> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/cryptography/hashing/47.-mixed-ctf-patterns.md).

# 47. Mixed CTF Hash Patterns

## Pattern Recognition Table

| Observation                      | Likely Attack                     |
| -------------------------------- | --------------------------------- |
| Cookie = base64(data + hash)     | Hash forgery / length extension   |
| Login compares with `==` in PHP  | Magic hash / type juggling        |
| "Verify your token" endpoint     | HMAC brute-force or timing attack |
| `/etc/shadow` or hash dump given | Hash cracking (John / Hashcat)    |
| Two files with same MD5          | MD5 collision                     |
| Hash starts with `0e` + digits   | PHP magic hash                    |
| JWT token                        | Algorithm confusion / weak secret |
| \`H(secret                       |                                   |

## JWT-Specific Patterns

```
header.payload.signature
```

* **alg=none attack**: Remove signature, set alg to "none"
* **RS256 → HS256 confusion**: Use public key as HMAC secret
* **Weak secret**: Brute-force with `hashcat -m 16500` or `jwt_tool`

```bash
# Crack JWT secret
hashcat -m 16500 jwt.txt rockyou.txt

# jwt_tool
python3 jwt_tool.py <token> -C -d rockyou.txt
```

## Common Challenge Structures

### 1. "Submit a valid signature for this message"

* → Look for timing oracle to leak MAC byte-by-byte
* → Check if server uses `==` instead of `hmac.compare_digest`

### 2. "Here's your signed cookie, make yourself admin"

* → Decode cookie, identify hash type
* → If `H(secret || data)`: try length extension
* → If HMAC: try brute-force secret

### 3. "Login with any password that gives this hash"

* → Check for magic hash inputs (PHP `0e` trick)
* → Try known MD5/SHA1 collision files

### 4. "Crack these hashes from the database dump"

* → Identify hash type (length + prefix)
* → Try online lookup first
* → Hashcat with rockyou + rules

## Checklist for Unknown Hash Challenge

* [ ] Identify hash algorithm (length, prefix, tool)
* [ ] Try online lookup (CrackStation, hashes.com)
* [ ] Check for magic hash pattern (`0e...`)
* [ ] Attempt length extension if `H(secret || msg)` pattern
* [ ] Brute-force with Hashcat or John
* [ ] Check for timing vulnerability in verification endpoint


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/cryptography/hashing/47.-mixed-ctf-patterns.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.