classical-cipher-analysis

What problem does it solve?

This Skill helps analysts and CTF players rapidly identify and break classical substitution, polyalphabetic, transposition, and XOR-based ciphers so they avoid misclassification and wasted effort on incorrect attack paths.

Core Features & Use Cases

• Cipher identification: charset inspection, frequency distribution, index of coincidence (IC), and Kasiski examination to determine encoding and cipher family.
• Targeted attack methods: procedures for Caesar/ROT, monoalphabetic substitution (frequency & crib-dragging), Vigenere (IC + per-column Caesar), affine brute force, Hill known-plaintext recovery, Playfair, Polybius, rail-fence and columnar transposition techniques, and single/repeating-key XOR handling.
• Tool and automation guidance: recommended workflows integrating CyberChef, dcode.fr, quipqiup, xortool and Python scripts for reproducible, scripted analysis.
• Use case: Given ciphertext from a CTF challenge or forensic artifact, determine whether it is encoded (base64/hex), monoalphabetic, polyalphabetic, transposed, or XOR-obfuscated and apply the appropriate decryption path.

Quick Start

Run a charset check, compute the index of coincidence, run Kasiski if IC suggests polyalphabetic encryption, and then apply frequency analysis, Caesar brute-force, or per-column Vigenere cracking to recover plaintext.