678 skills · sorted by relevance
Trace how JWT, JWS, and JWE tokens become accepted identities or privileges in a CTF sandbox. Examine headers, key selection, and claims, the token's attributes, then preserve a minimal reproducible path demonstrating validation confusion.
Examine Windows credential material in a CTF sandbox, including LSASS memory and Kerberos tickets. Distinguish stored secrets from credentials that actually work, and document the evidence linking their source to successful authentication or resulting privileges.
Trace how requests travel through a CTF sandbox, from hostnames and proxy rules to containers and processes. Compare headers and live traffic to identify which service handles a request and what changes its destination.
Trace forced authentication and relay chains in a CTF sandbox. Identify what triggers authentication, which service accepts the forwarded identity, and what privilege or artifact results, while distinguishing captured authentication from a successfully accepted relay.
Investigate Windows secrets protected by DPAPI, a system for encrypting sensitive data, in a CTF sandbox. Trace the required keys and account context through decryption, then verify which service accepts the recovered secret.
Trace how access to cloud metadata leads to issued credentials and accepted privileges in a CTF sandbox. Organize endpoints, identity details, and API evidence into a minimal, reproducible path showing where trust is granted.
Analyze packet captures in a CTF sandbox by rebuilding communication sessions and decoding message contents. Recover transferred files and connect packet order, timing, and reconstructed streams to observed host or malware behavior.
Trace software artifacts from source and dependencies through builds, publishing, and runtime use in CTF sandboxes. Compare intended versions with shipped files to identify the earliest divergence and document the evidence linking each stage.
Solve sandboxed CTF security challenges by reconstructing encoding and encryption steps, extracting data hidden in media, and tracing mobile app signing or storage behavior. Preserve exact parameters and evidence to reproduce decoded content or signed requests.
Investigate Kubernetes permissions and cluster behavior in CTF sandboxes. Trace role-based access control, service accounts, and automated controllers to explain workload changes, secret exposure, and differences between configuration files and live objects.
Reproduce timing and ordering bugs in a CTF sandbox using controlled concurrent requests. Compare normal and racing runs, trace reads and writes, and preserve a minimal sequence that demonstrates duplicate actions or inconsistent state.
Trace SSH keys, tokens, and other credentials in Linux CTF environments. Connect each recovered artifact to the service that accepts it, then document the resulting privileges or movement to another host.
Investigate hidden data in CTF images, audio, video, and documents. Examine file structure and candidate hiding channels, then extract and reconstruct the payload while preserving intermediate files and reproducible steps.
Reconstruct frontend behavior from served JavaScript, build manifests, and source maps, which link built code to source. Trace loaded modules, recover route and API references, and identify the smallest asset sequence that explains observed behavior.
Analyze encrypted ZIP challenges in a CTF sandbox and use bkcrack to recover legacy ZipCrypto keys from known file contents. Create a decrypted archive, validate extraction, and preserve the commands and evidence needed to reproduce the result.
Trace queued jobs from submission to their eventual effects in a CTF sandbox. Compare request-time and worker-time settings, follow retries and failed-message handling, and document the smallest sequence that explains a worker-specific result.
Investigate Kerberos delegation, which lets services act on another identity, in a CTF sandbox. Trace delegation settings, issued tickets, and service acceptance to document a reproducible trust path and the privileges it actually grants.
Trace OAuth and OIDC sign-in flows in a CTF sandbox, from redirects through token exchange to application acceptance. Show where tokens become a recognized identity or permission, and preserve the smallest reproducible flow.
Build an evidence-backed incident timeline in a CTF sandbox by correlating logs, network captures, and other artifacts. Trace attacker actions across sources, distinguish confirmed events from inferred gaps, and preserve the sequence that supports the conclusion.
Examine container isolation in a CTF sandbox, a controlled security challenge environment. The skill checks kernel and runtime conditions, verifies whether an exploit crosses into host context, and preserves a minimal reproducible chain with evidence.
Investigate prompt injection in sandboxed security challenges by tracing how untrusted text changes an agent’s decisions or tool calls. Build a minimal reproduction and preserve evidence showing where external content crosses into trusted instructions or actions.
Analyze Windows identity and host evidence in CTF sandboxes. Connect authentication tickets, credentials, mailbox rules, and host activity to explain which services accept access and how movement between hosts occurs.
Inspect firmware in a CTF sandbox, map its partitions, and trace startup and update steps. Connect extracted files, credentials, and configuration to device behavior, preserving evidence for a minimal reproducible path.
Analyze running containers in a CTF sandbox by comparing declared configuration with live processes, mounts, and routes. Trace how secrets and helper containers affect behavior, then document the earliest mismatch and a minimal evidence chain.