# Ctf Web

Provides web exploitation techniques for CTF challenges.

- Repository: https://github.com/ljagiello/ctf-skills (3598 stars)
- Category: Design
- License: MIT
- Last updated: 2026-10-30
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add ljagiello/ctf-skills --skill ctf-web -g -a claude-code -y`
Codex: `npx skills add ljagiello/ctf-skills --skill ctf-web -g -a codex -y`
Cursor: `npx skills add ljagiello/ctf-skills --skill ctf-web -g -a cursor -y`
Gemini CLI: `npx skills add ljagiello/ctf-skills --skill ctf-web -g -a gemini-cli -y`

## Description

Provides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, identity flow, or smart-contract frontend/backend surface, including XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, request smuggling, OAuth/OIDC, SAML, prototype pollution, and similar web bugs. Do not use it for native binary memory corruption, reverse engineering of standalone executables, disk or memory forensics, or pure cryptanalysis unless the web flaw is still the main path to the flag.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# CTF Web Exploitation

Use this skill as a routing and execution guide for web-heavy challenges. Keep the first pass short: map the app, confirm the trust boundary, and only then dive into the detailed technique notes.

## Prerequisites

**Python packages (all platforms):**
```bash
pip install sqlmap flask-unsign requests httpx
```

**Linux (apt):**
```bash
apt install hashcat jq curl
```

**macOS (Homebrew):**
```bash
brew install hashcat jq curl
```

**Go tools (all platforms, requires Go):**
```bash
go install github.com/ffuf/ffuf/v2@latest
```

**Manual install:**
- ysoserial, [GitHub](https://github.com/frohoff/ysoserial), requires Java (Java deserialization payloads)
- PayloadsAllTheThings, git clone to ctf-web/payloads/PayloadsAllTheThings (auto via install script or lazy clone)
  ```bash
  bash scripts/install_ctf_tools.sh pat   # PAT only
  bash scripts/install_ctf_tools.sh all   # all tools including PAT
  # manual fallback:
  git clone --depth 1 https://github.com/swisskyrepo/PayloadsAllTheThings.git ctf-web/payloads/PayloadsAllTheThings
  ```
  > PAT is optional and on-demand, not required at load time. The skill works without it (graceful degrade): `pat-reference.md` provides an offline index with exemplar payloads; bulk wordlists require the clone above.

**MCP servers (optional):** Playwright MCP ([microsoft/playwright-mcp](https://github.com/microsoft/playwright-mcp)) for browser-dependent challenges (DOM XSS, admin bot, SPA client secrets) and Burp Suite MCP ([PortSwigger/mcp-server](https://github.com/PortSwigger/mcp-server)) for wire-level work (header-level HTTP/1.1+HTTP/2 control, smuggling, blind SSRF/XXE via Collaborator, proxy-history regex mining), see [tools-mcp.md](tools-mcp.md). Two things to do before relying on Burp MCP: start Burp *before* the agent, and turn off the two approval gates in Burp's MCP tab or the first tool call blocks on a modal dialog.

## Additional Resources

The rest: https://github.com/ljagiello/ctf-skills/blob/HEAD/ctf-web/SKILL.md