What problem does it solve? Cryptographic failures expose sensitive data, break authentication, and enable spoofing, yet they are easy to miss during a security assessment. This Skill provides a systematic methodology for auditing all four OWASP WSTG-CRYP test cases so testers can find weak transport security, padding oracles, cleartext data transmission, and broken encryption implementations. ## Core Features & Use Cases - TLS and Certificate Auditing: Enumerate protocol versions, cipher suites, certificate strength, HSTS, and mixed content issues against Mozilla and NIST baselines. - Padding Oracle Detection: Identify block-cipher encrypted values, tamper with ciphertext, and detect oracles through error messages, status codes, or timing differences. - Cleartext Channel and Weak Crypto Review: Find credentials or PII sent over HTTP, cookies missing the Secure flag, hardcoded secrets, and forbidden algorithms like MD5, DES, RC4, and ECB mode. - Use Case: During a web application penetration test, run the WSTG-CRYP-01 checks against every TLS endpoint, then grep the source code for MD5, ECB, and java.util.Random to prioritize manual testing of the highest-risk cryptographic code paths. ## Quick Start Use the wstg-weak-cryptography skill to audit the target application's TLS configuration and check for padding oracle vulnerabilities in its encrypted tokens.
