269 skills · sorted by relevance
Route CTF, attack-and-defense competition, and practice-lab tasks through initial scope checks to a dedicated orchestrator. This entry skill hands off specialist selection while preserving priority for more specific pwn, APK, or IDA routes.
Examine container isolation in a CTF sandbox, a controlled security challenge environment. The skill checks kernel and runtime conditions, verifies whether an exploit crosses into host context, and preserves a minimal reproducible chain with evidence.
Trace how JWT, JWS, and JWE tokens become accepted identities or privileges in a CTF sandbox. Examine headers, key selection, and claims, the token's attributes, then preserve a minimal reproducible path demonstrating validation confusion.
Organize CTF investigations by mapping the supplied targets, tracing one minimal path, and selecting the relevant specialist workflow. Findings are grounded in observed behavior and reproducible evidence, with a clean baseline used for verification.
Solve sandboxed CTF security challenges by reconstructing encoding and encryption steps, extracting data hidden in media, and tracing mobile app signing or storage behavior. Preserve exact parameters and evidence to reproduce decoded content or signed requests.
Analyze encrypted ZIP challenges in a CTF sandbox and use bkcrack to recover legacy ZipCrypto keys from known file contents. Create a decrypted archive, validate extraction, and preserve the commands and evidence needed to reproduce the result.
Investigate hidden data in CTF images, audio, video, and documents. Examine file structure and candidate hiding channels, then extract and reconstruct the payload while preserving intermediate files and reproducible steps.
Trace SSH keys, tokens, and other credentials in Linux CTF environments. Connect each recovered artifact to the service that accepts it, then document the resulting privileges or movement to another host.
Investigate web applications in a CTF sandbox by tracing real browser requests, stored state, API calls, and background jobs. Compare successful and failing flows to explain authentication, routing, and differences between interface and server behavior.
Identify software protections that hinder inspection, such as debugger detection and obfuscation that makes code harder to understand. Support authorized binary analysis and CTF security challenges with protection findings, bypass strategies, reports, and analysis scripts.
Compare how proxies and backend servers interpret HTTP requests in a CTF sandbox. Use paired requests and logs to pinpoint differences in paths, headers, or message boundaries, then document a minimal reproduction of unintended routing.
Trace movement between Windows hosts in a CTF sandbox using credentials and Kerberos tickets, which carry authentication information. Connect recovered artifacts to the service that accepted them and document the resulting access or privileges.
Analyze running containers in a CTF sandbox by comparing declared configuration with live processes, mounts, and routes. Trace how secrets and helper containers affect behavior, then document the earliest mismatch and a minimal evidence chain.
Build an evidence-backed incident timeline in a CTF sandbox by correlating logs, network captures, and other artifacts. Trace attacker actions across sources, distinguish confirmed events from inferred gaps, and preserve the sequence that supports the conclusion.
Analyze running iOS apps in a CTF sandbox, a controlled challenge environment. Trace methods, inspect secure storage, and examine request signing and certificate checks to identify the state needed to reproduce an accepted request.
Recover hidden malware settings and communication parameters in an isolated CTF environment. Document how values are decoded, preserve supporting evidence, and connect recovered fields to the sample’s observed behavior.
Investigate Kubernetes permissions and cluster behavior in CTF sandboxes. Trace role-based access control, service accounts, and automated controllers to explain workload changes, secret exposure, and differences between configuration files and live objects.
Investigate Kerberos delegation, which lets services act on another identity, in a CTF sandbox. Trace delegation settings, issued tickets, and service acceptance to document a reproducible trust path and the privileges it actually grants.
Trace forced authentication and relay chains in a CTF sandbox. Identify what triggers authentication, which service accepts the forwarded identity, and what privilege or artifact results, while distinguishing captured authentication from a successfully accepted relay.
Inspect firmware in a CTF sandbox, map its partitions, and trace startup and update steps. Connect extracted files, credentials, and configuration to device behavior, preserving evidence for a minimal reproducible path.
Trace OAuth and OIDC sign-in flows in a CTF sandbox, from redirects through token exchange to application acceptance. Show where tokens become a recognized identity or permission, and preserve the smallest reproducible flow.
Analyze a custom protocol in a CTF sandbox and reproduce an accepted exchange. Recover message boundaries, checksums, and session state, then build a small replay program that preserves the required message order.
Investigate Windows secrets protected by DPAPI, a system for encrypting sensitive data, in a CTF sandbox. Trace the required keys and account context through decryption, then verify which service accepts the recovered secret.
Trace how access to cloud metadata leads to issued credentials and accepted privileges in a CTF sandbox. Organize endpoints, identity details, and API evidence into a minimal, reproducible path showing where trust is granted.