TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

Cryptography Challenges

1 post · Dec 2017

What this trail covers

Cloudflare has evolved its approach to engaging engineers with technical challenges, moving beyond theoretical discussions to practical, hands-on problem-solving. This post introduces a series of cryptography challenges, including password hashing, HSTS manipulation, and AES-256 decryption, designed to test and enhance practical security skills. The challenges are accompanied by hints and detailed solutions, demonstrating the application of tools like Hashcat and OpenSSL, and illustrating cryptographic concepts like the two-time pad attack. This initiative aims to foster a deeper understanding of security principles through active participation and problem-solving.

All Cloudflare trails
  1. Concise (Post-Christmas) Cryptography ChallengesThis post introduces three distinct cryptography challenges: password hashing using BCrypt, practical manipulation of HTTP Strict Transport Security (HSTS) to bypass HTTPS, and AES-256 decryption of images using CTR mode. For password hashing, it demonstrates the use of Hashcat with a dictionary attack to crack BCrypt hashes. For HSTS, it explains how to exploit DNS interception to redirect traffic to a non-HSTS subdomain. For AES-256, it details a two-time pad attack by XORing two ciphertexts generated with identical keys and nonces, followed by adding BMP headers and inverting the result to recover the original image. The post also provides the setup for generating the encrypted files using OpenSSL.