OverTheWire Krypton Level 5 → 6 tutorial!!
Published on 06 Aug 2023
Login
Log in as krypton5 using the password from Level 4 → 5.
ssh krypton5@krypton.labs.overthewire.org -p 2231
# password: CLEARTEXT
Why? Each level is a different user. To solve 5 → 6, you must be
krypton5
.
Task
This level is another Vigenère cipher, but this time the key length is unknown.
The password for the next level is in krypton6
.
A little bit of Theory
-
In a Vigenère cipher:
- If key length is unknown, you can use Kasiski or Friedman test to guess it.
- Online solvers can do both automatically: detect key length and recover the key.
-
Once the key is found, decryption is direct.
Further reading:
Solution
-
Explore the directory
cd /krypton/krypton5 ls -la cat README
Output (excerpt):
Frequency analysis can break a known key length as well. Lets try one last polyalphabetic cipher, but this time the key length is unknown.
-
Get a long ciphertext and run automatic decryption
- Copy the content of
found1
(orfound2
) into dCode – Vigenère solver. - Select Automatic Decryption (no need to provide key length).
- The solver proposes a key.
Example result:
Key: KEYLENGTH
- Copy the content of
-
Decrypt the target file
krypton6
- Content of
krypton6
is a short ciphertext:BELOS Z
. - Back on dCode, enter
BELOS Z
as ciphertext. - Choose KNOWING THE KEY/PASSWORD and set it to
KEYLENGTH
. - Decrypt → result:
RANDOM
- Content of
-
Log into the next level
ssh krypton6@krypton.labs.overthewire.org -p 2231 # password: RANDOM
Password
RANDOM
Troubleshooting
- Wrong output → Ensure you used Automatic Decryption on a long ciphertext (
found1
,found2
,found3
). - Multiple candidate keys → Pick the one producing the most readable English.
- Offline route → Use
kasiski
orfreq analysis
manually to estimate key length, then crack each Caesar column.
Copy-paste quick run
ssh krypton5@krypton.labs.overthewire.org -p 2231
# password: CLEARTEXT
cd /krypton/krypton5
# Paste found1 into dCode -> auto decrypt -> key KEYLENGTH
# Decrypt krypton6 with key KEYLENGTH -> RANDOM
ssh krypton6@krypton.labs.overthewire.org -p 2231
# password: RANDOM
Congrats 🎉 You just broke a Vigenère cipher without knowing the key length, and advanced to krypton6!
Thanks for reading!
Until next time — Otsumachi!! 💖☄️✨
all tags
GOT-overwrite aboutme aead ai alphanumeric-shellcode apt argc0 argon2 aslr assembly asymmetric atoi automation backbox bandit base64 bash beginner behemoth binary binary-exploitation binary-to-ascii blackarch blind blind-sqli blogging blue-team bruteforce buffer-overflow buffer-overwrite c caesar canary capabilities checksec command-injection commonmark cookie cron crypto cryptography ctf cutter cyberchef cybersecurity defenders detection dev directory-traversal dnf docs drifter ecc education elf env envp exploitation finale forensics format-string formulaone frequency frequency-analysis gcc gdb getchar gfm ghidra github-pages governance gpg guide hashing hkdf http jekyll jmpbuf kali kasiski kdf kernel keylength kramdown krypton lab ld_preload leviathan lfi lfsr linux linux-syscall llmops log-poisoning ltrace manpage markdown maze memcpy mitigations mitmproxy mlops narnia natas networking newline-injection nonce nop-sled nx object-injection obsidian openssl osint overflow overthewire package-manager pacman parrot path path-hijacking pathname php pie pkc pki pointer-trick pqc priv-esc privilege-escalation provable-security pwn pwntools pyshark python race-condition radare2 rag randomness recon red-team redirect relro requests ret2env ret2libc reverse-engineering reversing ricing roadmap rop rot13 rsa scapy security seed seo serialization session setjmp-longjmp setuid shell shellcode smoke soc sockets sprintf sql-injection srop stack-canary stack-overflow strace strcmp strcpy streamcipher strings strncpy strtoul substitution suid suisei symlink symmetric terminal test threat-intel time-based tls troubleshooting tshark type-juggling ubuntu udp utumno vigenere virtualbox virtualization vmware vortex walkthrough web windows wireshark writing wsl x86