void

name	void
description	Curiosity-driven offensive security toolkit for CTF, web vulns, forensics, crypto, OSINT, pwn, and toolchain management. Use when the user asks about hacking, pentesting, CTF challenges, security resources, bug bounty learning, installing security tools, decoding CTF strings, web recon, or mentions Void.

Void — Offensive Security Skill

Void is the anti-roadmap. Help users understand systems, not collect flags.

Quick invoke

User says: /void, "use void skill", "help with this CTF", "what resource for web hacking"

Always prefer the void CLI when available:

void start                    # learning path
void resources search <q>     # find resources
void tools doctor             # check toolchain
void ctf decode "<string>"    # CTF decoding
void ctf forensics file <p>   # file analysis
void ctf web headers <url>    # HTTP analysis
void skill guide              # full agent command reference

If CLI not built: make build or go run ./cmd/void <cmd>

Bash fallbacks: scripts/check-tool.sh, scripts/ctf-decode.sh, scripts/web-recon.sh

Core philosophy (enforce this)

1. Curiosity over roadmaps — one deep dive beats forty bookmarks
2. Build don't consume — suggest building (login system, scraper, bot) before courses
3. Understand WHY — if AI/agent solved a CTF step, user must explain every step
4. Authorized targets only — labs, own apps, bug bounty scope, CTF platforms

Agent workflows

New learner ("how do I become a hacker")

1. void start
2. Recommend ONE entry: void resources open overthewire-bandit
3. void tools doctor — fix missing essentials
4. Do NOT dump the full resource list

CTF challenge (any category)

1. void ctf decode "<encoded>"           # if encoded text
2. void ctf forensics file <artifact>   # files/images/pcaps
3. void ctf hash identify <hash>        # unknown hashes
4. void tools check <needed-tool>       # before running external tools
5. void resources search <category>     # if stuck, find learning resource

After solving: explain what assumption the challenge violated.

Web vulnerability / pentest (authorized)

1. void ctf web headers <url>
2. void ctf web cookies <url>
3. void tools check ffuf sqlmap nuclei burp
4. scripts/web-recon.sh <url>           # if tools installed
5. void resources info portswigger-academy

Check DevTools Network tab, JS bundles, client-side trust. Reference OWASP Top 10 vocabulary.

Forensics / stego

void ctf forensics file <path>
void ctf forensics stego <image>
void tools check exiftool binwalk steghide zsteg
void resources info cyberchef

Crypto CTF

void ctf crypto freq "<ciphertext>"
void ctf crypto xor <hex-ct> <hex-key>
void resources info cryptohack
void resources info cryptopals

Pwn / binary

void ctf pwn checksec <binary>
void tools check gdb pwntools checksec
void resources info pwn-college
void resources info nightmare-pwn

OSINT

void ctf osint dns <domain>
void ctf osint username <name>    # needs sherlock
void resources info osint-framework

Missing tool

void tools check <tool>
void tools install <tool>
scripts/check-tool.sh <tool>
void tools setup-script          # interactive bootstrap

Show install command for user's OS. Never silently fail.

Starred essentials (★)

ID	Name	When
overthewire-bandit	Bandit	First terminal wargame
portswigger-academy	Web Security Academy	Web hacking #1
portswigger-labs	PortSwigger Labs	Practice web vulns
cryptohack	CryptoHack	Learn crypto
pwn-college	pwn.college	Binary exploitation
cyberchef	CyberChef	Encode/decode everything
hacktricks	HackTricks	Mid-test technique lookup
hackerone-hacktivity	H1 Hacktivity	Learn from real bugs
ctftime	CTFtime	Find CTFs + writeups
picoctf	picoCTF	Beginner CTF

Full catalog: void resources list or resources-reference.md

Tool categories

void tools list — recon, web, passwords, network, forensics, pwn, crypto, ad, general

Doctor check: void tools doctor Category filter: void tools doctor -c web

Practice platforms

void resources list practice — HTB, TryHackMe, VulnHub, Root-Me, PortSwigger Labs

Reminder: easy CTF points are automatable — depth over score.

AI/agentic security

void resources list ai-security — MCP, nuclei, Caido, OWASP LLM Top 10, garak

Human does judgment; agents do breadth (recon, JS reading, endpoint mapping).

Additional reference

• resources-reference.md — full resource index by category
• workflows.md — detailed playbooks per vuln class
• tools-reference.md — CLI tool registry + install hints

What NOT to do

• Don't hand flags without explanation
• Don't suggest attacking unauthorized targets
• Don't recommend cert-chasing as primary learning
• Don't dump 40 links when one curious thread works