Pentest
  • Homepage
  • Pentest Links
  • 01 Prep
    • Target Inventory
    • OSINT and Dorks
    • Recon-ng dns zone snoop
    • ❤️Gitbook
  • 02 Scan
    • *Favorites
    • Burp
    • Dirb nikto wpscan etc
    • Enum Finger and Brute SSH
    • Fuzzing
    • Nmap
    • Open Port Checks OneLiner
    • Port Knocking
    • SSL Issues
    • Tcpdump
  • 03 Getting In
    • Char Evasion Tricks
    • Email SMTP
    • Eternal Blue
    • FTP
    • heartbleed
    • Metasploit
    • MySql
    • NFS
    • Oracle
    • Postgres
    • PowerShell Empire
    • Shells
    • rpc
    • SMB Samba
    • SSH Tips
    • SQLite3
    • Veil
  • 04 WebApps
    • Apache
    • Blogs
    • Coldfusion
    • Content Management (CMS)
    • Drupal
    • Elastix FreePBX
    • HttpFileServer (HFS)
    • IIS
    • IIS6 WebDav
    • Local File Inclusion (LFI)
    • Magento
    • Nagios
    • PFSense
    • php
    • php type juggling
    • phpLite
    • Web Injections
    • Javascript
    • Shellshock
    • SQL Injections (sqli)
    • SQLMap
    • WAF
    • Webmin
    • Web Scrape
    • Wordpress
  • 05 Passwords & Ciphers
    • Cipher Decrypt
    • Cipher RSA Wiener P-Q-E
    • Cracking
    • Dict Guess List Mangle
    • Get Hashes
    • Hydra Brutes
    • Images Exif Steg
    • Malware Analysis
    • Pull Hashes PCredz
    • SSH PrivKey Passphrase
    • Unzip Crack
    • Windows PW
  • 06 Linux PrivEsc
    • 1 Look Around
    • 2 Enums
    • 3 PrivEsc
    • 4 Kernel Exploits
    • 5 Looting
    • binaries
    • Buffer Overflow
    • bash prison
    • Monitor Files
    • mongodb node
    • Pivots
    • Remote Execute
    • Shell TTY Fix
    • TAR backups
    • Transfer Files
    • vnc
  • 07 Windows PrivEsc
    • 1 Windows cmd kungfu
    • 2 Enums
    • 3 PrivEsc
    • 4 Kernel Exploits
    • 5 Looting
    • Bloodhound
    • DLL Hijack MSF
    • Kerberos
    • Memory Analysis
    • NTDS
    • Powershell
    • Responder
    • Saved Creds runas
Powered by GitBook
On this page
  • Identify:
  • CyberChef
  • MD5 Decrypt
  • Encode-to-Copy
  • Encrypt with OpenSSL
  • Decrypt OpenSSL
  • Substitution Cipher
  • Caesar Cipher (ROT13)
  • Base64
  • Uudecode
  • Hex
  • GPG Keys
  • holiday hack 2020
  • RSA Wiener
  • bash loop base64
  • python loop base64

Was this helpful?

  1. 05 Passwords & Ciphers

Cipher Decrypt

Identify:

  • https://www.boxentriq.com/code-breaking/cipher-identifier

CyberChef

  • https://gchq.github.io/CyberChef/

MD5 Decrypt

  • https://md5decrypt.net/en/

cat data.txt | base64 -d  ..decode

Encode-to-Copy

Encode:
cat /home/lara/.gnupg/secring.gpg | gzip | base64
H4sIAGpz0l8AAwEbBeT6lQHhBEfYL10RBACMAcvxnrh7A6s3S...

Decode:
echo 'H4sIAG...' | base64 -d | gzip -d > secring.gpg

Encrypt with OpenSSL

  • https://thelinuxcode.com/encrypt-decrypt-files-openssl/

> openssl enc -aes256 -k MyPaxxKey -in /tmp/backup.tgz  -out /tmp/backup.tgz.enc

Decrypt OpenSSL

> openssl enc -d -aes-256-cbc -in secret.txt.enc -out -secret.txt
> openssl enc -d -aes-256-cbc -k MyPaxxKey -in /tmp/backup.tgz.enc -out /tmp/backup.gz
> gunzip /tmp/backup.gz 
> cat /tmp/backup

Substitution Cipher

You have the Encryption AND Decryption .. but need the KEY https://www.boxentriq.com/code-breaking/cryptogram Example: Brainfuck:

IB EVMJGASVCJNM, C TRKTGIGRGIAB EIJNPV IT C OPGNAZ AQ PBEVMJGIBS KM YNIEN RBIGT AQ JWCIBGPHG CVP VPJWCEPZ YIGN EIJNPVGPHG, CEEAVZIBS GA C QIHPZ TMTGPO; GNP "RBIGT" OCM KP TIBSWP WPGGPVT (GNP OATG EAOOAB), JCIVT AQ WPGGPVT, GVIJWPGT AQ WPGGPVT, OIHGRVPT AQ GNP CKAXP, CBZ TA QAVGN. GNP VPEPIXPV ZPEIJNPVT GNP GPHG KM JPVQAVOIBS GNP IBXPVTP TRKTGIGRGIAB. GNP QWCS IT CTIOJWPTRKTGIGRGIAB
in cryptography a substitution cipher is a method of encrypting by which units of plaintext are replaced with ciphertext according to a fixed system the units may be single letters the most common pairs of letters triplets of letters mixtures of the above and so forth the receiver deciphers the text by performing the inverse substitution the flag is asimplesubstitution

Key = fuckmybrain

Caesar Cipher (ROT13)

rotated 13 positions
lowercase and uppercase letters are 
> cat data.txt | tr a-zA-Z n-za-mN-ZA-M

Base64

  • https://www.base64decode.org

  • https://www.base64encode.org

Example: ISwwYGAKYAo%3D

Uudecode

  • https://www.textencode.com/decoder/uudecodeDecoder

  • https://www.textencode.com/encoder/uuencodeEncoder

Example: !,@``
Hint: A(&%N9"`Q/3(@=6YI;VX@86QL('-E;&5C="`Q+#(L,RTM

Hex

  • Convert Hex > Text

  • https://conv.darkbyte.ru

  • https://www.binaryhexconverter.com/hex-to-ascii-text-converter

GPG Keys

Found:
/home/kate/.gnupg/secring.gpg

Encode-to-Copy:
> cat /home/kate/.gnupg/secring.gpg | gzip | base64
XYZ123...

Decrypt Method:
> echo 'XYZ123...' | base64 -d | gzip -d > secring.gpg

Copy into YOUR directory (win/lin), So you can decrypt

Windows:
c:\users\name\AppData\Roaming\gnupg\pubring.gpg
c:\users\name\AppData\Roaming\gnupg\secring.gpg

Linux:
/home/name/.gnupg/pubring.gpg
/home/name/.gnupg/secring.gpg

Verify keys:
gpg --list-keys
gpg --list-secret-keys

Windows:
Run gpg exe from:
c:\Program Files (x86)\GNU\GnuPG

Decrypt:
gpg -d -o outputfile encryptedfilename
gpg -d -o pii.csv pii.csv.gpg

-d decrypt
-o output filename

You need a passphrase to unlock the secret key for
user: "Kate <kate@domain.tgt>"
kate:passwurd
Decrypted!!

holiday hack 2020

unzip, bzip2, tar, xxd, xz, uncompress, cat, win !!!

cat packagev1 | base64 -d > packagev2
file packagev2  ...Zip archive data
unzip packagev2
file package.txt.Z.xz.xxd.tar.bz2  ..bzip2 compressed data,
bzip2 -d package.txt.Z.xz.xxd.tar.bz2 
file package.txt.Z.xz.xxd.tar  ..POSIX tar archive
tar -xvf package.txt.Z.xz.xxd.tar 
file package.txt.Z.xz.xxd      ..ASCII text
xxd ..is a hexdump tool
xxd -r package.txt.Z.xz.xxd > package.txt.Z.xz
file package.txt.Z.xz  ..XZ compressed data
xz --decompress package.txt.Z.xz
file package.txt.Z     ..compressd data 16 bits
uncompress package.txt.Z
cat package.txt
North Pole: The Frostiest Place on Earth
Win!!

RSA Wiener

  • REF: rsa-wiener-attack

  • REF: BrainfuckHTB

decrypt given p, q and e
final: python
convert to hex, then ascii
> pt = 123
> str(hex(pt))
> str(hex(pt)[2:-1]).decode('hex')
flag!

bash loop base64

for i in $ seq(0 9); do echo -n '| base64-d';done
cat pwdbackup.txt | base64 -d | etc...

python loop base64

  • Decode base64 for 10 times!!

  • REF: poisonHTB, PythonBrutes

import base64
inp_string = "Vm0wd2QyUXlVWGxWV0d4WFlURndVRl="
times = 10
for i in range(times):
    inp_string = base64.b64decode(inp_string)
out_string = inp_string.decode('UTF-8')
print(out_string)
Previous05 Passwords & CiphersNextCipher RSA Wiener P-Q-E

Last updated 2 years ago

Was this helpful?