{
 "product": "Crypto Audit",
 "slug": "crypto-audit",
 "base": "https://cainstudio.online",
 "page": "https://cainstudio.online/guide-crypto-audit.html",
 "claims": [
  {
   "id": "C01",
   "kind": "control",
   "claim": "Modern code: bcrypt, SHA-256, secrets, default TLS -> No findings: no false alarm.",
   "requests": [
    {
     "method": "POST",
     "url": "/catalog-demo/taloscrypt-audit/run",
     "body": {
      "input": "import bcrypt, hashlib, secrets, requests\nh = bcrypt.hashpw(pw, bcrypt.gensalt())\nd = hashlib.sha256(data).hexdigest()\nt = secrets.token_urlsafe(32)\nr = requests.get(url, timeout=10)\n"
     }
    }
   ],
   "path": "steps.0.reply.total",
   "expect": [
    0
   ]
  },
  {
   "id": "C02",
   "kind": "attack",
   "claim": "Signature check off, TLS check off, key in the code -> Three classic mistakes, three findings.",
   "requests": [
    {
     "method": "POST",
     "url": "/catalog-demo/taloscrypt-audit/run",
     "body": {
      "input": "import jwt, requests\nfrom cryptography.fernet import Fernet\nclaims = jwt.decode(tok, options={'verify_signature': False})\nr = requests.get(url, verify=False)\nf = Fernet(b'ZmFrZWtleWZha2VrZXlmYWtla2V5ZmFrZWtleWZha2U=')\n"
     }
    }
   ],
   "path": "steps.0.reply.total",
   "expect": [
    3
   ]
  },
  {
   "id": "C03",
   "kind": "attack",
   "claim": "Passwords hashed with MD5 -> MD5 is broken for passwords.",
   "requests": [
    {
     "method": "POST",
     "url": "/catalog-demo/taloscrypt-audit/run",
     "body": {
      "input": "import hashlib\npw = hashlib.md5(password.encode()).hexdigest()\n"
     }
    }
   ],
   "path": "steps.0.reply.findings.0.rule_name",
   "expect": [
    "WeakHash_MD5"
   ]
  },
  {
   "id": "C04",
   "kind": "attack",
   "claim": "AES in ECB mode -> ECB leaks patterns in the data.",
   "requests": [
    {
     "method": "POST",
     "url": "/catalog-demo/taloscrypt-audit/run",
     "body": {
      "input": "from Crypto.Cipher import AES\nc = AES.new(key, AES.MODE_ECB)\n"
     }
    }
   ],
   "path": "steps.0.reply.findings.0.rule_name",
   "expect": [
    "InsecureMode_ECB"
   ]
  },
  {
   "id": "C05",
   "kind": "attack",
   "claim": "random() used for a security token -> random() is predictable; use secrets.",
   "requests": [
    {
     "method": "POST",
     "url": "/catalog-demo/taloscrypt-audit/run",
     "body": {
      "input": "import random\ntoken = random.random()\n"
     }
    }
   ],
   "path": "steps.0.reply.findings.0.rule_name",
   "expect": [
    "InsecureRandom_Crypto"
   ]
  },
  {
   "id": "C06",
   "kind": "attack",
   "claim": "A 1024-bit RSA key -> Under 2048 bits is too short.",
   "requests": [
    {
     "method": "POST",
     "url": "/catalog-demo/taloscrypt-audit/run",
     "body": {
      "input": "from cryptography.hazmat.primitives.asymmetric import rsa\nk = rsa.generate_private_key(public_exponent=65537, key_size=1024)\n"
     }
    }
   ],
   "path": "steps.0.reply.findings.0.rule_name",
   "expect": [
    "ShortRSAKey"
   ]
  }
 ]
}