
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
This program tries to find the Plaintext and key from a given ciphertext that has been encoded using the Vigenere Substitution Cipher.
This program tries to find the Plaintext and key from a given ciphertext that has been encoded using the Vigenere Substitution Cipher.
$ npm install
$ node cli.js
$ docker build -t vigbrute .
$ docker run vigbrute
Then follow the prompts!
There are various commands that you can use to try and crack the ciphertext:
chiConducts a chi-based attack on the passed data. It uses the kasiskia values to find the most likely key lengths, splits the ciphertext up into multiple decrypted ceasar texts, and calculates language/letter frequency on the cipher.
-data <data> -- Use the passed data as the ciphertext for the chi attack. This or -file is required.-file <file> -- Use the passed filename as the ciphertext for the chi attack. This or -data is required.-alphabet [alphabet] -- Optional. Set the specific alphabet to use.bruteConducts a brute force attack on the passed data. This means each and every combination of the alphabet is attempted.
-data <data> -- Use the passed data as the ciphertext for the brute force attack. This or -file is required.-file <file> -- Use the passed filename as the ciphertext for the brute force attack. This or -data is required.-alphabet [alphabet] -- Optional. Set the specific alphabet to use.dictConducts a dictionary attack on the passed data. This means only potential candidate words from the dictionary file will be attempted.
-data <data> -- Use the passed data as the ciphertext for the brute force attack. This or -file is required.-file <file> -- Use the passed filename as the ciphertext for the brute force attack. This or -data is required.-dictionary [dict file] -- Optional. Set the specific dictionary to use.last <type>Outputs the last attempt of the specified type. Ie, last brute will output the last brute attack attempt, and last dict will output the last dictionary attack attempt.
save <type> <destination>Saves the last attempt of the specified type to the specified destination file.
helpPrints the command help.
exitExits the program.
require("vigbrute")You can also require("vigbrute") in your code directly, to find find the password directly.
const vigbrute = require("vigbrute");
// OR, if it's not installed via NPM
const vigbrute = require("./vigbrute");
vigbrute.chi({
file: "mycipher.txt",
// alphabet: "zyxwvutsrqponmlkjihgfedcba",
callback: (result) => console.log(result)
});
vigbrute.dict({
file: "mycipher.txt",
dict: "mydict.txt",
callback: (result) => console.log(result)
});
vigbrute.brute({
file: "mycipher.txt",
alphabet: "zyxwvutsrqponmlkjihgfedcba",
callback: (result) => console.log(result)
});
Currently not Open Source, but if you want to use this as a prime example for the best way to attack this assignment, I'll keep it closed.
FAQs
This program tries to find the Plaintext and key from a given ciphertext that has been encoded using the Vigenere Substitution Cipher.
We found that vigbrute demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.