Individual skill
ctf-web
Provides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, identity flow, or smart-contract frontend/backend surface, including XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, request smuggling, OAuth/OIDC, SAML, prototype pollution, and similar web bugs. Do not use it for native binary memory corruption, reverse engineering of standalone executables, disk or memory forensics, or pure cryptanalysis unless the web flaw is still the main path to the flag.
ctf-web/SKILL.md
Source commit a6106aaf5f1f4eeb6b95908f11c2314c7150dfac
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Network or broad shell
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 3,669
- Repository last updated
- Nov 6, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent-skills Repository topic
- claude-code-skills Repository topic
- ctf Repository topic
- security Repository topic
- claude-code Repository topic
- codex Repository topic
- codex-cli Repository topic
- gemini Repository topic
- gemini-cli Repository topic
- opencode Repository topic
- engineering Derived category
- legal Derived category
- security Derived category
- security-application Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 17,215 bytesSKILL.mdcore · 17,215 bytesSKILL.mdcore · 17,215 bytesSKILL.mdcore · 17,215 bytesSKILL.mdcore · 17,215 bytesSKILL.mdcore · 17,215 bytesSKILL.mdcore · 17,215 bytesSKILL.mdcore · 17,215 bytesSKILL.mdcore · 17,215 bytesSKILL.mdcore · 17,215 bytesSKILL.mdcore · 17,215 bytesSKILL.mdcore · 17,215 bytesSKILL.mdcore · 17,215 bytesSKILL.mdcore · 17,215 bytesSKILL.mdcore · 17,215 bytesauth-and-access-2.mddoc · 5,200 bytesauth-and-access.mddoc · 60,041 bytesauth-infra.mddoc · 16,903 bytesauth-jwt.mddoc · 11,351 bytesclient-side-advanced.mddoc · 39,923 bytesclient-side.mddoc · 24,209 bytescves.mddoc · 16,275 bytesfield-notes.mddoc · 43,959 bytesnode-and-prototype.mddoc · 6,842 bytespat-reference.mddoc · 12,966 bytespython-requests.mddoc · 20,904 bytesscripts/async_fuzz.pyruns · 7,061 bytesserver-side-2.mddoc · 15,855 bytesserver-side-advanced-2.mddoc · 26,297 bytesserver-side-advanced-3.mddoc · 7,099 bytesserver-side-advanced-4.mddoc · 22,250 bytesserver-side-advanced.mddoc · 16,184 bytesserver-side-deser.mddoc · 22,411 bytesserver-side-exec-2.mddoc · 39,597 bytesserver-side-exec.mddoc · 21,998 bytesserver-side.mddoc · 30,450 bytessql-injection.mddoc · 39,055 bytestools-mcp.mddoc · 35,878 bytesweb3.mddoc · 17,365 bytes
Read excerpt
# CTF Web Exploitation
Use this skill as a routing and execution guide for web-heavy challenges. Keep the first pass short: map the app, confirm the trust boundary, and only then dive into the detailed technique notes.
## Prerequisites
**Python packages (all platforms):**
```bash
pip install sqlmap flask-unsign requests httpx
```
**Linux (apt):**
```bash
apt install hashcat jq curl