pentest-ctf

name	pentest-ctf
description	CTF (Capture the Flag) challenge solving advisory — HackTheBox, TryHackMe, PicoCTF, web/pwn/rev/crypto/forensics. Triggers on CTF, HackTheBox, HTB, TryHackMe, THM, PicoCTF, OverTheWire, pwn, reverse engineering, crypto challenge, forensics challenge, stego.
license	MIT
compatibility	Works with Claude Code
allowed-tools	Read Write Edit Bash Grep
metadata	{"author":"badi","homepage":"https://github.com/fatihkan/badi-skills/tree/main/skills/pentest-ctf","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents ctf-solver"}

pentest-ctf

CTF (Capture the Flag) challenge solving. Authorization: CTF platforms authorize attacks on their own platforms (in HackTheBox, THM, etc. ROEs). Use against any other platform counts as a violation.

Triggers

• "HackTheBox machine"
• "TryHackMe room"
• "PicoCTF challenge"
• "pwn challenge"
• "reverse engineering challenge"
• "crypto challenge"
• "stego challenge"

Category-Based Approach

Web

# Typical flag: HTB{...}, picoCTF{...}, flag.txt
# Approach:
1. Nmap full TCP (-p-)
2. HTTP banner + tech detect (whatweb)
3. Content discovery (ffuf / gobuster)
4. Parameter discovery (paramspider, Arjun)
5. SQL injection (sqlmap test but LOUD)
6. SSRF / XXE / SSTI / template injection
7. Source code reveal (.git, .env, backup files)

Pwn (Binary Exploitation)

# Typical: ELF binary + nc <host> <port>
# Approach:
1. `file ./challenge` + checksec
2. Strings + disassemble the main function (Ghidra)
3. Detect the vulnerability class:
   - Buffer overflow (stack)
   - Format string
   - Use-after-free
   - Heap overflow / off-by-one
4. ROP gadget search (ROPgadget / rp++)
5. Write the exploit (pwntools)
6. Local test -> remote

# Pwntools template
from pwn import *
context.arch = 'amd64'
context.log_level = 'debug'

# Local vs remote
local = True
if local:
    p = process('./challenge')
else:
    p = remote('host', port)

# Exploit
payload = b'A'*40 + p64(0xdeadbeef)
p.sendline(payload)
p.interactive()

Reverse Engineering

# Approach:
1. `file ./binary`
2. Strings (ascii + utf16)
3. Ghidra / IDA Free / Cutter
4. Anti-debug bypass (gdb scripts)
5. Decompile + analyze the main algorithm
6. Trace it to produce the output flag

# Standart RE tools
ghidra ./binary
r2 -A ./binary                   # radare2
gdb-peda ./binary                # gdb + PEDA / pwndbg
strace -f ./binary               # syscall trace
ltrace ./binary                  # library call trace

Crypto

# Common attack categories:
# - RSA: small e, common factor, common modulus
# - ECC: weak curve, invalid curve attack
# - AES: ECB pattern, CBC bit flipping, padding oracle
# - Stream: key reuse XOR
# - Hash: length extension, collision

# RSA small e
from Crypto.Util.number import long_to_bytes
import gmpy2
c, e, n = ..., 3, ...
m, exact = gmpy2.iroot(c, e)
if exact: print(long_to_bytes(int(m)))

# XOR cribdrag
from pwn import xor
plaintext_known = b'flag{'
c1, c2 = ..., ...
# c1 XOR c2 = m1 XOR m2 — crib drag with the known plaintext

Forensics

# Disk image / memory dump
file challenge.img
binwalk -e challenge.img         # nested file extraction
volatility -f memory.raw --profile=Win10x64 pslist
exiftool image.jpg               # metadata

# Network capture
wireshark capture.pcap
tshark -r capture.pcap -Y "http" -T fields -e http.host -e http.request.uri

Stego

# Image stego
binwalk -e image.jpg                    # appended data
strings -a image.jpg | head             # ASCII strings
zsteg image.png                         # LSB stego
steghide extract -sf image.jpg          # password required (crack with rockyou)
stegseek image.jpg rockyou.txt          # automatic password crack

# Audio stego
audacity audio.wav                      # spectrogram view (hidden message!)

CTF-Specific Tools

Tool	Usage
pwntools (Python)	Pwn exploit dev
Ghidra / IDA Free	RE
Burp / ZAP	Web
CyberChef	Encoding/decoding (offline)
RsaCtfTool	RSA fast attack
dcode.fr	Cipher recognition
stegsolve.jar	Image bit-plane analysis
binwalk + foremost	File carving

Methodology (General)

1. Read challenge description carefully (2 times)
2. Identify category (web/pwn/rev/crypto/forensics/stego)
3. Quick recon (file, nmap, strings)
4. Initial hypothesis (3 possible approaches)
5. Try in order, drop dead-ends fast
6. Use hints (usually costs points but saves time)
7. Flag format: regex match (HTB{...}, flag{...})
8. Submit + writeup

Writeup Template

# <Challenge Name> — <Category> — <Points>

## Description
[Original challenge text]

## Recon
- file: ELF 64-bit, dynamically linked, NX off
- checksec: No PIE, No Canary, NX disabled

## Vulnerability
Stack-based buffer overflow in `gets()` call, offset 40.

## Exploit
```python
from pwn import *
# ... code

Flag

flag{example_flag_here}

Learning

• gets() forbidden (use fgets)
• NX off + No PIE -> shellcode direct

## Out-of-Scope

- CTF platform ToS violation (real-world exploit attempt)
- Sharing flags (you must solve it yourself)
- Tournament cheating