skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

hash-attack-techniques

Select and apply hash attack methods for security testing scenarios.

2|Updated May 15, 2026
Search Tags:#collision#ctf#proof of work#cryptanalysis#hash attacks#hmac timing#length extension
One-click install
npx skills add https://github.com/lNwNl/Methodos --skill hash-attack-techniques
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hash-attack-techniques
Source: https://github.com/lNwNl/Methodos/tree/main/docker/opencode/skills/hash-attack-techniques
Command: npx skills add https://github.com/lNwNl/Methodos --skill hash-attack-techniques

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you choose and apply correct cryptanalytic techniques when a system is weakened by hashing, collisions, length-extension properties, timing leaks, or proof-of-work constraints.

Core Features & Use Cases

  • Attack selection by scenario: Quickly map an observed hashing pattern (e.g., H(secret||msg), collisions, truncated hashes, PoW) to the right attack class.
  • Practical exploit playbooks: Apply length extension guidance for Merkle–Damgård hashes, MD5/SHA-1 collision workflows, birthday-bound reasoning for truncated outputs, and meet-in-the-middle concepts.
  • HMAC and side-channel strategy: Identify when extension does not apply to HMAC and instead pivot to timing attack methodology or constant-time defenses.

Quick Start

Give the AI the hash type, what you know (e.g., MAC = H(secret||msg) with message and MAC), and the goal (e.g., forge a valid extended message), then ask it to produce the correct attack steps and tool commands for that exact scenario.

Frequently Asked Questions about hash-attack-techniques

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform a hash length extension attack on a Merkle–Damgård construction?▼

To perform a hash length extension attack on a Merkle–Damgård construction, you use a known MAC like H(secret||msg) to forge a valid extended message. This technique exploits the sequential block processing to append data without knowing the original secret.

When does a hash length extension attack not work?▼

A hash length extension attack does not work against HMAC constructions because HMAC's non-extensibility properties prevent appending data. Instead, you must pivot to analyzing HMAC timing side channels or evaluating constant-time defense mechanisms.

How do I generate MD5 or SHA-1 hash collisions for a CTF challenge?▼

You generate MD5 or SHA-1 hash collisions by applying dedicated cryptanalytic workflows that produce two distinct inputs sharing the same digest. These collision generation techniques exploit known weaknesses in the algorithm's internal state diffusion.

What is the best way to find collisions in truncated hash outputs?▼

The best way to find collisions in truncated hash outputs is applying birthday-bound collision search reasoning. This approach calculates the probability of finding matching truncated digests based on the reduced output bit length.

How do I solve proof-of-work challenges in CTF competitions?▼

You solve proof-of-work challenges by brute-forcing input values until the resulting hash meets specific target constraints, such as leading zeros. This requires selecting correct tools to compute hash iterations efficiently within feasible time limits.

Related Skills

Explore More Legal & Compliance Skills→
Prohao42Prohao42
120

hash-attack-techniques

Identify hash construction weaknesses for authorized cryptanalysis and attack simulations.

Community
Advanced
Carlos-Reyes-UTPCarlos-Reyes-UTP
2

hunt-business-logic

Identifies business logic vulnerabilities in web application workflows.

Community
Advanced
dakshrawat298-gifdakshrawat298-gif

constant-time-testing

Audit cryptographic implementations for timing side-channel leaks using dudect and timecop.

Community
Advanced
DorianGalloDorianGallo
5

hash-attack-techniques

Plan hash and MAC attacks for CTFs and authorized security testing.

Community
Advanced