.txt -r best64.rule
john --format=<format> hashes.txt --wordlist=rockyou.txt
```

## 5. Token / blob unfolding workflow

For a mystery token captured in HTTP traffic:
```
1. ciphey/ares → reveal base layer
2. If structured (JSON / proto3 / msgpack) → parse
3. If still encoded → repeat step 1
4. Look for HMAC / signature suffix → identify symmetric key candidates
5. If symmetric encryption suspected → try AES-CBC/GCM w/ common keys
   (app-name, "secret", env vars exposed elsewhere)
```

## 6. Decepticon integration

Wrap as MCP tool:
```python
# decepticon/tools/crypto/decode.py — skeleton
def crypto_decode(ciphertext: str, hint: str = None, timeout: int = 30) -> dict:
    """Try ares first (fast), fallback to ciphey, return best decode."""
    import subprocess
    cmd = ["ares", "-t", ciphertext]
    if hint:
        cmd += ["--language", hint]
    r = subprocess.run(cmd, timeout=timeout, capture_output=True, text=True)
    return {
        "tool": "ares",
        "output": r.stdout,
        "confidence": _parse_ares_confidence(r.stdout),
    }
```

Promote to KG when classification succeeds:
```python
kg_add_node(kind="artifact", label=f"decoded:{hash}",
            props={"plaintext": result, "encoding_chain": chain})
```

## 7. Severity (depends on what was decoded)

| Decoded content | Severity |
|---|---|
| Plaintext password | Critical (depends on user role) |
| API key / private key | Critical |
| Internal hostname / IP | Medium |
| Session token | High-Critical |
| Encryption key | Critical |

## Cross-references
- Upstream: https://github.com/bee-san/Ciphey, https://github.com/bee-san/Ares
- JWT-specific (different layer): `skills/exploit/web/jwt/SKILL.md`
- AD hashes: `skills/ad/dcsync/SKILL.md`

## Known exemplars
- CTF flag formats (90% are base64, hex, or rot-N layers)
- Mobile reverse engineering: API keys often base64-XORed in strings
- IoT firmware: AES-CBC w/ hardcoded keys recoverable via Ciphey + ghidra
- Phishing email obfuscation: nested encoding chains common