Ctf Forensics

A sprawling forensics reference that covers the full CTF forensics spectrum, from standard Volatility memory analysis and PCAP inspection to genuinely obscure corners like ICMP timing channels, USB keyboard LED Morse exfiltration, and CD audio disc steganography. The skill is organized into a dozen supporting markdown files grouped by domain (disk, network, steganography, signals), each packed with one-liner commands and technique descriptions for challenges involving disk images, memory dumps, network captures, and hardware signals. It's built for Claude Code with bash and Python 3, expecting you to install tools like binwalk, Volatility, Wireshark, and various stego utilities as you go. The breadth is impressive but you'll need to know when to stop forensics and pivot to the crypto, malware, or reversing skills when you've extracted the real payload.

skills.sh installs: 9.7K
GitHub stars: 3.7K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add ljagiello/ctf-skills --skill ctf-forensics --agent claude-code

Installs into .claude/skills of the current project.

Files

CTF Forensics & Blockchain

Quick reference for forensics CTF challenges. Each technique has a one-liner here; see supporting files for full details.

Prerequisites

Python packages (all platforms):

pip install volatility3 Pillow numpy matplotlib scipy librosa scikit-learn opencv-python-headless pymongo impacket brotli exrex stegano heatshrink2

Linux (apt):

apt install binwalk foremost libimage-exiftool-perl tshark sleuthkit \
  ffmpeg steghide testdisk john pcapfix

macOS (Homebrew):

brew install binwalk exiftool wireshark sleuthkit ffmpeg \
  testdisk john-jumbo

Ruby gems (all platforms):

gem install zsteg

Additional Resources

SKILL.md on GitHub

Details

Repository: github.com/ljagiello/ctf-skills
Categories: DevOps & CI/CD, Office & Documents

More from ljagiello/ctf-skills

All 11