Zhao

Compare how proxies and backend servers interpret HTTP requests in a CTF sandbox. Use paired requests and logs to pinpoint differences in paths, headers, or message boundaries, then document a minimal reproduction of unintended routing.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Compare HTTP interpretation across proxies and backend servers
• Investigate path normalization and decoding differences
• Trace routing changes caused by ambiguous headers

Reproduce timing and ordering bugs in a CTF sandbox using controlled concurrent requests. Compare normal and racing runs, trace reads and writes, and preserve a minimal sequence that demonstrates duplicate actions or inconsistent state.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reproduce bugs triggered by simultaneous requests
• Investigate duplicate actions and ineffective duplicate prevention
• Trace stale reads and gaps in locking

Analyze a custom protocol in a CTF sandbox and reproduce an accepted exchange. Recover message boundaries, checksums, and session state, then build a small replay program that preserves the required message order.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Recover message boundaries in an unknown protocol
• Reconstruct handshake steps and session state
• Build a replay program for a captured exchange

Trace mailbox abuse in a CTF sandbox, a controlled security challenge environment. The skill connects OAuth permissions, forwarding rules, delegated access, and message logs to concrete mail effects, documenting the smallest reproducible sequence and supporting evidence.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Trace how OAuth consent enables mailbox access
• Investigate forwarding and inbox rule effects
• Verify shared mailbox and delegated access

Trace SSH keys, tokens, and other credentials in Linux CTF environments. Connect each recovered artifact to the service that accepts it, then document the resulting privileges or movement to another host.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Trace where recovered SSH keys and tokens are accepted
• Document privilege gains through sockets or sudo
• Explain movement between Linux challenge hosts

Trace queued jobs from submission to their eventual effects in a CTF sandbox. Compare request-time and worker-time settings, follow retries and failed-message handling, and document the smallest sequence that explains a worker-specific result.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Trace a queued payload to its eventual downstream effect
• Compare request-time settings with worker runtime state
• Investigate retries and dead-letter queue handling

Analyze packet captures in a CTF sandbox by rebuilding communication sessions and decoding message contents. Recover transferred files and connect packet order, timing, and reconstructed streams to observed host or malware behavior.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Rebuild TCP or UDP communication sessions
• Decode HTTP, DNS, or custom protocol messages
• Recover files transferred over the network

Analyze WebSocket and SSE realtime connections in CTF sandboxes. Trace connection setup, authentication, subscriptions, and message sequences to explain changes in displayed or stored state and identify the smallest sequence that reproduces them.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inspecting connection setup and authentication data
• Decoding realtime messages and subscription flow
• Tracing reconnect behavior and message order

Investigate Kerberos delegation, which lets services act on another identity, in a CTF sandbox. Trace delegation settings, issued tickets, and service acceptance to document a reproducible trust path and the privileges it actually grants.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Identifying constrained, unconstrained, or resource-based delegation
• Tracing S4U steps and issued authentication tickets
• Verifying ticket acceptance and resulting privileges

Trace forced authentication and relay chains in a CTF sandbox. Identify what triggers authentication, which service accepts the forwarded identity, and what privilege or artifact results, while distinguishing captured authentication from a successfully accepted relay.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Identify what triggers forced authentication
• Find which service accepts relayed authentication
• Connect relay acceptance to resulting privileges

Compare GraphQL and RPC contracts, which describe expected API behavior, with generated clients and live handlers in a CTF sandbox. Identify hidden or outdated operations and preserve minimal request pairs that demonstrate the mismatch.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Compare API contracts with live request handling
• Trace requests made by generated clients
• Investigate hidden or outdated API operations

Trace uploaded files through extraction, conversion, parsing, and reconstruction of saved objects in a CTF sandbox, an isolated competition environment. Preserve original and derived files, distinguish visible validation from backend behavior, and document the smallest reproducible processing chain.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Trace an uploaded file to its backend effect
• Investigate archive extraction and preview generation
• Compare visible validation with backend file handling

Build an evidence-backed incident timeline in a CTF sandbox by correlating logs, network captures, and other artifacts. Trace attacker actions across sources, distinguish confirmed events from inferred gaps, and preserve the sequence that supports the conclusion.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Combine logs and network captures into an incident timeline
• Trace attacker actions from initial access to persistence
• Separate confirmed event order from inferred gaps

Investigate web applications in a CTF sandbox by tracing real browser requests, stored state, API calls, and background jobs. Compare successful and failing flows to explain authentication, routing, and differences between interface and server behavior.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Trace authentication and session flows
• Compare browser state with server behavior
• Follow uploads and background jobs

Analyze running iOS apps in a CTF sandbox, a controlled challenge environment. Trace methods, inspect secure storage, and examine request signing and certificate checks to identify the state needed to reproduce an accepted request.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Trace Objective-C or Swift methods
• Inspect Keychain and local app storage
• Examine certificate checks and request signing

Inspect compiled programs in Binary Ninja using strings, function references, and intermediate representations—views of program logic at different levels. Trace data flow and report findings with addresses, supporting evidence, confidence, and reproduction steps.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Tracing function calls and data flow in Binary Ninja
• Cross-checking findings from other disassemblers
• Automating binary analysis with the Python API

Develop exploit code from a known memory corruption flaw, then investigate differences between local and remote execution. Covers stack, heap, and Linux kernel cases, with attention to library versions, debugging, and repeatable results.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Developing exploit code for a known vulnerability
• Investigating why a CTF exploit fails remotely
• Checking library versions and memory protections

Analyze suspected malware through code inspection and behavior observed in an isolated environment. Extract indicators of compromise, such as suspicious domains and file paths, and create YARA file-matching rules or Sigma behavior-detection rules from the findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious executables, scripts, and macros
• Extracting malicious domains, file paths, and other indicators
• Creating YARA and Sigma detection rules

Investigate Active Directory Certificate Services in an isolated CTF competition environment. Trace certificate templates and enrollment rights through issuance, identity mapping, and service acceptance to explain resulting privileges and document a minimal reproducible chain.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inspect certificate templates and enrollment rights
• Trace certificate issuance to accepted authentication
• Identify configuration weaknesses behind granted privileges

Analyze executable files and libraries with IDA Pro. Inspect pseudocode, strings, function calls, and data flow, then add meaningful names and comments and produce a Markdown report documenting findings and analysis steps.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating executable files and libraries
• Tracing processing from strings and function calls
• Organizing analysis with comments and meaningful names

Analyze firmware from routers, cameras, and other IoT devices, from extracting internal files to running services in an emulator. Follow a staged workflow to investigate vulnerabilities and reproduce findings with firmware analysis and testing tools.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing router or camera firmware
• Inspecting firmware update packages
• Running firmware without physical hardware

Analyze Android and iOS apps through package inspection, code analysis, runtime observation, and network traffic review. Support authorized security testing of embedded secrets, certificate checks, device protection checks, and cryptographic behavior.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inspecting APK or IPA permissions and configuration
• Checking code for embedded keys and tokens
• Observing app behavior with Frida or Objection

Support authorized hardware security research by locating debug interfaces, recording pin assignments and voltage levels, and collecting boot logs. Assess interface locks and firmware extraction options, then hand extracted images to firmware analysis tools.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Locate UART, JTAG, and SWD debug interfaces
• Collect and document boot logs
• Assess secure boot and encrypted flash

Investigate signs of intrusion through hypothesis-led log searches, then turn findings into detection rules. Supports Sigma, YARA, and SIEM queries, with attention to false positives, data field mapping, and validation against historical logs.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Hunting for intrusion signs in security logs
• Turning findings into Sigma or YARA rules
• Investigating false positives and tuning alerts