64 skills · sorted by relevance
Assess WPA/WPA2 Personal Wi-Fi password strength through authentication data capture, file conversion, and offline password testing. Covers dictionary searches, pattern-based guesses, vendor default passwords, and capture quality checks.
Fast workflow to inspect PCAPs and extract protocol-level details using tshark
The English summary is being prepared. Showing the original description.
Guidance for analyzing network packet captures (PCAP files) and computing network statistics using Python, with tested utility functions.
The English summary is being prepared. Showing the original description.
Network flow extractor that analyzes pcap/pcapng files to identify outbound connections with automatic DNS hostname resolution. Use when you need to enumerate network destinations, identify what hosts a device communicates with, or map IP addresses to hostnames from packet captures.
The English summary is being prepared. Showing the original description.
Network traffic analysis, PCAP parsing, IDS/IPS rule creation, firewall configuration auditing, and network anomaly detection
The English summary is being prepared. Showing the original description.
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for packet capture analysis, session reconstruction, application-protocol decoding, stream reassembly, beacon timing, and packet-to-process correlation. Use when the user asks to analyze a PCAP, rebuild TCP or UDP sessions, decode HTTP, WebSocket, DNS, custom C2, or binary protocols, extract transferred artifacts, or tie packet sequences to host or malware behavior. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
The English summary is being prepared. Showing the original description.
Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. Uses Wireshark, Zeek, and NetFlow analysis techniques. Activates for requests involving network traffic analysis, packet capture investigation, PCAP analysis, network forensics, C2 traffic detection, or exfiltration detection.
The English summary is being prepared. Showing the original description.
Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns using Wireshark, Zeek, and Suricata. Activates for requests involving malware network analysis, C2 traffic decoding, malware PCAP analysis, or network-based malware detection.
The English summary is being prepared. Showing the original description.
Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns using Wireshark, Zeek, and Suricata. Activates for requests involving malware network analysis, C2 traffic decoding, malware PCAP analysis, or network-based malware detection.
The English summary is being prepared. Showing the original description.
Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. Uses Wireshark, Zeek, and NetFlow analysis techniques. Activates for requests involving network traffic analysis, packet capture investigation, PCAP analysis, network forensics, C2 traffic detection, or exfiltration detection.
The English summary is being prepared. Showing the original description.
Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts. Uses Wireshark, Zeek, and NetFlow analysis techniques. Activates for requests involving network traffic analysis, packet capture investigation, PCAP analysis, network forensics, C2 traffic detection, or exfiltration detection.
The English summary is being prepared. Showing the original description.
Analyzes network traffic generated by malware during sandbox execution or live incident response to identify C2 protocols, data exfiltration channels, payload downloads, and lateral movement patterns using Wireshark, Zeek, and Suricata. Activates for requests involving malware network analysis, C2 traffic decoding, malware PCAP analysis, or network-based malware detection.
The English summary is being prepared. Showing the original description.
Analyze Modbus industrial network traffic to identify unauthorized commands, write operations, and unusual polling intervals. Compare activity with normal traffic patterns and allowed operations, then report anomalies by type and severity.
Analyze DNS logs to find signs of hidden data transfers. Use query length, character randomness, traffic volume, and response sizes to identify suspicious domains and support monitoring rules with Python, Suricata, and Splunk examples.
Analyze Cobalt Strike communication profiles and Beacon payload configurations to extract request paths, headers, timing, and process injection settings. Turn these indicators into a JSON report and network detection rules for Suricata or Snort.
Operate Chrome or Brave using signed-in browser sessions to verify deployed pages, reproduce bugs, inspect page structure, and examine errors or network traffic. An optional macOS bridge extends control to native applications and operating system input.
Provides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions, steganography, PDF analysis, Windows registry, Volatility, PCAP, Docker images, coredumps, side-channel power traces, DTMF audio spectrograms, packet timing analysis, CD audio disc images, or recovering deleted files and credentials.
The English summary is being prepared. Showing the original description.
Collects bounded packet captures from AKS nodes and Azure network configuration for wire-level evidence. WHEN: "capture packets on an AKS node", "take a pcap", "run tcpdump on AKS", "prove where packets drop". Use for explicit packet-capture intent after read-only diagnostics, not general AKS connectivity or ingress troubleshooting.
The English summary is being prepared. Showing the original description.
Running Suricata against PCAPs offline and validating results via eve.json
The English summary is being prepared. Showing the original description.
Collects bounded packet captures from AKS nodes and Azure network configuration for wire-level evidence. WHEN: "capture packets on an AKS node", "take a pcap", "run tcpdump on AKS", "prove where packets drop". Use for explicit packet-capture intent after read-only diagnostics, not general AKS connectivity or ingress troubleshooting.
The English summary is being prepared. Showing the original description.
Read and write 3-D point cloud data using Lidar Toolbox file I/O. Covers PLY, PCD, LAS/LAZ, PCAP (Velodyne/Ouster/Hesai), E57, and IDC (Ibeo) formats. Use when loading point clouds from disk, saving to disk, choosing the correct reader or writer for a file format, extracting or preserving lidar point attributes, reading Ibeo IDC sensor recordings, or converting between formats.
The English summary is being prepared. Showing the original description.
用于磁盘镜像、内存转储、事件日志、PCAP、隐写分析、Windows 注册表、音频信号、Docker 镜像、coredump 以及已删除文件与凭据恢复等取证类 CTF 题;触发名:ctf-forensics
The English summary is being prepared. Showing the original description.
Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.
The English summary is being prepared. Showing the original description.
Use for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery.
The English summary is being prepared. Showing the original description.