菜单
Extracts hidden data from files and analyzes forensic artifacts. Use when working with images, memory dumps, disk images, steganography, file carving, or when searching for hidden flags in files.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | forensics |
| description | Extracts hidden data from files and analyzes forensic artifacts. Use when working with images, memory dumps, disk images, steganography, file carving, or when searching for hidden flags in files. |
| allowed-tools | Bash, Read, Write, Grep, Glob |
Progress:
- [ ] Identify file type (file, xxd)
- [ ] Check metadata (exiftool)
- [ ] Search strings for flag
- [ ] Check for embedded data (binwalk)
- [ ] Try steganography tools
- [ ] Extract hidden content
file suspicious_file
exiftool suspicious_file
strings suspicious_file | grep -iE "flag|ctf|secret|key"
binwalk suspicious_file
| File Type | Approach | Reference |
|---|---|---|
| Image (PNG/JPG) | Steganography | reference/steganography.md |
| Memory dump | Volatility | reference/memory.md |
| Unknown/corrupted | File analysis | reference/file-analysis.md |
| PCAP | Network skill | Use networking skill |
# Try AperiSolve first (online)
# https://www.aperisolve.com/
# PNG
zsteg image.png
zsteg -a image.png
# JPEG
steghide extract -sf image.jpg
stegseek image.jpg rockyou.txt # Brute force
Full techniques: reference/steganography.md
# Volatility 3
vol -f memory.dmp windows.info
vol -f memory.dmp windows.pslist
vol -f memory.dmp windows.filescan | grep -i flag
Full techniques: reference/memory.md
binwalk -e suspicious_file # Extract embedded files
foremost -i file -o output/ # Carve files
# Fix corrupted header
xxd file | head -10 # Check magic bytes
Full techniques: reference/file-analysis.md
| Tool | URL | Purpose |
|---|---|---|
| AperiSolve | aperisolve.com | All-in-one stego |
| StegOnline | stegonline.georgeom.net | Image analysis |
| CyberChef | gchq.github.io/CyberChef | Data transform |
Analyzes binary files for vulnerabilities and develops exploits. Use when working with ELF/PE executables, pwn challenges, buffer overflow, heap exploitation, ROP chains, format string bugs, or shellcode development.
Breaks cryptographic systems and decrypts ciphertext. Use when working with RSA, AES, XOR, classical ciphers, hash functions, or when challenge involves encryption, decryption, keys, or mathematical crypto attacks.
Reverses and exploits mobile applications. Use when working with Android APK files, iOS IPA files, mobile app reversing, Frida hooking, or app security analysis challenges.
Analyzes network traffic and exploits protocols. Use when working with PCAP files, Wireshark captures, packet analysis, protocol exploitation, traffic forensics, or data exfiltration detection.
Gathers intelligence from public sources. Use when searching for usernames, geolocating images, investigating social media, analyzing domains, or solving information gathering challenges.
Escapes Python sandbox restrictions. Use when working with restricted Python eval/exec environments, sandbox escapes, filtered input challenges, or Python jail challenges.