Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-cryp-04
Testing for Weak Encryption
Passed 13 of 21 test cases with the skill, and 9 of 21 without it.
and 4 more in the full report
6 fixed8 passed either way7 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
An audit of an authentication microservice reveals that stored user account passwords are hashed using unsalted MD5 and SHA1 algorithms. Development teams suggest treating unsalted legacy hashes as Low risk due to database access controls. What CVSS score and severity rating should be assigned to MD5 or SHA1 password hashing under OWASP WSTG-CRYP-04 guidelines?
| Checked | Without skill | With skill |
|---|---|---|
| Assigns a CVSS score of 7.5 to MD5 and SHA1 password hashing. | Missed | Passed |
| Assigns High severity to MD5 and SHA1 password hashing. | Passed | Passed |
The instructions your model reads when the skill loads.
WSTG-CRYP-04
Testing for Weak Encryption
Weak encryption can occur through the use of outdated algorithms, insufficient key lengths, improper implementation, or predictable initialization vectors. This test identifies cryptographic weaknesses in data encryption at rest and in transit within the application.
# Look for encrypted/hashed data in:
# - Cookies
# - Database exports
# - API responses
# - Configuration files
# - URL parameters
test cases passed, vs 9 / 21 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.