Advanced › Module 9 › Lesson 1
Crypto Findings
Crypto finding draft literacy — algorithm, mode, key handling, evidence — on $CRYPTO_LAB review notes.
Visual · t28_crypto_findings
Crypto finding = structured report row. $CRYPTO_LAB. Original Cyberlium.
Opening
A crypto finding without algorithm context is noise — draft rows the way defenders and devs can actually retest.
Crypto finding literacy: Finding ID, title, component, algorithm/mode (AES-GCM, RSA-OAEP, etc.), key source finding (hardcoded, weak RNG, ECB mode), observed evidence (code path, config snippet hash), inference separate, impact category (confidentiality/integrity), affected data class, reproduction on $CRYPTO_LAB only, recommended library fix stub. No prod oracle attack steps, no sensationalized 'broke AES' titles without evidence. Cyberlium templates chmod 600 — professional tone. Refused: padding-oracle repro steps against production, findings on stranger apps without scope, fabricated crypto evidence. Lab row: one complete finding from Module 5 or 8 lab artifact.
1. Finding row fields
ID, algorithm, mode, key handling, observed, inferred, impact, fix stub — crypto-specific columns.
Repro references $CRYPTO_LAB CTF or sample only.
Command guide
Try these commands — Finding row fields
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CWE reporting — https://cwe.mitre.org/ (map findings to weakness IDs) NIST crypto — https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines
Optional command
OpenSSL — https://www.openssl.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export CRYPTO_LAB=${CRYPTO_LAB:-$HOME/cyberlium-lab/t28-crypto}
python3 - <<'PY'
import os
lab = os.environ.get('CRYPTO_LAB', os.path.expanduser('~/cyberlium-lab/t28-crypto'))
path = os.path.join(lab, 'report', 'finding-draft.txt')
os.makedirs(os.path.dirname(path), exist_ok=True)
open(path, 'w').write('
'.join([
'FINDING ID: CRYPTO-LAB-001',
'Title: Lab passphrase stored in shell history (literacy sample)',
'Severity: Informational (lab only)',
'Affected: YOUR demo.enc under t28-crypto/data/',
'Description: symmetric key passed via -pass pass: on command line — bad practice literacy',
'Evidence: demo.enc + openssl enc command in lab notes (no live exploit)',
'Recommendation: use -pass file: or env var; prefer KMS for production keys',
'CWE: CWE-522 (insufficiently protected credentials)',
'Scope: authorized lab files only — not stranger API crypto abuse',
]))
print(f'Wrote {path}')
PYCommand — copy this
grep -E 'FINDING|CWE|Scope' "$CRYPTO_LAB/report/finding-draft.txt"
Primary tools to practice this lesson: python3, grep. Reference sites: CWE reporting (https://cwe.mitre.org/); NIST crypto (https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines); OpenSSL (https://www.openssl.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Evidence discipline
Config hash or code line citation — same integrity as DFIR exhibits.
Inference: 'oracle might' not 'broke prod' without authorized proof.
3. Scope refuse
No prod padding-oracle cookbooks in finding repro.
No fabricated crypto breakthrough claims.
4. What you ship: crypto finding template
Crypto finding fields + one completed $CRYPTO_LAB row + NEVER prod oracle line.
5. What you record before the next lesson
Crypto finding template path.
6. Wrong vs right: prod crypto oracles vs CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Draft padding-oracle finding on live bank site without authorization.
Right
Crypto finding template with one $CRYPTO_LAB row. Next: Libraries Not DIY.
Mission: crypto finding template
1) List crypto finding fields. 2) Complete one row from prior lab. 3) Separate observed vs inferred. 4) Write NEVER prod oracle repro line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “ECB mode finding — typical impact wording?”
Knowledge Check
APPLY: Crypto finding requires:
Multiple choice
Knowledge Check
APPLY: True or False: Prod padding-oracle repro belongs in finding.
True or False
Knowledge Check
APPLY: Inference should:
Multiple choice