skills.rest
warterbili
warterbiliCOMMUNITY
Explore all skills by this author →
Website𝕏@lsdwaterbiliGitHub

castle-reverse

Reverse Castle.io request token algorithms for Android and web platforms.

Updated Aug 27, 2026
Search Tags:#web-security#frida#token-generation#anti-bot#castle-io#token-reversal#android-reversing
One-click install
npx skills add https://github.com/warterbili/AUTO_REVERSE --skill castle-reverse
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: castle-reverse
Source: https://github.com/warterbili/AUTO_REVERSE/tree/main/skills/web/castle-reverse
Command: npx skills add https://github.com/warterbili/AUTO_REVERSE --skill castle-reverse

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill eliminates the need for manual, undocumented reverse-engineering of Castle.io anti-bot SDKs to access or reproduce their request tokens, which are required to bypass or integrate with Castle-protected applications and websites.

Core Features & Use Cases

  • Full Android v3.1.1 (Highwind) Token Reverse-Engineering: Complete documentation of the obfuscated token generation logic, including the 3-layer nibble-XOR crypto scheme and 38-field device fingerprint collection, with no reliance on XXTEA encryption used in older web versions.
  • Web SDK v2.6.0 Support: Includes an archived open-source reimplementation of the web/JS SDK token v11 algorithm for browser-based Castle.io integration.
  • Ready-to-Use Tooling: Provides offline token generators, decoders, and Frida hooks for live token capture and byte-exact verification of reversed logic.
  • Use Case: For example, a security tester can use this Skill to generate valid X-Castle-Request-Token values for an Android app using Castle.io protection, without sending requests to the live Castle Risk API.

Quick Start

Use the castle-reverse skill to generate a valid X-Castle-Request-Token for a target Android app by providing its publishable key and the device's captured fingerprint field values.

Frequently Asked Questions about castle-reverse

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate a Castle.io request token offline for an Android app?▼

You can generate a Castle.io request token offline by using the reversed Android v3.1.1 Highwind algorithm with the target's publishable key and 38 captured device fingerprint fields, bypassing the official Castle Risk API entirely.

What is the X-Castle-Request-Token generation logic in the Android SDK?▼

The X-Castle-Request-Token generation logic in Android SDK v3.1.1 uses a 3-layer nibble-XOR crypto scheme combined with 38-field device fingerprint collection, replacing the XXTEA encryption seen in older web versions.

Can I reproduce Castle.io anti-bot tokens for web platforms without the official SDK?▼

Yes, you can reproduce Castle.io anti-bot tokens for web platforms using an archived open-source reimplementation of the web/JS SDK token v11 algorithm for browser-based integration and security testing.

Does this approach support live capture and verification of Castle.io tokens?▼

Yes, this approach supports live capture and byte-exact verification of Castle.io tokens through provided Frida hooks, allowing you to intercept and validate the reversed token logic on active Android applications.

What do I need to provide to use a Castle.io token generator for security testing?▼

To use the Castle.io token generator for security testing, you need to provide the target application's publishable key and the captured device fingerprint field values to produce valid X-Castle-Request-Token and x-castle-client-id headers.

Related Skills

Explore More Software Engineering Skills→
alexfazioalexfazio
159

cc-trace

Intercept and inspect Claude Code API traffic using mitmproxy.

Community
Advanced
888BasedGod-sol888BasedGod-sol
14

claudecraft

Coordinate Claude agents and helper bots to automate Minecraft structure building.

Community
Intermediate
hardw00thardw00t
90

android-pentest

Automate Android app pentesting with static APK analysis and Frida instrumentation.

Community
Advanced
jackspacejackspace
16

api-integration-builder

Generate TypeScript API clients with authentication, retry logic, and rate limiting.

Community
Advanced