ctf-pentesting

name	ctf-pentesting
description	Structured penetration testing and CTF challenge methodology for security learning. Use this skill when working on TryHackMe, HackTheBox, or similar CTF platforms, or when analyzing web application security, investigating breaches, performing privilege escalation, or learning offensive security techniques. Triggers on keywords: CTF, pentest, exploit, vulnerability, privilege escalation, reverse shell, nmap, gobuster, flag, THM, HTB, brute force, injection, XSS, SSTI, LFI, RFI, CVE, backdoor, webshell, forensics, breach investigation.
catalog_description	Structured pen-testing and CTF methodology for security learning.

CTF & Penetration Testing Skill

Systematic methodology for Capture The Flag challenges and penetration testing exercises. Designed for experienced developers learning offensive security.

When to Use This Skill

• Working on TryHackMe or HackTheBox challenges
• Analyzing web application security
• Investigating simulated breaches
• Learning exploitation techniques
• Practicing privilege escalation

Methodology: The Kill Chain

Always follow this sequence. Never skip phases.

1. RECON ──> 2. ENUMERATE ──> 3. EXPLOIT ──> 4. POST-EXPLOIT ──> 5. PRIVESC
   │              │                │               │                  │
   nmap           gobuster         injection       shell upgrade      sudo -l
   headers        source code      auth bypass     persistence        SUID
   tech stack     API routes       CVE exploit     data exfil         cron
                  JS analysis      file upload     lateral move       kernel

Phase 1: Reconnaissance

Identify the attack surface. Determine technology stack and versions.

# Quick targeted scan
nmap -sV -sC -p 22,80,443,3000,8080,8443 <TARGET>

# Full port scan (run in background)
nmap -sV -p- <TARGET> --min-rate 5000

# Technology fingerprinting
curl -sI http://<TARGET> | grep -iE "server|powered|x-"

Decision tree after recon:

• Web app found → Phase 2: Web Enumeration
• Only SSH → Look for credentials elsewhere, try default creds
• Multiple services → Enumerate each, correlate findings

Phase 2: Enumeration

Extract maximum information before attempting exploitation.

Web enumeration - always run these:

# Directory scan (start with common, escalate to medium)
gobuster dir -u http://<TARGET> -w /usr/share/wordlists/dirb/common.txt \
  -x php,txt,html,js,json,bak,zip -q | grep -v "Status: 404"

# Information disclosure (check ALL of these)
for f in robots.txt .env .env.bak .git/config .git/HEAD package.json \
  composer.json wp-config.php .htaccess sitemap.xml; do
  CODE=$(curl -s -o /dev/null -w "%{http_code}" "http://<TARGET>/$f")
  [ "$CODE" != "404" ] && echo "[${CODE}] /$f"
done

Technology-specific enumeration: See references/tech-specific.md for detailed checks per technology (Next.js, Flask, Spring Boot, PHP, Node.js, etc.)

Phase 3: Exploitation

Match findings to attack vectors. See references/attack-vectors.md.

Critical rule: Always try the simplest attack first.

1. Default/leaked credentials
2. Known CVE for the exact version
3. Common misconfigurations
4. Custom exploitation

Phase 4: Post-Exploitation

After gaining access:

# Stabilize shell
python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm
# Ctrl+Z, then: stty raw -echo; fg

# Grab flags
cat /home/*/user.txt 2>/dev/null
cat /root/root.txt 2>/dev/null

# Situational awareness
whoami && id
hostname
ip addr
cat /etc/passwd | grep -v nologin | grep -v false
ls -la /home/

Phase 5: Privilege Escalation

See references/privesc.md for the full checklist.

Quick wins (check in this order):

sudo -l                                    # Most common path
find / -perm -4000 -type f 2>/dev/null     # SUID binaries
cat /etc/crontab && ls -la /etc/cron.*     # Cron jobs
getcap -r / 2>/dev/null                    # Capabilities
find / -writable -type f 2>/dev/null       # Writable files

Output Rules

Clean output is mandatory. Every scan must filter noise:

• URL scanning: Show only non-404 results
• Use curl -s -o /dev/null -w "%{http_code}" pattern
• Combine related checks into single scripts
• Name scripts descriptively: scan_api.sh, check_creds.sh

Template for URL scanning:

TARGET="http://<ip>:<port>"
for path in <paths>; do
  CODE=$(curl -s -o /dev/null -w "%{http_code}" "$TARGET/$path")
  [ "$CODE" != "404" ] && echo "[${CODE}] /$path"
done

Learning Integration

After each completed challenge, document:

1. Attack path - Step-by-step how access was gained
2. New technique - What was learned
3. Developer lesson - How to prevent this vulnerability
4. Enterprise context - How this applies to real-world systems

Update references/progress-tracker.md with new skills and completed challenges.

Flag Format

• TryHackMe: THM{...}
• HackTheBox: 32-character hex string
• Custom: Check challenge description