Ctf Web
Provides web exploitation techniques for CTF challenges.
Install
npx skills add ljagiello/ctf-skills --skill ctf-web -g -a claude-code -y- Repository
- ljagiello/ctf-skills3.6k
- Category
- Design
- Updated
- 5d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- Yes, review before use
What it does
Provides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, identity flow, or smart-contract frontend/backend surface, including XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, request smuggling, OAuth/OIDC, SAML, prototype pollution, and similar web bugs. Do not use it for native binary memory corruption, reverse engineering of standalone executables, disk or memory forensics, or pure cryptanalysis unless the web flaw is still the main path to the flag.
CTF Web Exploitation
Use this skill as a routing and execution guide for web-heavy challenges. Keep the first pass short: map the app, confirm the trust boundary, and only then dive into the detailed technique notes.
Prerequisites
Python packages (all platforms):
pip install sqlmap flask-unsign requests httpx
Linux (apt):
apt install hashcat jq curl
macOS (Homebrew):
brew install hashcat jq curl
Go tools (all platforms, requires Go):
go install github.com/ffuf/ffuf/v2@latest
Manual install:
- ysoserial, GitHub, requires Java (Java deserialization payloads)
- PayloadsAllTheThings, git clone to ctf-web/payloads/PayloadsAllTheThings (auto via install script or lazy clone)
bash scripts/install_ctf_tools.sh pat # PAT only bash scripts/install_ctf_tools.sh all # all tools including PAT # manual fallback: git clone --depth 1 https://github.com/swisskyrepo/PayloadsAllTheThings.git ctf-web/payloads/PayloadsAllTheThingsPAT is optional and on-demand, not required at load time. The skill works without it (graceful degrade):
pat-reference.mdprovides an offline index with exemplar payloads; bulk wordlists require the clone above.
MCP servers (optional): Playwright MCP (microsoft/playwright-mcp) for browser-dependent challenges (DOM XSS, admin bot, SPA client secrets) and Burp Suite MCP (PortSwigger/mcp-server) for wire-level work (header-level HTTP/1.1+HTTP/2 control, smuggling, blind SSRF/XXE via Collaborator, proxy-history regex mining), see tools-mcp.md. Two things to do before relying on Burp MCP: start Burp before the agent, and turn off the two approval gates in Burp's MCP tab or the first tool call blocks on a modal dialog.
