CTF web challenge SQL injection hunting and exploitation. Trigger when web-recon has identified injectable endpoints or params, need to confirm, exploit, and extract data including flags from the database.
CTF web challenge reconnaissance. Trigger when starting a new web target, need to enumerate endpoints, identify technologies, discover forms and inputs, or map attack surface before exploitation.
CTF web challenge authentication bypass. Trigger when web-recon has identified login forms, admin panels, JWT tokens, session cookies, or access control mechanisms that need bypass testing.
CTF blackbox cryptographic token hunter. Trigger when web_recon finds JWT tokens, JWE tokens, encrypted cookies, weak session tokens, or exposed public keys. Tests JWT algorithm confusion, weak secrets, JWE public key forge, predictable tokens. Does NOT…
CTF web challenge file upload bypass and webshell. Trigger when web-recon identifies file upload forms, avatar/attachment endpoints, or import functionality.
CTF web challenge final analysis and flag extraction. Trigger after all hunting agents have completed, need to aggregate findings, extract flag from collected data, or escalate remaining leads to get the flag.
CTF web challenge IDOR and broken access control. Trigger when web-recon identifies user-specific resources, numeric IDs in URLs, API endpoints, or JWT/session-based access control.
CTF web challenge LFI, path traversal, and RCE via LFI. Trigger when web-recon identifies file parameters, include/require patterns, or path traversal indicators.