Manage a live CTF competition with an agent team. Auto-triages challenges, assigns them to teammates, and tracks progress. Use during live CTF competitions when you have multiple challenges to solve in parallel. Triggers: "competition mode", "live CTF", "start competition", "manage CTF", "assign challenges". Requires agent teams enabled.
Solve CTF cryptography challenges including encryption, hashing, and encoding. Use when you see: Base64 (trailing ==), hex strings (32/40/64 chars for MD5/SHA1/SHA256), RSA parameters (n=, e=, c=, p=, q=), XOR-encrypted data, .pem .key .enc files, classical ciphers (Caesar, Vigenere, substitution), encoding chains, or "crack this hash". Tools: xortool, hashid, hashcat, john, RsaCtfTool, openssl.
Solve CTF forensics challenges: memory dumps, network captures, disk images, and file carving. Use when you see: .vmem .raw .dmp memory dumps, .pcap .pcapng network captures, .dd .E01 disk images, or embedded/hidden files. Triggers: "memory dump", "packet capture", "disk image", "file carving", "deleted files", "volatility". Tools: volatility3, binwalk, foremost, tshark, sleuthkit. NOT for steganography (use stego) or binary exploitation (use pwn).
Solve CTF misc challenges: encoding chains, esoteric programming languages, QR codes, logic puzzles, and anything that doesn't fit crypto/forensics/stego/web/pwn/reverse/osint. Use when you see: Brainfuck (+[->), Ook!, Whitespace, JSFuck, QR/barcodes, multi-layer encoding (Base64->hex->ROT13), or "what encoding is this". Triggers: "decode this", "esoteric language", "QR code", "barcode", "encoding chain", "CyberChef", unusual character sets. Tools: CyberChef, zbarimg, dcode.fr, online interpreters.
Solve CTF OSINT (open source intelligence) challenges: username enumeration, domain recon, social media investigation, geolocation from images, and public records research. Use when given a username, email, domain, or photo to investigate. Triggers: "find this person", "username lookup", "who is", "geolocation", "reverse image search", "EXIF GPS", "whois", "domain recon", "social media". Tools: sherlock, theHarvester, exiftool, whois, dig. NOT for web app exploitation (use web).
Solve CTF binary exploitation (pwn) challenges: buffer overflows, format strings, ROP chains, heap exploitation, and shellcoding. Use when given ELF/PE binaries with a remote service to exploit. Triggers: "buffer overflow", "format string", "ROP", "shellcode", "checksec", "NX", "canary", "PIE", "GOT overwrite", "ret2libc", pwntools scripts, .elf files, nc/netcat connection targets. Tools: checksec, ROPgadget, pwntools, gdb, one_gadget. NOT for static reverse engineering (use reverse).
Solve CTF reverse engineering challenges: disassembly, decompilation, key/password finding, algorithm analysis, and anti-debug bypass. Use when given binaries to analyze statically — crackmes, keygens, obfuscated code. Triggers: .exe .elf .apk .jar .pyc files, "disassemble", "decompile", "keygen", "crackme", "find the password", "anti-debugging", radare2/Ghidra output, assembly code. Tools: radare2, Ghidra, objdump, ltrace, strace, jadx, uncompyle6. NOT for exploitation/pwn (use pwn) or malware triage (use forensics).
Solve CTF steganography challenges: hidden data in images, audio, and media files. Use when you see: .png .jpg .bmp .gif images, .wav .mp3 .flac audio, or suspect LSB encoding, appended data after EOF, hidden metadata, spectrogram messages. Triggers: "hidden message", "LSB", "steganography", "hidden in image", "zsteg", "steghide", "exiftool". Tools: zsteg, steghide, exiftool, binwalk, stegsolve. NOT for file carving from disk images (use forensics).