Zhao

Trace uploaded files through extraction, conversion, parsing, and reconstruction of saved objects in a CTF sandbox, an isolated competition environment. Preserve original and derived files, distinguish visible validation from backend behavior, and document the smallest reproducible processing chain.

• Trace an uploaded file to its backend effect
• Investigate archive extraction and preview generation
• Compare visible validation with backend file handling

Investigate Windows secrets protected by DPAPI, a system for encrypting sensitive data, in a CTF sandbox. Trace the required keys and account context through decryption, then verify which service accepts the recovered secret.

• Inspect DPAPI-protected data and masterkeys
• Trace credentials stored by browsers or Windows Vault
• Identify the account or machine context needed for decryption

Trace how access to cloud metadata leads to issued credentials and accepted privileges in a CTF sandbox. Organize endpoints, identity details, and API evidence into a minimal, reproducible path showing where trust is granted.

• Investigating access to cloud metadata services
• Tracing instance or workload credentials
• Verifying privileges accepted through metadata credentials

Trace queued jobs from submission to their eventual effects in a CTF sandbox. Compare request-time and worker-time settings, follow retries and failed-message handling, and document the smallest sequence that explains a worker-specific result.

• Trace a queued payload to its eventual downstream effect
• Compare request-time settings with worker runtime state
• Investigate retries and dead-letter queue handling

Route authorized reverse engineering, security analysis, CTF challenge, and defensive testing requests to specialist skills in a local repository. This Codex adapter selects the relevant workflow and checks the task scope before target actions begin.

• Selecting a specialist skill for reverse engineering
• Starting security analysis with a defined scope
• Routing CTF challenge tasks to a suitable workflow

Analyze running containers in a CTF sandbox by comparing declared configuration with live processes, mounts, and routes. Trace how secrets and helper containers affect behavior, then document the earliest mismatch and a minimal evidence chain.

• Comparing container manifests with live runtime behavior
• Identifying which process consumes a mounted secret
• Tracing changes made by sidecars or init containers

Compare GraphQL and RPC contracts, which describe expected API behavior, with generated clients and live handlers in a CTF sandbox. Identify hidden or outdated operations and preserve minimal request pairs that demonstrate the mismatch.

• Compare API contracts with live request handling
• Trace requests made by generated clients
• Investigate hidden or outdated API operations

Analyze running iOS apps in a CTF sandbox, a controlled challenge environment. Trace methods, inspect secure storage, and examine request signing and certificate checks to identify the state needed to reproduce an accepted request.

• Trace Objective-C or Swift methods
• Inspect Keychain and local app storage
• Examine certificate checks and request signing

Trace mailbox abuse in a CTF sandbox, a controlled security challenge environment. The skill connects OAuth permissions, forwarding rules, delegated access, and message logs to concrete mail effects, documenting the smallest reproducible sequence and supporting evidence.

• Trace how OAuth consent enables mailbox access
• Investigate forwarding and inbox rule effects
• Verify shared mailbox and delegated access

Investigate Kerberos delegation, which lets services act on another identity, in a CTF sandbox. Trace delegation settings, issued tickets, and service acceptance to document a reproducible trust path and the privileges it actually grants.

• Identifying constrained, unconstrained, or resource-based delegation
• Tracing S4U steps and issued authentication tickets
• Verifying ticket acceptance and resulting privileges

Analyze Windows identity and host evidence in CTF sandboxes. Connect authentication tickets, credentials, mailbox rules, and host activity to explain which services accept access and how movement between hosts occurs.

• Tracing authentication tickets and tokens
• Investigating mailbox rules alongside identity events
• Building a timeline of Windows host evidence

Trace movement between Windows hosts in a CTF sandbox using credentials and Kerberos tickets, which carry authentication information. Connect recovered artifacts to the service that accepted them and document the resulting access or privileges.

• Trace movement between Windows hosts
• Identify services that accept recovered credentials
• Connect Kerberos tickets to resulting access

Trace server-side request forgery, where a server fetches a supplied URL, through internal services and metadata endpoints in a CTF sandbox. Document credential scope and distinguish successful token extraction from access actually accepted by another service.

• Tracing server-side requests to internal services
• Checking metadata access and token scope
• Distinguishing token extraction from accepted access

Analyze packet captures in a CTF sandbox by rebuilding communication sessions and decoding message contents. Recover transferred files and connect packet order, timing, and reconstructed streams to observed host or malware behavior.

• Rebuild TCP or UDP communication sessions
• Decode HTTP, DNS, or custom protocol messages
• Recover files transferred over the network

Analyze WebSocket and SSE realtime connections in CTF sandboxes. Trace connection setup, authentication, subscriptions, and message sequences to explain changes in displayed or stored state and identify the smallest sequence that reproduces them.

• Inspecting connection setup and authentication data
• Decoding realtime messages and subscription flow
• Tracing reconnect behavior and message order

Reproduce timing and ordering bugs in a CTF sandbox using controlled concurrent requests. Compare normal and racing runs, trace reads and writes, and preserve a minimal sequence that demonstrates duplicate actions or inconsistent state.

• Reproduce bugs triggered by simultaneous requests
• Investigate duplicate actions and ineffective duplicate prevention
• Trace stale reads and gaps in locking

Trace forced authentication and relay chains in a CTF sandbox. Identify what triggers authentication, which service accepts the forwarded identity, and what privilege or artifact results, while distinguishing captured authentication from a successfully accepted relay.

• Identify what triggers forced authentication
• Find which service accepts relayed authentication
• Connect relay acceptance to resulting privileges

Compare how proxies and backend servers interpret HTTP requests in a CTF sandbox. Use paired requests and logs to pinpoint differences in paths, headers, or message boundaries, then document a minimal reproduction of unintended routing.

• Compare HTTP interpretation across proxies and backend servers
• Investigate path normalization and decoding differences
• Trace routing changes caused by ambiguous headers

Trace software artifacts from source and dependencies through builds, publishing, and runtime use in CTF sandboxes. Compare intended versions with shipped files to identify the earliest divergence and document the evidence linking each stage.

• Comparing declared, resolved, and shipped dependency versions
• Tracing package or build tampering through CI/CD
• Identifying the artifact actually used at runtime

Trace how requests become rendered pages in a CTF sandbox. Compare display restrictions with server enforcement, inspect data passed to the browser, and preserve a minimal example that demonstrates where rendering behavior diverges.

• Trace routes through server rendering
• Inspect page data passed to the browser
• Compare display restrictions with handler enforcement

Analyze a custom protocol in a CTF sandbox and reproduce an accepted exchange. Recover message boundaries, checksums, and session state, then build a small replay program that preserves the required message order.

• Recover message boundaries in an unknown protocol
• Reconstruct handshake steps and session state
• Build a replay program for a captured exchange

Trace how JWT, JWS, and JWE tokens become accepted identities or privileges in a CTF sandbox. Examine headers, key selection, and claims, the token's attributes, then preserve a minimal reproducible path demonstrating validation confusion.

• Inspect token headers and key selection in a CTF sandbox
• Trace how token claims become application permissions
• Build a minimal reproduction of token acceptance confusion

Build an evidence-backed incident timeline in a CTF sandbox by correlating logs, network captures, and other artifacts. Trace attacker actions across sources, distinguish confirmed events from inferred gaps, and preserve the sequence that supports the conclusion.

• Combine logs and network captures into an incident timeline
• Trace attacker actions from initial access to persistence
• Separate confirmed event order from inferred gaps

Recover hidden malware settings and communication parameters in an isolated CTF environment. Document how values are decoded, preserve supporting evidence, and connect recovered fields to the sample’s observed behavior.

• Recovering hidden malware configuration fields
• Decoding command server addresses and beacon settings
• Separating loaders from staged payloads