Cryptography in Competitions

Scope

What this is: Breaking weak cryptographic implementations, cracking password hashes, and exploiting encryption flaws.

Competition relevance: Offensive operations (red team CTF). Common for password hash cracking and weak cipher challenges.

Why it matters: Weak cryptography is a common vulnerability. Password cracking often unlocks additional access or flags. Demonstrates understanding of cryptographic security.

WSOS 2026 alignment: This topic directly supports Section 6: Operations and management (breaking weak cryptographic implementations).

Competition area: Core to the offensive operations area, where you identify and exploit weak cryptography, crack password hashes, and break encryption implementations.

Offline competence: Password cracking tools (hashcat, john, hydra) work offline with local wordlists (rockyou.txt, SecLists). Hash identification (hash-identifier, hashid) works offline. Cryptographic analysis tools (openssl, base64) are built-in. Maintain offline wordlists and rainbow tables for common hash types.

Competency Matrix

Level	Expectation
Regional	Recognize base64, ROT13. Understand encoding != encryption.
National	Hash identification. Basic cracking. Cipher recognition.
Squad/Team Selection	Advanced ciphers. Custom crypto analysis.

---

Technical Content

Encoding vs Encryption

Encoding (reversible without key):

• Base64: SGVsbG8gV29ybGQ=
• Hex: 48656c6c6f20576f726c64
• ROT13: Uryyb Jbeyq
• URL encoding: %48%65%6C%6C%6F

Encryption (requires key):

• AES, DES, RSA
• Hashing (one-way): MD5, SHA1, SHA256

Detect encoding:

# Base64 (ends with = or ==)
echo "SGVsbG8=" | base64 -d

# Hex (0-9, a-f characters)
echo "48656c6c6f" | xxd -r -p

# ROT13
echo "Uryyb" | tr 'A-Za-z' 'N-ZA-Mn-za-m'

---

Hash Cracking

Identify hash type:

hash-identifier
hashid hash.txt

Common hashes:

• MD5: 32 hex chars
• SHA1: 40 hex chars
• SHA256: 64 hex chars

Crack with hashcat:

hashcat -m 0 hash.txt wordlist.txt  # MD5
hashcat -m 100 hash.txt wordlist.txt  # SHA1
hashcat -m 1400 hash.txt wordlist.txt  # SHA256

Online tools:

• CrackStation
• Hashes.com

---

Weak Crypto

Caesar cipher:

• Shift each letter by N positions
• Try all 26 possibilities

XOR:

• Single-byte XOR: Try all 256 keys
• xortool for automated analysis

---

Competition Strategy & Marking

What gets marked:

• See specific task requirements

Evidence and reporting requirements: Evidence and reporting requirements:

• Screenshot showing hash or ciphertext to be attacked (hash value, hash type, encrypted data)

• Hash type correctly identified (hash-identifier, hashid output, or manual identification)

• Screenshot showing cracking tool in action (hashcat or john command with parameters, wordlist used)

• Screenshot showing successfully cracked plaintext password or decrypted data

• Time taken to crack (hashcat time output) and resources used (wordlist, rules, hardware)

• For weak encryption: screenshot showing decryption method, key discovery, and plaintext result

• Written explanation of cryptographic weakness exploited (short key length, weak algorithm, no salt)

• Clear file naming: crypto_hash_ntlm.png, crypto_hashcat_cracking.png, crypto_cracked_plaintext.png

• Identify encoding first (base64, hex)

• Decode everything before assuming encryption

• Hash cracking: try wordlists first

• Don’t spend >15 minutes on crypto (low marks)

Time-boxed drill suggestion: 30-minute cryptography challenge: Given a collection of password hashes (MD5, SHA1, NTLM, bcrypt with varying difficulties), identify each hash type using hashid, crack fast hashes using hashcat with rockyou.txt wordlist, identify any weak encryption schemes (Base64, ROT13, Caesar cipher, XOR with short key), decrypt or break the weak ciphers, and document all findings with cracked passwords and attack methods used. This drill should be completable entirely offline with pre-downloaded wordlists and local hashcat installation.

---

False Flags / Wrong Paths

Common Traps

Time-consuming rabbit holes If a single approach takes more than the allocated time-box, reassess and try alternative methods or move to next task.

Over-complication Competition scenarios test core skills. If solution seems overly complex, look for simpler approach.

---

Practice Checklist

• Can complete core tasks without documentation
• Understand key concepts and techniques
• Can document findings with proper evidence format
• Can complete realistic scenarios within time limits

---

References

Primary references:

• WSOS 2026: the sections this page supports are listed under Scope
• Competition stage roadmap: See ../../00-roadmaps/[stage].md

Related topics in this knowledge base:

• Cross-reference related topics as appropriate

External resources (for offline preparation):

• Tool documentation: man pages, —help flags, /usr/share/doc
• Maintain offline copies of key references