Encryption Quick Reference

# Base64 Encode/Decode
echo "text" | base64
echo "dGV4dAo=" | base64 -d

# Hex Encode/Decode
echo "text" | xxd -p
echo "74657874" | xxd -r -p

# URL Encode (Python)
python3 -c "import urllib.parse; print(urllib.parse.quote('test string'))"

# ROT13
echo "text" | tr 'A-Za-z' 'N-ZA-Mn-za-m'

# Generate Private Key & CSR
openssl req -newkey rsa:2048 -nodes -keyout domain.key -out domain.csr

# Self-Signed Certificate
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout domain.key -out domain.crt

# Encrypt file with AES-256-CBC
openssl enc -aes-256-cbc -salt -pbkdf2 -in plaintext.txt -out encrypted.enc

# Decrypt file
openssl enc -d -aes-256-cbc -pbkdf2 -in encrypted.enc -out decrypted.txt

# Encrypt with specific key/IV (hex)
openssl enc -aes-256-cbc -K <hex_key> -iv <hex_iv> -in file.txt -out encrypted.enc

# Crack SSH Key (John)
ssh2john id_rsa > hash.txt
john --wordlist=rockyou.txt hash.txt

# Crack Zip File
zip2john protected.zip > hash.txt
john --wordlist=rockyou.txt hash.txt

# Crack PDF
pdf2john protected.pdf > hash.txt

# Crack 7z Archive
7z2john protected.7z > hash.txt

# Crack KeePass Database
keepass2john Database.kdbx > hash.txt

# Crack Office Documents
office2john protected.docx > hash.txt

# Crack MD5
hashcat -m 0 hash.txt wordlist.txt

# Crack NTLM
hashcat -m 1000 hash.txt wordlist.txt

# Crack SHA256
hashcat -m 1400 hash.txt wordlist.txt

# Crack bcrypt
hashcat -m 3200 hash.txt wordlist.txt

# With Rules
hashcat -m 0 hash.txt wordlist.txt -r rules/best64.rule

# Kerberoast (TGS-REP)
hashcat -m 13100 tgs_hashes.txt wordlist.txt

# AS-REP Roast
hashcat -m 18200 asrep_hashes.txt wordlist.txt

# NetNTLMv2
hashcat -m 5600 ntlmv2_hashes.txt wordlist.txt

# MSSQL (2012+)
hashcat -m 1731 mssql_hashes.txt wordlist.txt

# MySQL (SHA1)
hashcat -m 300 mysql_hashes.txt wordlist.txt

# === IMAGE STEGANOGRAPHY ===
# Extract Data (Steghide)
steghide extract -sf image.jpg

# Extract Data (Binwalk)
binwalk -e image.jpg

# Zsteg (PNG analysis)
zsteg -a image.png

# Foremost (file carving)
foremost -i image.jpg -o output/

# Stegseek (fast steghide cracker)
stegseek image.jpg wordlist.txt

# Exiftool (metadata)
exiftool image.jpg

# Strings (hidden text)
strings -n 8 image.jpg

# === AUDIO STEGANOGRAPHY ===
# Sonic Visualizer - check spectrogram
# Audacity - Layer > Spectrogram view

# Decode SSTV (Slow-Scan TV)
sstv -d audio.wav -o output.png

# LSB audio extraction
python3 lsb_audio.py audio.wav

# Deepsound (Windows)
deepsound.exe -extract audio.wav

# === DECODE JWT (without verification) ===
# Header.Payload.Signature (base64url encoded)
echo "JWT_TOKEN" | cut -d. -f2 | base64 -d 2>/dev/null

# Python decode
import jwt
jwt.decode(token, options={"verify_signature": False})

# === COMMON JWT ATTACKS ===
# 1. Algorithm None Attack
# Change header: {"alg": "none"} and remove signature

# 2. Algorithm Confusion (RS256 → HS256)
# Sign with public key as HMAC secret

# 3. Weak Secret Brute Force
hashcat -m 16500 jwt.txt wordlist.txt
john jwt.txt --wordlist=wordlist.txt --format=HMAC-SHA256

# jwt_tool - Swiss army knife
jwt_tool TOKEN -C -d wordlist.txt  # Crack secret
jwt_tool TOKEN -X a                 # Algorithm none
jwt_tool TOKEN -I -pc name -pv admin  # Inject claim

# === USEFUL JWT TOOLS ===
# jwt.io - Online decoder
# jwt_tool - CLI manipulation
# c-jwt-cracker - Fast brute force

# === HASHING ===
import hashlib
hashlib.md5(b"text").hexdigest()
hashlib.sha256(b"text").hexdigest()

# === AES ENCRYPTION (PyCryptodome) ===
from Crypto.Cipher import AES
from Crypto.Random import get_random_bytes
key = get_random_bytes(32)  # AES-256
cipher = AES.new(key, AES.MODE_GCM)
ciphertext, tag = cipher.encrypt_and_digest(plaintext)

# === RSA ===
from Crypto.PublicKey import RSA
key = RSA.generate(2048)
pubkey = key.publickey().export_key()

# === BASE64 ===
import base64
base64.b64encode(b"text")
base64.b64decode(b"dGV4dA==")

# === PBKDF2 Key Derivation ===
from hashlib import pbkdf2_hmac
key = pbkdf2_hmac('sha256', password, salt, 100000)

# === RSA ATTACK TOOLS ===
# RsaCtfTool - Automated RSA attacks
python3 RsaCtfTool.py --publickey pub.pem --private

# With known n and e, try factorization
python3 RsaCtfTool.py -n <modulus> -e <exponent> --private

# === COMMON RSA WEAKNESSES ===
# Small e (e=3) with small message
# Wiener's Attack (small d)
# Fermat Factorization (p,q close together)
# Common Modulus Attack
# Hastad Broadcast Attack

# === EXTRACT RSA PARAMETERS ===
openssl rsa -pubin -in pub.pem -text -noout

# Python extract
from Crypto.PublicKey import RSA
key = RSA.import_key(open("pub.pem").read())
print(f"n={key.n}, e={key.e}")

# === FACTORDB ===
# factordb.com - Check if n is already factored

# === TESTSSL.SH ===
# Comprehensive SSL/TLS scanner
./testssl.sh https://target.com
./testssl.sh --severity HIGH target.com:443

# === SSLYZE ===
sslyze --regular target.com
sslyze --certinfo target.com

# === NMAP SSL SCRIPTS ===
nmap --script ssl-enum-ciphers -p 443 target.com
nmap --script ssl-heartbleed -p 443 target.com
nmap --script ssl-poodle -p 443 target.com

# === OPENSSL TESTING ===
# Check supported protocols
openssl s_client -connect target:443 -tls1_2
openssl s_client -connect target:443 -tls1_3

# Check certificate chain
openssl s_client -connect target:443 -showcerts

# Check for specific cipher
openssl s_client -connect target:443 -cipher 'RC4'