skills.rest
sayseven7
sayseven7COMMUNITY
Explore all skills by this author →
WebsiteGitHub

hash-attack-techniques

Identify hash-based attack opportunities in authorized security testing.

11|4|Updated Jun 7, 2026
Search Tags:#proof-of-work#cryptanalysis#length-extension#md5-collision#hmac-timing#birthday-attack
One-click install
npx skills add https://github.com/sayseven7/frameseven --skill hash-attack-techniques-sayseven7
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hash-attack-techniques
Source: https://github.com/sayseven7/frameseven/tree/main/internal/mcp/skills/hash-attack-techniques
Command: npx skills add https://github.com/sayseven7/frameseven --skill hash-attack-techniques-sayseven7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you identify and exploit weaknesses in hash-based security designs, especially when a system relies on fragile comparisons, weak MAC construction, or outdated collision-resistant assumptions.

Core Features & Use Cases

  • Length Extension Analysis: Determine when secret-prefix MACs can be extended and how to forge valid-looking messages.
  • Collision and Timing Attacks: Work through MD5 and SHA-1 collision scenarios, HMAC timing leaks, birthday attacks, and proof-of-work challenges.
  • Use Case: If a CTF service compares md5 values loosely or a legacy application uses SHA-1 or raw hashes for integrity, this Skill helps you choose the right attack path and avoid common cryptography mistakes.

Quick Start

Ask the Skill to analyze the hash scheme, select the correct attack class, and outline the exact authorized testing steps or proof-of-concept needed for the target.

Frequently Asked Questions about hash-attack-techniques

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for length extension attacks on secret-prefix MACs?▼

Length extension attacks exploit secret-prefix MACs by appending forged data to a valid hash without knowing the secret. This Skill identifies vulnerable constructions and outlines the exact authorized testing steps needed to exploit them.

What is the best way to generate MD5 and SHA-1 collisions for security testing?▼

MD5 and SHA-1 collisions occur when two distinct inputs produce identical hash outputs. This Skill guides you through collision scenarios and helps select the correct attack path for testing legacy application integrity.

How do HMAC timing leaks expose hash-based authentication?▼

HMAC timing leaks expose authentication flaws when hash comparisons execute in non-constant time, revealing valid prefixes. This Skill analyzes HMAC timing attacks and recommends constant-time comparison defenses to secure the design.

When do I need birthday attacks and meet-in-the-middle searches for proof-of-work?▼

Birthday attacks and meet-in-the-middle searches are needed for proof-of-work challenges requiring partial hash collisions. This Skill determines when these cryptanalytic approaches apply and provides exploit outlines for authorized testing.

Why does SHA-3 avoid length extension attacks and other hash vulnerabilities?▼

SHA-3 avoids length extension attacks because its sponge construction prevents appending data to an existing hash output. This Skill provides defensive distinctions for SHA-3, HMAC, and constant-time comparison against non-vulnerable constructions.

Related Skills

Explore More Software Engineering Skills→
DorianGalloDorianGallo
5

hash-attack-techniques

Plan hash and MAC attacks for CTFs and authorized security testing.

Community
Advanced
ApegurusApegurus
1

exploit-reference

Index major DeFi exploits with vulnerability patterns and Foundry PoCs.

Community
Intermediate
ok-helloworldok-helloworld
241

type-juggling

Probe PHP loose comparisons to verify authentication and signature bypasses.

Community
Advanced
hypnguyen1209hypnguyen1209
338

crypto-analysis

Identify cryptographic weaknesses in implementations, TLS configurations, and hash practices.

Community
Advanced