ctf-skills - Agent skills for solving CTF challenges - web expl

项目说明

ctf-skills

Agent Skills for solving CTF challenges — web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more. Works with any 工具 that supports the Agent Skills spec, including Claude 代码.

Installation

En Setup

Two setup strategies depending on your workflow:

Pre-install (recommended before competitions)

Use the central installer entrypoint:

Run a narrower mode when you only want one 工具 group:

Preview what would be installed (skips already-present packages):

what's already installed:

Use --force to reinstall e regardless of what's already present. Install logs are saved to ~/.ctf-tools/.

The full package lists now live in scripts/install_ctf_tools.sh.

> [!TIP]
> The pat mode shallow-clones PayloadsAllTheThings into ~/.ctf-tools/PayloadsAllTheThings and links it at ctf-web/payloads/PayloadsAllTheThings. Bulk payloads stay out of git; technique files reference ctf-web/pat-reference.md with a few exemplar payloads inline.

On-demand (during challenges)

Each skill's SKILL.md has a Prerequisites section listing only the tools needed for that category. Install as you go when the agent encounters a missing 工具.

Skills

| Skill | Files | Description |
|-------|-------|-------------|
| ctf-ai-ml | 3 | Model weight perturbation negation, ad examples (FGSM, PGD, C&W), foolbox L1BasicIterati Keras e, hand-rolled Keras FGSM via K.gradients, prompt injection, LLM jailbreaking, model extraction, membership inference, neural 网络 collision, LoRA adapter exploitation, gradient descent in, data poisoning, backdoor detection, token smuggling, context window manipulation |
| ctf-web | 22 | SQLi (blind boolean/time/error generators, second-order, WAF bypasses, EXIF metadata injection, keyword fragmentation bypass, MySQL column truncation, DNS record injection, ORDER BY CASE WHERE bypass, QR 代码 input injection, double-keyword filter bypass), Burp Intruder parity via python-requests.md (sync, 30-worker ThreadPoolExecutor, 100-concurrency httpx async, generator streaming feeds, async_fuzz.py CLI fuzzer), PayloadsAllTheThings on-demand index (pat-reference.md), XSS (AngularJS sandbox escapes, DOM clobbering, CSP bypasses), SSTI (Jinja2, Twig, Go template FuncMap), SSRF (DNS rebinding, cloud metadata), XXE, file upload polyglots, deserialization (Ja, Python pickle, PHP), JWT (key confusion, dynamic length RSA parameters), OAuth/OIDC, prototype pollution |
| ctf-pwn | 18 | Buffer o, ROP chains, ret2csu, ret2vdso, ROP PIE bypass, bad char XOR bypass, 5 runnable pwntools==4.15.0 template scripts in ctf-pwn/scripts/ with yield payload generators (ret2libc, SROP, shellcraft asm, format string write-size suites, seccomp ORW), heap exploitation (unlink, House of Force, largebin attack guide, glibc 2.39 tcache key protection + calloc behavior, House of Apple 2 + setcontext SUID , House of Tangerine/Emma/Water/Einherjar), kernel exploitation (io_uring C, CET Shadow Stack signal-frame bypass, KASLR, SMEP/SMAP, ret2usr, modprobe_path), format string, SROP with UTF-8 constraints |
| ctf-crypto | 19 | RSA (small e, common modulus, Wiener, Boneh-Durfee $d<N^{0.292}$, partial-$d$ exposure, Hastad broadcast, Hastad broadcast with linear padding Coppersmith, Coppersmith structured primes, Franklin-Reiter related message attack e=3, Manger, Manger OAEP timing, Williams $p+1$ + ECM chain, LSB binary search oracle, Fermat/consecuti, multi-prime, restricted-digit primes, p=q bypass, cube root CRT, phi multiple factoring, weak keygen base representation, gcd(e,phi)>1 exponent reduction, CRT fault attack, homomorphic decryption oracle bypass, small prime CRT decomposition, Montgomery timing, Bleichenbacher low-exponent forgery, e=1 bypass), AES (ECB byte-at-a-time, CBC bitflip + padding oracle, GCM nonce reuse forbidden attack, ChaCha20-Poly1305 nonce reuse, key-committing partitioning oracle), ECC (small subgroup, invalid curve 5 , Smart $p$-adic lift, MO, twist attacks, SIDH Castryck-Decru warning, CSIDH walk, ECDSA nonce reuse, Ed25519 torsion), classic DH (trivial g, Pohlig-Hellman, Lim-Lee confinement), Lattices/PQC (fpylll Howgra lattice, NTRU negacyclic basis, GGH C, Mersenne AJPS small roots, BDD predicate, ML-KEM/Kyber flattening), PRNG/stream (PCG XSH-RR, xoroshiro/xoshiro, BBS parity, Henon/Arnold chaos, Spritz/VMPC/RC4A, Trivium cube attack) |
| ctf-reverse | 19 | Binary analysis, custom VMs (+ lifting to LLVM IR), WASM, RISC-V, Rust serde, Python bytecode, Unicorn CPU emulation guide (unicorn-emulation.md: hooks, mixed-mode 64→32 retf with XMM state preser, MMIO peripherals, Keystone trace in), Go (GoReSym), Android APK/DEX/JNI, anti-debug, anti- flow flattening deobfuscation |
| ctf-forensics | 14 | Disk/memory forensics (GIMP raw memory dump inspection, Kyoto Cabinet hash DB forensics), RAID 5 XOR recovery, APFS snapshot recovery, Windows KAPE triage, Windows/Linux forensics, steganography (Arnold's Cat Map descrambling, MJPEG extra bytes after FFD9, high-res SST FM demodulation, EXIF zlib + triangular numbers LSB, PDF xref generation number covert channel, pixel-wise ECB deduplication image recovery), 网络 captures, tcpdump, TLS/SSL keylog decryption, RDP session decryption key extraction, USB HID drawing, USB HID keyboard capture decoding (+ arrow key na tracking), USB MIDI Launchpad traffic reconstruction, UART decode, serial UART data decoding from WA, side-channel power analysi… |
| ctf-osint | 3 | Social media, geolocation, Google Lens cropped region search, reflected/mirrored text reading, Street View panorama matching, What3Words micro-landmark matching, Google Plus Codes, Baidu reverse image search, O Turbo spatial queries, username enumeration, username metadata mining (postal codes), Stra route OSINT, Google Maps photo , DNS recon, archi, Google dorking (TBS image filters), g, Shodan SSH fingerprint deanonymization, gaming platform OSINT (WoW/Steam/Minecraft character lookup), fake service banner detection via nmap fingerprinting, git commit author email mining for credential pivot, .DS_S… |
| ctf-malware | 3 | Obfuscated scripts, C2 traffic, custom crypto protocols, .NET malware, PyInstaller unpacking, PE analysis, sandbox e, anti-analysis (, timing e, API hashing, process injection), dynamic analysis (strace/ltrace, 网络 monitoring, memory extraction), YARA rules, shellcode analysis, memory forensics ( malfind, process injection), Poison Ivy RAT Camellia decryption, DarkComet RAT forensics (keylogger log recovery, registry persistence), Cobalt Strike beacon analysis (Malleable C2 detection, dissect.cobaltstrike config extraction), trojanized plugin custom alphabet C2 decoding, ARP spoof + TCP RST injection to capture IRC C2 credentials |
| ctf-misc | 12 | Pyjails (audit-hook trampolines across 4 families, Filter'd length-limit trampolines, full NFKC compatibility decomposition, modern filter trios, func_globals module chain, restricted charset number gen, class attribute persistence, name mangling + func_code.co_consts + __doc__ attribute access, f-string config injection eval), bash jails (BASH_ENV ), encodings (two-pass try_xor + bytes-preserving auto_decode, base64→xor→zlib chains, QR polyglots, Brainfuck dual-interpreter equality jails, DTMF, Gray 代码, RTF custom tag extraction, SMS PDU decoding, RFC4042 UTF-9, pixel color binary encoding, TOPKEK binary encoding, MaxiCode 2D barcode decoding, DTMF audio + multi-tap T9 phone keypad, music note inter), RF/SDR, DNS exploitation (+ round-robin A record enumeration), Unicode stego, floating-point tricks, 游戏 theory, commitment schemes, WASM, K8s, custom assembly sandbox escape, Lua sandbox escape (function name injection, table indexing bypass), Ruby sandbox escape .trace, cookie check… |
| sol | 0 | Orchestrator skill — analyzes challenge and delegates to category skills |
| ctf-writeup | 0 | Generates standardized submission-style writeups with metadata, solution steps, 代码, and lessons learned |

Usage

Skills are loaded automatically based on context. You can also invoke the orchestrator directly:

Contributing

See CONTRIBUTING.md for de setup and contribution guidelines.

License

MIT

项目信息

开发语言：Python

Star 数：3392

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Agent skills for solving CTF challenges - web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。