445 skills · sorted by relevance
Analyze Windows identity and host evidence in CTF sandboxes. Connect authentication tickets, credentials, mailbox rules, and host activity to explain which services accept access and how movement between hosts occurs.
Compare GraphQL and RPC contracts, which describe expected API behavior, with generated clients and live handlers in a CTF sandbox. Identify hidden or outdated operations and preserve minimal request pairs that demonstrate the mismatch.
Trace how requests travel through a CTF sandbox, from hostnames and proxy rules to containers and processes. Compare headers and live traffic to identify which service handles a request and what changes its destination.
Inspect firmware in a CTF sandbox, map its partitions, and trace startup and update steps. Connect extracted files, credentials, and configuration to device behavior, preserving evidence for a minimal reproducible path.
Trace how requests become rendered pages in a CTF sandbox. Compare display restrictions with server enforcement, inspect data passed to the browser, and preserve a minimal example that demonstrates where rendering behavior diverges.
Organize CTF investigations by mapping the supplied targets, tracing one minimal path, and selecting the relevant specialist workflow. Findings are grounded in observed behavior and reproducible evidence, with a clean baseline used for verification.
Analyze running iOS apps in a CTF sandbox, a controlled challenge environment. Trace methods, inspect secure storage, and examine request signing and certificate checks to identify the state needed to reproduce an accepted request.
Solve sandboxed CTF security challenges by reconstructing encoding and encryption steps, extracting data hidden in media, and tracing mobile app signing or storage behavior. Preserve exact parameters and evidence to reproduce decoded content or signed requests.
Examine container isolation in a CTF sandbox, a controlled security challenge environment. The skill checks kernel and runtime conditions, verifies whether an exploit crosses into host context, and preserves a minimal reproducible chain with evidence.
Compare how proxies and backend servers interpret HTTP requests in a CTF sandbox. Use paired requests and logs to pinpoint differences in paths, headers, or message boundaries, then document a minimal reproduction of unintended routing.
Trace SSH keys, tokens, and other credentials in Linux CTF environments. Connect each recovered artifact to the service that accepts it, then document the resulting privileges or movement to another host.
Trace software artifacts from source and dependencies through builds, publishing, and runtime use in CTF sandboxes. Compare intended versions with shipped files to identify the earliest divergence and document the evidence linking each stage.
Trace OAuth and OIDC sign-in flows in a CTF sandbox, from redirects through token exchange to application acceptance. Show where tokens become a recognized identity or permission, and preserve the smallest reproducible flow.
Build an evidence-backed incident timeline in a CTF sandbox by correlating logs, network captures, and other artifacts. Trace attacker actions across sources, distinguish confirmed events from inferred gaps, and preserve the sequence that supports the conclusion.
Analyze encrypted ZIP challenges in a CTF sandbox and use bkcrack to recover legacy ZipCrypto keys from known file contents. Create a decrypted archive, validate extraction, and preserve the commands and evidence needed to reproduce the result.
Trace server-side request forgery, where a server fetches a supplied URL, through internal services and metadata endpoints in a CTF sandbox. Document credential scope and distinguish successful token extraction from access actually accepted by another service.
Investigate Kubernetes permissions and cluster behavior in CTF sandboxes. Trace role-based access control, service accounts, and automated controllers to explain workload changes, secret exposure, and differences between configuration files and live objects.
Analyze a custom protocol in a CTF sandbox and reproduce an accepted exchange. Recover message boundaries, checksums, and session state, then build a small replay program that preserves the required message order.
Analyze WebSocket and SSE realtime connections in CTF sandboxes. Trace connection setup, authentication, subscriptions, and message sequences to explain changes in displayed or stored state and identify the smallest sequence that reproduces them.
Analyze binaries, malware samples, memory dumps, and packet captures in sandboxed security challenges. Trace program behavior, investigate crashes, and verify exploit conditions while preserving original files, decoded artifacts, and observable evidence for reproducible findings.
Trace uploaded files through extraction, conversion, parsing, and reconstruction of saved objects in a CTF sandbox, an isolated competition environment. Preserve original and derived files, distinguish visible validation from backend behavior, and document the smallest reproducible processing chain.
Investigate prompt injection in sandboxed security challenges by tracing how untrusted text changes an agent’s decisions or tool calls. Build a minimal reproduction and preserve evidence showing where external content crosses into trusted instructions or actions.
Investigate hidden data in CTF images, audio, video, and documents. Examine file structure and candidate hiding channels, then extract and reconstruct the payload while preserving intermediate files and reproducible steps.
Assess the security of LLM applications and AI agents by tracing inputs, retrieved content, tool calls, and outputs. Covers prompt injection, where content carries unwanted instructions, along with permission misuse, memory poisoning, and supply-chain risks.