614 skills · sorted by relevance
Trace how requests become rendered pages in a CTF sandbox. Compare display restrictions with server enforcement, inspect data passed to the browser, and preserve a minimal example that demonstrates where rendering behavior diverges.
Compare how proxies and backend servers interpret HTTP requests in a CTF sandbox. Use paired requests and logs to pinpoint differences in paths, headers, or message boundaries, then document a minimal reproduction of unintended routing.
Trace mailbox abuse in a CTF sandbox, a controlled security challenge environment. The skill connects OAuth permissions, forwarding rules, delegated access, and message logs to concrete mail effects, documenting the smallest reproducible sequence and supporting evidence.
Examine Windows credential material in a CTF sandbox, including LSASS memory and Kerberos tickets. Distinguish stored secrets from credentials that actually work, and document the evidence linking their source to successful authentication or resulting privileges.
Trace movement between Windows hosts in a CTF sandbox using credentials and Kerberos tickets, which carry authentication information. Connect recovered artifacts to the service that accepted them and document the resulting access or privileges.
Analyze packet captures in a CTF sandbox by rebuilding communication sessions and decoding message contents. Recover transferred files and connect packet order, timing, and reconstructed streams to observed host or malware behavior.
Inspect firmware in a CTF sandbox, map its partitions, and trace startup and update steps. Connect extracted files, credentials, and configuration to device behavior, preserving evidence for a minimal reproducible path.
Trace software artifacts from source and dependencies through builds, publishing, and runtime use in CTF sandboxes. Compare intended versions with shipped files to identify the earliest divergence and document the evidence linking each stage.
Analyze encrypted ZIP challenges in a CTF sandbox and use bkcrack to recover legacy ZipCrypto keys from known file contents. Create a decrypted archive, validate extraction, and preserve the commands and evidence needed to reproduce the result.
Analyze running containers in a CTF sandbox by comparing declared configuration with live processes, mounts, and routes. Trace how secrets and helper containers affect behavior, then document the earliest mismatch and a minimal evidence chain.
Investigate prompt injection in sandboxed security challenges by tracing how untrusted text changes an agent’s decisions or tool calls. Build a minimal reproduction and preserve evidence showing where external content crosses into trusted instructions or actions.
Analyze WebSocket and SSE realtime connections in CTF sandboxes. Trace connection setup, authentication, subscriptions, and message sequences to explain changes in displayed or stored state and identify the smallest sequence that reproduces them.
Trace server-side request forgery, where a server fetches a supplied URL, through internal services and metadata endpoints in a CTF sandbox. Document credential scope and distinguish successful token extraction from access actually accepted by another service.
Trace uploaded files through extraction, conversion, parsing, and reconstruction of saved objects in a CTF sandbox, an isolated competition environment. Preserve original and derived files, distinguish visible validation from backend behavior, and document the smallest reproducible processing chain.
Recover hidden malware settings and communication parameters in an isolated CTF environment. Document how values are decoded, preserve supporting evidence, and connect recovered fields to the sample’s observed behavior.
Trace OAuth and OIDC sign-in flows in a CTF sandbox, from redirects through token exchange to application acceptance. Show where tokens become a recognized identity or permission, and preserve the smallest reproducible flow.
Trace queued jobs from submission to their eventual effects in a CTF sandbox. Compare request-time and worker-time settings, follow retries and failed-message handling, and document the smallest sequence that explains a worker-specific result.
Trace how access to cloud metadata leads to issued credentials and accepted privileges in a CTF sandbox. Organize endpoints, identity details, and API evidence into a minimal, reproducible path showing where trust is granted.
Solve sandboxed CTF security challenges by reconstructing encoding and encryption steps, extracting data hidden in media, and tracing mobile app signing or storage behavior. Preserve exact parameters and evidence to reproduce decoded content or signed requests.
Reproduce timing and ordering bugs in a CTF sandbox using controlled concurrent requests. Compare normal and racing runs, trace reads and writes, and preserve a minimal sequence that demonstrates duplicate actions or inconsistent state.
Build an evidence-backed incident timeline in a CTF sandbox by correlating logs, network captures, and other artifacts. Trace attacker actions across sources, distinguish confirmed events from inferred gaps, and preserve the sequence that supports the conclusion.
Analyze running iOS apps in a CTF sandbox, a controlled challenge environment. Trace methods, inspect secure storage, and examine request signing and certificate checks to identify the state needed to reproduce an accepted request.
Analyze a custom protocol in a CTF sandbox and reproduce an accepted exchange. Recover message boundaries, checksums, and session state, then build a small replay program that preserves the required message order.
Investigate Kubernetes permissions and cluster behavior in CTF sandboxes. Trace role-based access control, service accounts, and automated controllers to explain workload changes, secret exposure, and differences between configuration files and live objects.