Claude MarketplacesSubmit
ljagiello avatar

Ctf Web

ljagiello/ctf-skills

A comprehensive web exploitation guide covering everything from SQLi and SSTI to OAuth bypasses and prototype pollution. The workflow is smart: map the app, confirm trust boundaries, then dive into technique docs. You get 15+ markdown references spanning injection, deserialization, auth manipulation, and client-side attacks, plus prereq commands for sqlmap, ffuf, flask-unsign, and ysoserial. The field notes pull from real CTF write-ups (CSAW, PlaidCTF, 35C3) with specifics like Xalan XSLT seed guessing and SoapClient CRLF smuggling. It tells you when to pivot to pwn, crypto, or forensics skills if the challenge shifts. Best for HTTP-first targets where the flag lives in a database, API response, or behind broken auth rather than native binaries.

skills.sh installs
10.3K
GitHub stars
3.7K
last updated
Aug 21, 2026
View on GitHub

Install

$ npx -y skills add ljagiello/ctf-skills --skill ctf-web --agent claude-code

Installs into .claude/skills of the current project.

Files

CTF Web Exploitation

Use this skill as a routing and execution guide for web-heavy challenges. Keep the first pass short: map the app, confirm the trust boundary, and only then dive into the detailed technique notes.

Prerequisites

Python packages (all platforms):

pip install sqlmap flask-unsign requests httpx

Linux (apt):

apt install hashcat jq curl

macOS (Homebrew):

brew install hashcat jq curl

Go tools (all platforms, requires Go):

go install github.com/ffuf/ffuf/v2@latest
SKILL.md on GitHub

Sponsors

Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthlyAgent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any language

Details

Repository
github.com/ljagiello/ctf-skills
Categories
Frontend Development, Backend & APIs, Security, Automation & Workflows, Web3 & Blockchain

More from ljagiello/ctf-skills

All 11

Recommended

More Frontend Development
1nomadamas avatarrhwp-advancednomadamas/k-skillDebug HWP layout, dump document IR, compare versions, extract thumbnails, and unlock read-only HWPs with the upstream rhwp Rust CLI (export-svg/dump/dump-pages/10.3Kskills.sh installs
2jeffallan avatarwordpress-projeffallan/claude-skillsDevelops custom WordPress themes and plugins, creates and registers Gutenberg blocks and block patterns, configures WooCommerce stores, implements WordPress RES10.2Kskills.sh installs
3manaflow-ai avatarcmuxmanaflow-ai/cmuxEnd-user control of cmux topology and routing (windows, workspaces, panes/surfaces, focus, moves, reorder, identify, trigger flash). Use when automation needs d10.1Kskills.sh installs
4langchain-ai avatarmanaged-deep-agentslangchain-ai/langchain-skillsINVOKE THIS SKILL when building, testing, or deploying Managed Deep Agents in LangSmith with the mda CLI. Covers the code-first, file-based project layout; defi10Kskills.sh installs
5tanis90 avatarpdf-convertertanis90/pdf-converter-mineruPDF converter powered by MinerU — convert PDF to Word, Markdown, HTML, LaTeX, or plain text. Also handles image-to-text OCR, scanned document recognition, and O9.7Kskills.sh installs
6cypress-io avatarcypress-authorcypress-io/ai-toolkitCreates, updates, and fixes Cypress tests (E2E/end-to-end and component tests). Use when the user asks to create tests, add tests, write tests, update tests, te9.5Kskills.sh installs