Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing.
中文简介正在准备中。当前显示原文说明。
dhicoc/dsh-reverse-skill3022026年10月8日 更新
免费在 GitHub 公开
competition-browser-persistence
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for browser cookies, localStorage, sessionStorage, IndexedDB, Cache Storage, service workers, offline caches, and client-side session persistence. Use when the user asks to inspect browser state, replay cached auth or session behavior, explain why a page behaves differently after load, or trace how stored client state changes requests, rendering, or access. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
中文简介正在准备中。当前显示原文说明。
dhicoc/dsh-reverse-skill星标 302(GitHub 302 + cccskills 0)
实测评分 未实测
查看安装方法包含的文件（3）
- SKILL.md3.1 KB
- agents/openai.yaml407 B
- references/browser-persistence.md1.1 KB
SKILL.md（原文）
安装前可以查看交给 AI 代理的指令内容。
Competition Browser Persistence
Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.
Use this skill when the decisive branch lives in browser-held state rather than only in visible HTML or backend source.
Reply in Simplified Chinese unless the user explicitly requests English.
Quick Start
- Identify the active persistence surface first: cookie jar, localStorage, sessionStorage, IndexedDB, Cache Storage, or service worker.
- Record origin, scope, domain, path, expiry, and key names before mutating state.
- Tie stored state to one concrete effect: request header, rendered branch, cached response, offline behavior, or hidden route access.
- Separate boot-time state from runtime-mutated state.
- Reproduce the smallest stateful sequence that reaches the decisive branch.
Workflow
1. Map Browser State Surfaces
- Inspect cookies, storage buckets, service worker registrations, cache entries, and transient globals exposed during boot.
- Record which origin, host, route, or feature flag each state item actually applies to.
- Keep auth tokens, refresh material, CSRF state, cached responses, and feature toggles in separate evidence blocks.
2. Tie State To Runtime Behavior
- Show how stored state becomes request headers, role derivation, route visibility, cached API data, or offline fallback behavior.
- Compare clean-state and mutated-state runs with one variable changed at a time.
- Distinguish UI-only state from backend-accepted state.
3. Reduce To The Decisive Persistence Chain
- Compress the result to the smallest chain: initial page or login -> state persisted -> subsequent request or render branch -> resulting capability.
- Keep extracted storage, service worker scripts, and replay steps tied to the same origin and route.
- If the problem broadens into general web routing or worker behavior outside browser persistence, switch back to the broader web-runtime skill.
Read This Reference
- Load
references/browser-persistence.mdfor the browser-state checklist, service-worker checklist, and evidence packaging.
What To Preserve
- Cookie attributes, storage keys, database names, cache keys, service worker scopes, and origin boundaries
- The exact request or render effect caused by each decisive state item
- Clean-state vs mutated-state reproduction steps for the smallest working path
评价
还没有评价。欢迎分享你的使用感受。
评论
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
同一仓库的技能
在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。
中文简介正在准备中。当前显示原文说明。
dhicoc/dsh-reverse-skill3022026年10月8日 更新
Use for authorized multi-stage attack-path planning and orchestration when a task spans reconnaissance, initial access, privilege escalation, lateral movement, or impact assessment. Route single-stage tasks directly to their specialist skill.
中文简介正在准备中。当前显示原文说明。
dhicoc/dsh-reverse-skill3022026年10月8日 更新
跨版本符号迁移与二进制差分。当你有旧版本的符号/逆向结果，需要快速迁移到新版本时使用。 适用场景：内核缺 PDB 用旧版符号推导、程序更新后批量迁移函数名、应用更新后快速定位新偏移。 核心方法：用 LLM 做结构化差异比对，程序化输入输出，成本极低（200 函数 ~1 元）。 触发关键词：符号迁移、bindiff、跨版本、PDB 缺失、函数偏移迁移、symbol migration、binary diff、版本对比。
中文简介正在准备中。当前显示原文说明。
dhicoc/dsh-reverse-skill3022026年10月8日 更新
Use for authorized binary analysis in Binary Ninja, including HLIL/MLIL/LLIL inspection, strings/imports/exports, cross-references, types, patch review, Python API automation, and optional Binary Ninja MCP or localhost HTTP integration.
中文简介正在准备中。当前显示原文说明。
dhicoc/dsh-reverse-skill3022026年10月8日 更新
统一自动化入口。覆盖浏览器自动化（Playwright）和 Windows 桌面应用自动化（OpenReverse）。 浏览器场景：打开网页、点击、填表、爬取、截图、自动化登录、渗透页面交互。 桌面场景：操作 IDA/x64dbg 等 GUI 工具、Windows UI Automation、视觉驱动交互、桌面应用网络抓包。 触发关键词：浏览器自动化、桌面自动化、打开网页、填表、爬取、截图、自动化登录、Playwright、agent-browser、headless、OpenReverse、UIA、CUA、桌面操作、Windows 自动化。
中文简介正在准备中。当前显示原文说明。
dhicoc/dsh-reverse-skill3022026年10月8日 更新