Package: xortool
xortool.pyA tool to do some xor analysis:guess the key length (based on count of equal chars)guess the key (base on knowledge of most frequent char)Notice:xortool is now only running on Python 3. The old Python 2 version is accessible at thepy2branch. Thepippackage has been updated.Installation$pip3installxortoolFor development or building this repository,poetryis needed.Usagexortool
  A tool to do some xor analysis:
  - guess the key length (based on count of equal chars)
  - guess the key (base on knowledge of most frequent char)

Usage:
  xortool [-x] [-m MAX-LEN] [-f] [-t CHARSET] [FILE]
  xortool [-x] [-l LEN] [-c CHAR | -b | -o] [-f] [-t CHARSET] [-p PLAIN] [FILE]
  xortool [-x] [-m MAX-LEN| -l LEN] [-c CHAR | -b | -o] [-f] [-t CHARSET] [-p PLAIN] [FILE]
  xortool [-h | --help]
  xortool --version

Options:
  -x --hex                          input is hex-encoded str
  -l LEN, --key-length=LEN          length of the key
  -m MAX-LEN, --max-keylen=MAX-LEN  maximum key length to probe [default: 65]
  -c CHAR, --char=CHAR              most frequent char (one char or hex code)
  -b --brute-chars                  brute force all possible most frequent chars
  -o --brute-printable              same as -b but will only check printable chars
  -f --filter-output                filter outputs based on the charset
  -t CHARSET --text-charset=CHARSET target text character set [default: printable]
  -p PLAIN --known-plaintext=PLAIN  use known plaintext for decoding
  -h --help                         show this help

Notes:
  Text character set:
    * Pre-defined sets: printable, base32, base64
    * Custom sets:
      - a: lowercase chars
      - A: uppercase chars
      - 1: digits
      - !: special chars
      - *: printable chars

Examples:
  xortool file.bin
  xortool -l 11 -c 20 file.bin
  xortool -x -c ' ' file.hex
  xortool -b -f -l 23 -t base64 message.enc
  xortool -b -p "xctf{" message.encExample 1# xor is xortool/xortool-xortests$xor-f/bin/ls-s"secret_key">binary_xored

tests$xortoolbinary_xored
Themostprobablekeylengths:2:5.0%5:8.7%8:4.9%10:15.4%12:4.8%15:8.5%18:4.8%20:15.1%25:8.4%30:14.9%
Key-lengthcanbe5*n
Mostpossiblecharisneededtoguessthekey!# 00 is the most frequent byte in binariestests$xortoolbinary_xored-l10-c00...1possiblekey(s)oflength10:
secret_key# decrypted ciphertexts are placed in ./xortool_out/Number_<key repr># ( have no better idea )tests$md5sumxortool_out/0_secret_key/bin/ls
29942e290876703169e1b614d0b4340axortool_out/0_secret_key
29942e290876703169e1b614d0b4340a/bin/lsThe most common use is to pass just the encrypted file and the most frequent character (usually 00 for binaries and 20 for text files) - length will be automatically chosen:tests$xortooltool_xored-c20Themostprobablekeylengths:2:5.6%5:7.8%8:6.0%10:11.7%12:5.6%15:7.6%20:19.8%25:7.8%28:5.7%30:11.4%
Key-lengthcanbe5*n1possiblekey(s)oflength20:
an0thers3cret\xddkeyHere, the key is longer then default 32 limit:tests$xortoolls_xored-c00-m64Themostprobablekeylengths:3:3.3%6:3.3%9:3.3%11:7.0%22:6.9%24:3.3%27:3.2%33:18.4%44:6.8%55:6.7%
Key-lengthcanbe3*n1possiblekey(s)oflength33:
reallylongs3cr3tk3y...PADDINGSo, if automated decryption fails, you can calibrate:(-m) max length to try longer keys(-l) selected length to see some interesting keys(-c) the most frequent char to produce right plaintextExample 2We are given a message in encoded in Base64 and XORed with an unknown key.# xortool message.encThemostprobablekeylengths:2:12.3%4:13.8%6:10.5%8:11.5%10:8.6%12:9.4%14:7.1%16:7.8%23:10.4%46:8.7%
Key-lengthcanbe4*n
Mostpossiblecharisneededtoguessthekey!We can now test the key lengths while filtering the outputs so that it only keeps the plaintexts holding the character set of Base64. After trying a few lengths, we come to the right one, which gives only 1 plaintext with a percentage of valid characters above the default threshold of 95%.$xortoolmessage.enc-b-f-l23-tbase64256possiblekey(s)oflength23:\x01=\x121#"0\x17\x13\t\x7f ,&/\x12s\x114u\x170#\x00<\x130"#1\x16\x12\x08~!-\'.\x13r\x105t\x161"\x03?\x103!2\x15\x11\x0b}".$-\x10q\x136w\x152!\x02>\x112 !3\x14\x10\n|#/%,\x11p\x127v\x143\x059\x165\'&4\x13\x17\r{$("+\x16w\x150q\x134\'...Found 1 plaintexts with 95.0%+ valid charactersSee files filename-key.csv, filename-char_used-perc_valid.csvBy filtering the outputs on the character set of Base64, we directly keep the only solution.InformationAuthor: hellmanLicense:MIT License