Advanced › Module 4 › Lesson 2
XOR CTF
XOR CTF literacy names single-byte and repeating-key XOR breaks — solvers on YOUR $CRYPTO_LAB toys only.
Visual · t28_xor_ctf
XOR CTF literacy. $CRYPTO_LAB only. Original Cyberlium.
Opening
XOR feels simple until keys repeat — CTF solvers score flags on bytes YOU generated, not production firmware you stole.
Single-byte XOR: try 256 keys, score English frequency. Repeating-key XOR: guess key length via Hamming distance or coincidence, then column-wise single-byte break — classic Cryptopals-style literacy on toy blobs. XOR alone is not encryption for real data. Cyberlium runs XOR solvers on YOUR $CRYPTO_LAB files — hex blobs you created, course flags — never firmware dumps or stranger captures without written scope. Next: Freq Analysis Lab.
1. XOR break patterns (named, lab toys)
Single-byte: brute 0x00–0xFF, score with ETAOIN letter frequencies. Repeating-key: estimate period, split columns, break each as Caesar-like XOR. Many CTF flags hide in English plaintext after break.
On $CRYPTO_LAB, generate repeating-key XOR of a sentence YOU wrote — solve your own toy to confirm workflow.
Command guide
Try these commands — XOR break patterns (named, lab toys)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Vigenère literacy — https://cryptopals.com/ (classical crypto context) Frequency analysis — https://en.wikipedia.org/wiki/Frequency_analysis (concept only) CWE-327 — https://cwe.mitre.org/data/definitions/327.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export CRYPTO_LAB=${CRYPTO_LAB:-$HOME/cyberlium-lab/t28-crypto}
python3 - <<'PY'
def vigenere(text, key):
out, ki = [], 0
for c in text:
if 'A' <= c <= 'Z':
k = ord(key[ki % len(key)].upper()) - 65
out.append(chr((ord(c)-65+k)%26+65)); ki += 1
else: out.append(c)
return ''.join(out)
plain = 'ATTACKATDAWN'
key = 'LEMON'
print(f'Plain: {plain}')
print(f'Vigenere: {vigenere(plain, key)} (YOUR lab string only)')
PYCommand — copy this
grep YOUR "$CRYPTO_LAB/data/demo.txt"
Primary tools to practice this lesson: python3, grep. Reference sites: Vigenère literacy (https://cryptopals.com/); Frequency analysis (https://en.wikipedia.org/wiki/Frequency_analysis); CWE-327 (https://cwe.mitre.org/data/definitions/327.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why XOR CTF teaches modern mistakes
Developers XOR files with short passwords — defender finding class. Stream ciphers properly use CSPRNG keystreams — XOR literacy shows why key reuse kills confidentiality.
One-time pad is theoretically secure only with true random key as long as message — rarely achieved in software shortcuts.
3. CTF scope boundary
Forbidden: XOR-breaking scraped firmware, competitor binaries, or private files without authorization. Allowed: XOR CTF card — toy filename, key length, solver steps summary, flag recovered from YOUR blob.
Ship: XOR CTF card for $CRYPTO_LAB. Next: Freq Analysis Lab.
4. What you ship: XOR CTF card for $CRYPTO_LAB
Toy filename, key pattern, solver summary, YOUR flag. $CRYPTO_LAB named. NO unauthorized binaries. chmod 600.
5. What you record before the next lesson
Date. XOR CTF card. $CRYPTO_LAB named. File t28-m04-l02-xor-ctf.txt chmod 600.
6. Wrong vs right: prod crypto oracles vs CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
XOR-break neighbor's encrypted backup. Use repeating-key XOR for real API tokens.
Right
Write XOR CTF card for YOUR $CRYPTO_LAB toy blob. Next: Freq Analysis Lab.
Mission: solve YOUR XOR toy
1) Create repeating-key XOR blob from YOUR sentence. 2) Document key length guess method. 3) Record recovered flag. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Hamming distance between columns hints key length — classic CTF trick on YOUR bytes.
Knowledge Check
APPLY: XOR CTF on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Repeating-key XOR is vulnerable to column-wise frequency attacks.
True or False
Knowledge Check
APPLY: XOR alone for real confidentiality is:
Multiple choice