Zhao

Trace uploaded files through extraction, conversion, parsing, and reconstruction of saved objects in a CTF sandbox, an isolated competition environment. Preserve original and derived files, distinguish visible validation from backend behavior, and document the smallest reproducible processing chain.

• Trace an uploaded file to its backend effect
• Investigate archive extraction and preview generation
• Compare visible validation with backend file handling

Analyze packet captures in a CTF sandbox by rebuilding communication sessions and decoding message contents. Recover transferred files and connect packet order, timing, and reconstructed streams to observed host or malware behavior.

• Rebuild TCP or UDP communication sessions
• Decode HTTP, DNS, or custom protocol messages
• Recover files transferred over the network

Organize CTF investigations by mapping the supplied targets, tracing one minimal path, and selecting the relevant specialist workflow. Findings are grounded in observed behavior and reproducible evidence, with a clean baseline used for verification.

• Choosing an analysis path for a CTF challenge
• Tracing a minimal path through challenge infrastructure
• Packaging reproducible evidence for a solution

Analyze a custom protocol in a CTF sandbox and reproduce an accepted exchange. Recover message boundaries, checksums, and session state, then build a small replay program that preserves the required message order.

• Recover message boundaries in an unknown protocol
• Reconstruct handshake steps and session state
• Build a replay program for a captured exchange

Trace software artifacts from source and dependencies through builds, publishing, and runtime use in CTF sandboxes. Compare intended versions with shipped files to identify the earliest divergence and document the evidence linking each stage.

• Comparing declared, resolved, and shipped dependency versions
• Tracing package or build tampering through CI/CD
• Identifying the artifact actually used at runtime

Examine Windows credential material in a CTF sandbox, including LSASS memory and Kerberos tickets. Distinguish stored secrets from credentials that actually work, and document the evidence linking their source to successful authentication or resulting privileges.

• Examining LSASS secrets and Windows logon sessions
• Checking whether recovered Kerberos tickets are usable
• Tracing DPAPI and SSP credential material

Route authorized reverse engineering, security analysis, CTF challenge, and defensive testing requests to specialist skills in a local repository. This Codex adapter selects the relevant workflow and checks the task scope before target actions begin.

• Selecting a specialist skill for reverse engineering
• Starting security analysis with a defined scope
• Routing CTF challenge tasks to a suitable workflow

Trace queued jobs from submission to their eventual effects in a CTF sandbox. Compare request-time and worker-time settings, follow retries and failed-message handling, and document the smallest sequence that explains a worker-specific result.

• Trace a queued payload to its eventual downstream effect
• Compare request-time settings with worker runtime state
• Investigate retries and dead-letter queue handling

Investigate Kerberos delegation, which lets services act on another identity, in a CTF sandbox. Trace delegation settings, issued tickets, and service acceptance to document a reproducible trust path and the privileges it actually grants.

• Identifying constrained, unconstrained, or resource-based delegation
• Tracing S4U steps and issued authentication tickets
• Verifying ticket acceptance and resulting privileges

Trace movement between Windows hosts in a CTF sandbox using credentials and Kerberos tickets, which carry authentication information. Connect recovered artifacts to the service that accepted them and document the resulting access or privileges.

• Trace movement between Windows hosts
• Identify services that accept recovered credentials
• Connect Kerberos tickets to resulting access

Trace server-side request forgery, where a server fetches a supplied URL, through internal services and metadata endpoints in a CTF sandbox. Document credential scope and distinguish successful token extraction from access actually accepted by another service.

• Tracing server-side requests to internal services
• Checking metadata access and token scope
• Distinguishing token extraction from accepted access

Trace how requests become rendered pages in a CTF sandbox. Compare display restrictions with server enforcement, inspect data passed to the browser, and preserve a minimal example that demonstrates where rendering behavior diverges.

• Trace routes through server rendering
• Inspect page data passed to the browser
• Compare display restrictions with handler enforcement

Trace how access to cloud metadata leads to issued credentials and accepted privileges in a CTF sandbox. Organize endpoints, identity details, and API evidence into a minimal, reproducible path showing where trust is granted.

• Investigating access to cloud metadata services
• Tracing instance or workload credentials
• Verifying privileges accepted through metadata credentials

Investigate web applications in a CTF sandbox by tracing real browser requests, stored state, API calls, and background jobs. Compare successful and failing flows to explain authentication, routing, and differences between interface and server behavior.

• Trace authentication and session flows
• Compare browser state with server behavior
• Follow uploads and background jobs

Analyze Windows identity and host evidence in CTF sandboxes. Connect authentication tickets, credentials, mailbox rules, and host activity to explain which services accept access and how movement between hosts occurs.

• Tracing authentication tickets and tokens
• Investigating mailbox rules alongside identity events
• Building a timeline of Windows host evidence

Organize authorized bug bounty investigations from scope review through reconnaissance, asset discovery, vulnerability testing, and reporting. Use vulnerability-specific guides to prioritize checks and prepare reproducible findings with evidence, impact, and remediation advice.

• Review a bug bounty program's scope and testing rules
• Gather public information and discover target assets
• Plan API authorization and business logic checks

Investigate memory dumps, disk records, and captured network traffic while preserving evidence. The skill guides timeline reconstruction and examination of system traces to identify suspicious activity and produce findings that others can review.

• Preserve evidence before starting an incident investigation
• Inspect processes and connections in memory dumps
• Build timelines from event logs and execution traces

Inspect browser storage and caches in a CTF sandbox to explain changes in authentication, page rendering, or requests. Compare clean and modified states, then document the smallest sequence that reproduces the relevant behavior.

• Investigating login behavior affected by stored browser state
• Explaining page differences caused by caches
• Reproducing behavior with clean and modified storage

Analyze authorized browser extensions for Chrome, Edge, and Firefox. Inspect permissions, background scripts, storage, and network activity to reconstruct key data flows and explain credential handling, signing, encryption, or proxy behavior.

• Review extension permissions and entry scripts
• Trace credential handling and network data flows
• Investigate suspicious or compromised extensions

Test desktop application security across local storage, communication between processes, network traffic, and update channels. Map where trust and permissions change, then investigate weaknesses in credentials, access checks, and update verification.

• Checking how desktop apps store credentials
• Reviewing authentication between local processes
• Inspecting app traffic and API access controls

Assess the security of LLM applications and AI agents by tracing inputs, retrieved content, tool calls, and outputs. Covers prompt injection, where content carries unwanted instructions, along with permission misuse, memory poisoning, and supply-chain risks.

• Testing chatbot resistance to prompt injection
• Auditing agent tool permissions and approval steps
• Checking retrieval access controls and memory poisoning

Analyze Android apps in a CTF sandbox using static inspection and Frida hooks, which observe or alter running code. Trace request signing, local storage, and Java-to-native boundaries to reproduce a request accepted by the server.

• Tracing request-signing inputs and outputs
• Inspecting Java-to-native calls with runtime hooks
• Examining app settings, databases, and token storage

Transfer known function and variable names from an older binary to a newer version. Compare disassembly and pseudocode with an LLM, produce structured mappings, and apply names and comments in IDA.

• Migrate known function names after a software update
• Locate kernel functions when the new PDB is unavailable
• Find updated function addresses and structure offsets

Analyze compiled .NET and C# programs by identifying managed files, removing obfuscation, inspecting intermediate instructions, and debugging runtime behavior. Save extracted configuration and code changes as evidence for further review.

• Inspect compiled .NET program behavior
• Analyze obfuscated C# programs
• Extract malware configuration and communication destinations