Agent skill · security · yaklang
hash-attack-techniques
Hash attack playbook. Use when exploiting length extension, MD5/SHA1 collisions, HMAC timing leaks, birthday attacks, or hash-based proof of work in CTF and authorized testing scenarios.
Why this skill is useful
Adds executable scripts and detailed attack methodologies for various hash attack techniques that are not commonly known or documented.
What it needs
Requires hashcat, hashclash, hashpump installed locally. About 8k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Hash Attack Techniques — Expert Cryptanalysis Playbook AI LOAD INSTRUCTION: Expert hash attack techniques for CTF and security assessments. Covers length extension attacks, MD5/SHA1 collision generation, meet-in-the-middle hash attacks, HMAC timing side channels, birthday attacks, and proof-of-work solving. Base models often incorrectly apply length extension to HMAC or SHA-3, or fail to distinguish between identical-prefix and chosen-prefix collisions. 0. RELATED ROUTING rsa-attack-techniques when hash weaknesses affect RSA signature schemes symmetric-cipher-attacks when hash is used in key derivation classical-cipher-analysis when analyzing hash-like constructions in classical ciphers Quick attack selection Scenario Attack Tool --- --- --- H(secret \ \ msg) known, extend message Length extension HashPump, hashextender Need two files with same MD5 Identical-prefix collision fastcoll Need specific MD5 prefix match Chosen-prefix collision hashclash Byte-by-byte HMAC comparison Timing attack Custom script Find any collision Birthday attack O(2^(n/2)) Proof of work: find hash with leading zeros Brute force hashcat, Python --- 1. LENGTH EXTENSION ATTACK 1.1 Vulnerable vs Non-Vulnerable Hash Vulnerable Why --- --- --- MD5 Yes Merkle-Damgard construction SHA-1 Yes Merkle-Damgard construction SHA-256 Yes Merkle-Damgard construction SHA-512 Yes Merkle-Damgard construction SHA-3 / Keccak No Sponge construction HMAC- No Double hashing prevents extension SHA-256 truncated No (if truncated) Missing internal state bits BLAKE2 No Different construction 1.2 Attack Mechanism 1.3 Padding Calculation (MD5/SHA) 1.4 Tool Usage 1.5 Python Implementation --- 2. MD5 COLLISION ATTACKS 2.1 Identical-Prefix Collision (fastcoll) Two messages with same prefix but different content, producing identical MD5. 2.2 Chosen-Prefix Collision (hashclash) Two messages with different chosen prefixes, appended with computed suffixes to collide. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/hash-attack-techniques