[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GQA72SS4DZVJ4SCVGD7HX8":3,"skill-same:01M6GQA72SS4DZVJ4SCVGD7HX8":94},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":22,"linkOnly":23,"markdownContent":24,"markdownBody":25,"frontMatter":26,"refName":27,"commitSha":28,"skillDirectory":29,"forksCount":30,"repositoryHtmlUrl":31,"repositoryHomepageUrl":6,"ownerHtmlUrl":32,"ownerBlogUrl":33,"ownerDescription":34,"updatedAt":35,"install":36,"resources":49},"01M6GQA72SS4DZVJ4SCVGD7HX8","riegan-ctf-web",null,"jiayaoqijia\u002Fcryptoskill","jiayaoqijia","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1453879?v=4","01M6GMYTX7Q7S504VC6E756ENR","YQ","01M6GMYV1QKJ1CC75MTTGT9PR0",81,"AGPL-3.0","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-web\u002FSKILL.md",[],[18,19,20,21],"web","ctf","riegan ctf web","riegan ctf","2026-11-10 10:12:30",false,"---\nname: ctf-web\ndescription: Use when a challenge is a web application: a URL or host:port to attack, a login form, an admin bot, a source zip or Dockerfile for a website; when the user mentions SQLi, XSS, SSTI, LFI\u002FRFI, XXE, SSRF, deserialization, JWT or session tokens, IDOR, CSRF, GraphQL, file upload, cookie stealing, CORS or CSP, request smuggling; or when a flag should be extracted from a website, and for white-box source review of challenge web apps.\n---\n\n# CTF web — map the app, pick the bug class, deliver\n\nWorkspace layout, remote gate, flag logging: sibling skill `ctf`. **All live testing\nagainst remote targets is gated by the router's rules** — mirror locally whenever the\nchallenge ships source (`php -S 127.0.0.1:8000`, `python3 -m http.server 8000`,\n`scripts\u002Fctf python app.py`, or `podman` for provided Dockerfiles\u002Fimages; details in\n`references\u002Ftooling.md`). Craft and verify payloads on the mirror, replay the final\nexploit remotely once approved.\n\n## Triage — map the app (first 10 minutes)\n\n1. Record in `notes.md`: entry URL, ports, stack guess, auth model, whether an admin\n   bot exists, whether source was provided.\n2. Answer the map questions:\n\n| Question | How |\n|---|---|\n| Stack \u002F language? | headers (`Server`, `X-Powered-By`), cookie names (`PHPSESSID`\u002F`JSESSIONID`\u002F`laravel_session`\u002F`connect.sid`), 404 page — `references\u002Frecon.md` |\n| Routes? | robots\u002Fsitemap, JS bundles, wayback, ffuf — `references\u002Frecon.md` |\n| Hidden params? | `scripts\u002Fctf arjun -u URL -m GET` |\n| Session mechanism? | cookie flags, JWT? → `scripts\u002Fjwt-inspect.py \"$TOKEN\"` |\n| Admin bot? | client-side challenge: `references\u002Fclient.md` (exfil section first) |\n| Source available? | switch to Playbook → source-audit flow |\n\n3. Low-hanging fruit sweep (minutes, wins events):\n\n| Check | Payoff |\n|---|---|\n| `\u002F.git\u002FHEAD`, `.env`, `backup.zip`, `.bak`\u002F`~`\u002F`.swp` files | full source \u002F secrets |\n| `\u002Frobots.txt`, `\u002Fsitemap.xml`, wayback CDX | hidden endpoints |\n| `\u002Fswagger`, `\u002Fopenapi.json`, `\u002Fgraphql` introspection | complete API surface |\n| `\u002Fserver-status`, `\u002Factuator\u002Fenv`, `\u002Fphpmyadmin`, `\u002Fadminer.php` | config or DB leak |\n| default creds (`admin:admin` ...) | instant login — `references\u002Fauth.md` |\n| JWT in any header\u002Fcookie | none \u002F weak secret \u002F confusion — `references\u002Fauth.md` |\n| `package.json`, `.js.map` source maps | hidden routes, versions |\n\nOne command runs probes + fuzzing: `skills\u002Fctf-web\u002Fscripts\u002Fdirquick.sh -e .php,.bak -v http:\u002F\u002Ftarget:port`\n(remote gate applies; run it against local mirrors freely).\n\n4. If the flag format appears in any response, log it per the router, keep going for\n   the intended path anyway (organizers often plant decoys).\n\n## Playbook\n\n### Flow A — source-audit (source zip \u002F Dockerfile given)\n\n1. Identify language + framework from deps (`package.json`, `composer.json`,\n   `requirements.txt`, `pom.xml`, `go.mod`). Find the router\u002Fcontrollers: every\n   endpoint with its params, and every middleware (auth, body parsing).\n2. Grep the sinks, then trace each hit back to user input:\n\n| Language | Grep sink list |\n|---|---|\n| PHP | `unserialize\\(`, `include`, `require`, `eval\\(`, `assert\\(`, `system\\(`, `shell_exec\\(`, `passthru\\(`, `exec\\(`, `popen\\(`, `proc_open`, `preg_replace` with `\u002Fe`, backticks, `move_uploaded_file\\(`, `simplexml_load_string\\(`, `DOMDocument->load`, `curl_exec\\(`, `md5\\(`+`==`, `extract\\(`, `header('Location` |\n| Python | `pickle`, `yaml.load`, `eval\\(`, `exec\\(`, `os.system`, `subprocess`, `render_template_string`, `requests.get(` with user URL, f-string\u002Fformat SQL, `jinja2.Environment` |\n| Node | `child_process`, `exec`, `execSync`, `spawn`, `eval\\(`, `new Function`, `serialize`, deep `merge`\u002F`extend`\u002F`_.set` (proto pollution), `res.redirect(`, `jwt.verify`, `Object.assign` |\n| Java | `readObject`, `ObjectInputStream`, `Runtime.getRuntime`, `ProcessBuilder`, `SpelExpressionParser`, `Velocity`, `Statement`\u002F`executeQuery` with concat, `\u003C%=`, JSP EL `${}`, `XMLDecoder` |\n| Any | SQL built by concatenation\u002F`${}`; `==` vs `===`; `jwt.decode` (not verify); `Crypto` with `aes-128-ecb`; `random` for tokens |\n\n3. Match sink to bug class table (below), build the payload against a local mirror,\n   then fire at the remote target (gated).\n4. No obvious sink? Audit business logic: register\u002Flogin flows, IDOR on every\n   object reference, race-prone endpoints (balance\u002Fcoupon\u002Fvote), mass assignment.\n\n### Flow B — blackbox (no source)\n\n1. Recon sweep (`references\u002Frecon.md`): fingerprint, exposed files, dirs, vhosts,\n   param mining, wayback.\n2. Injection probes on every input point, one class at a time — error\u002Fboolean\u002Ftime\n   triage in `references\u002Finjection.md`.\n3. Auth surface: default creds, JWT\u002Fsession weaknesses, OAuth flow, IDOR\u002Fmass\n   assignment — `references\u002Fauth.md`.\n4. File\u002FURL surfaces: uploads, `?file=` params, importers (SSRF) — `references\u002Fdeser-files.md`.\n5. Admin bot \u002F browser-only behavior: `references\u002Fclient.md`.\n6. Escalate breadth (deeper wordlists, more params) and depth (chain two bugs:\n   LFI+log poison, open redirect+OAuth, XSS+CSRF) before concluding.\n\n### Bug class index\n\n| Bug class | Preconditions | Reference |\n|---|---|---|\n| SQLi (manual + sqlmap), NoSQL, command injection, SSTI, XSLT, LDAP | any user input reaching a query\u002Fparser\u002Fshell\u002Ftemplate | `references\u002Finjection.md` |\n| JWT\u002Fsession\u002FOAuth\u002FIDOR\u002Fmass assignment\u002Frace\u002FCSRF\u002Fdefault creds | any auth or object reference | `references\u002Fauth.md` |\n| Deserialization (PHP\u002FPython\u002FJava\u002FRuby\u002FYAML\u002FNode), LFI\u002FRFI, php:\u002F\u002Ffilter chain, log poisoning, upload bypasses, XXE, SSRF | user data unserialized \u002F included \u002F fetched | `references\u002Fdeser-files.md` |\n| XSS + admin bot, CSP bypass, prototype pollution, postMessage, CORS, smuggling, cache poisoning, open redirect | client-side render or bot | `references\u002Fclient.md` |\n| Recon: fingerprint, ffuf, exposed source, vhosts, wayback, param mining | always first (Flow B) | `references\u002Frecon.md` |\n| Proxies (mitmproxy\u002FBurp), browsers, websockets, listeners, local mirrors | tooling for all of the above | `references\u002Ftooling.md` |\n\n## References\n\n- `references\u002Frecon.md` — manual Wappalyzer-style fingerprinting, quick exposed-file\n  probes, git-dumper, source maps, Swagger\u002FGraphQL introspection, ffuf patterns\n  (extensions\u002Frecursion\u002Fmulti-wordlist\u002Fvhost), wayback CDX, arjun.\n- `references\u002Finjection.md` — SQLi triage + UNION method + sqlmap, NoSQL `$ne`\u002F`$regex`\u002F\n  `$where`, command injection channels, SSTI engine decision tree + per-engine RCE\n  payloads, SpEL\u002FOGNL\u002FEL, XSLT, LDAP.\n- `references\u002Fauth.md` — JWT attack table (none\u002Fcrack\u002FRS→HS confusion\u002Fkid\u002Fjku\u002Fx5u),\n  session bugs, OAuth flows, IDOR methodology, mass assignment, races, CSRF,\n  default creds, register\u002Flogin logic flaws.\n- `references\u002Fdeser-files.md` — PHP\u002FPython\u002FJava\u002FRuby\u002FYAML\u002FNode deserialization,\n  phar, LFI path list + wrappers, php:\u002F\u002Ffilter chain RCE, log\u002Fsession poisoning,\n  upload bypass table, XXE, SSRF (ports, cloud metadata, gopher, rebinding), SVG XSS.\n- `references\u002Fclient.md` — XSS contexts + exfil listeners (HTTP\u002FWebSocket, HttpOnly\n  workaround), CSP bypass table, prototype pollution (client + Node RCE gadget),\n  postMessage, CORS, request smuggling basics, cache poisoning, open redirect.\n- `references\u002Ftooling.md` — mitmproxy scripting, Burp install, sqlmap via proxy,\n  ffuf modes, websocat, interactsh, local mirrors, workspace hygiene.\n\n## Scripts in this skill\n\n| Script | Purpose |\n|---|---|\n| `scripts\u002Fdirquick.sh` | one-shot recon: header dump, exposed-file probes, ffuf content (+ optional vhost); falls back to a bundled wordlist without seclists |\n| `scripts\u002Fjwt-inspect.py` | JWT decode + suspicious-flag triage + optional HMAC wordlist crack (stdlib only) |\n\n## Toolbox\n\n| Tool | Install | Purpose |\n|---|---|---|\n| `ffuf` | `paru -S ffuf` (AUR) or https:\u002F\u002Fgithub.com\u002Fffuf\u002Fffuf\u002Freleases | content\u002Fvhost\u002Fparam fuzzing |\n| `seclists` | `paru -S seclists` (AUR; → `\u002Fusr\u002Fshare\u002Fseclists`) or clone github.com\u002Fdanielmiessler\u002FSecLists | wordlists |\n| `sqlmap` | `sudo pacman -S sqlmap` | automated SQL injection |\n| `mitmproxy` | `sudo pacman -S mitmproxy` | scriptable intercepting proxy |\n| Burp Suite | `paru -S burpsuite` (AUR) or upstream community jar | manual proxy, Repeater\u002FIntruder, races |\n| `websocat` | `sudo pacman -S websocat` | websocket client + listener |\n| `httpie` | `sudo pacman -S httpie` | ergonomic HTTP client |\n| `hashcat` | `sudo pacman -S hashcat` | `-m 16500` JWT secret cracking |\n| `php` | `sudo pacman -S php` | local mirrors, phar\u002Fphpggc payload crafting |\n| `git-dumper` | `uv tool install git-dumper` | recover exposed `.git\u002F` |\n| `arjun` | `uv pip install --python .venv\u002Fbin\u002Fpython arjun` | hidden parameter discovery |\n| `jwt_tool` | clone github.com\u002Fticarpi\u002Fjwt_tool + `uv pip install --python .venv\u002Fbin\u002Fpython pycryptodomex` | JWT forgery\u002Fattack suite |\n| `tplmap` | clone github.com\u002Fepinna\u002Ftplmap | SSTI detection + auto-RCE |\n| `ysoserial` | clone github.com\u002Ffrohoff\u002Fysoserial + `mvn package` | Java deserialization payloads |\n| `phpggc` | clone github.com\u002Fambionics\u002Fphpggc | PHP gadget chains (Laravel...) |\n| `php_filter_chain_generator` | clone github.com\u002Fsynacktiv\u002Fphp_filter_chain_generator | php:\u002F\u002Ffilter → RCE chain |\n| `Gopherus` | clone github.com\u002Ftarunkant\u002FGopherus | gopher:\u002F\u002F SSRF payloads |\n| `interactsh-client` | `go install -v github.com\u002Fprojectdiscovery\u002Finteractsh\u002Fcmd\u002Finteractsh-client@latest` | out-of-band callback host |\n| browser tool | built into this agent (skill `agent-browser`) | interactive apps, login flows, bot debugging |\n\nReport files to the user with the flag; log to `work\u002F\u003Cevent>\u002Fflags.md` per the router.\n","# CTF web — map the app, pick the bug class, deliver\n\nWorkspace layout, remote gate, flag logging: sibling skill `ctf`. **All live testing\nagainst remote targets is gated by the router's rules** — mirror locally whenever the\nchallenge ships source (`php -S 127.0.0.1:8000`, `python3 -m http.server 8000`,\n`scripts\u002Fctf python app.py`, or `podman` for provided Dockerfiles\u002Fimages; details in\n`references\u002Ftooling.md`). Craft and verify payloads on the mirror, replay the final\nexploit remotely once approved.\n\n## Triage — map the app (first 10 minutes)\n\n1. Record in `notes.md`: entry URL, ports, stack guess, auth model, whether an admin\n   bot exists, whether source was provided.\n2. Answer the map questions:\n\n| Question | How |\n|---|---|\n| Stack \u002F language? | headers (`Server`, `X-Powered-By`), cookie names (`PHPSESSID`\u002F`JSESSIONID`\u002F`laravel_session`\u002F`connect.sid`), 404 page — `references\u002Frecon.md` |\n| Routes? | robots\u002Fsitemap, JS bundles, wayback, ffuf — `references\u002Frecon.md` |\n| Hidden params? | `scripts\u002Fctf arjun -u URL -m GET` |\n| Session mechanism? | cookie flags, JWT? → `scripts\u002Fjwt-inspect.py \"$TOKEN\"` |\n| Admin bot? | client-side challenge: `references\u002Fclient.md` (exfil section first) |\n| Source available? | switch to Playbook → source-audit flow |\n\n3. Low-hanging fruit sweep (minutes, wins events):\n\n| Check | Payoff |\n|---|---|\n| `\u002F.git\u002FHEAD`, `.env`, `backup.zip`, `.bak`\u002F`~`\u002F`.swp` files | full source \u002F secrets |\n| `\u002Frobots.txt`, `\u002Fsitemap.xml`, wayback CDX | hidden endpoints |\n| `\u002Fswagger`, `\u002Fopenapi.json`, `\u002Fgraphql` introspection | complete API surface |\n| `\u002Fserver-status`, `\u002Factuator\u002Fenv`, `\u002Fphpmyadmin`, `\u002Fadminer.php` | config or DB leak |\n| default creds (`admin:admin` ...) | instant login — `references\u002Fauth.md` |\n| JWT in any header\u002Fcookie | none \u002F weak secret \u002F confusion — `references\u002Fauth.md` |\n| `package.json`, `.js.map` source maps | hidden routes, versions |\n\nOne command runs probes + fuzzing: `skills\u002Fctf-web\u002Fscripts\u002Fdirquick.sh -e .php,.bak -v http:\u002F\u002Ftarget:port`\n(remote gate applies; run it against local mirrors freely).\n\n4. If the flag format appears in any response, log it per the router, keep going for\n   the intended path anyway (organizers often plant decoys).\n\n## Playbook\n\n### Flow A — source-audit (source zip \u002F Dockerfile given)\n\n1. Identify language + framework from deps (`package.json`, `composer.json`,\n   `requirements.txt`, `pom.xml`, `go.mod`). Find the router\u002Fcontrollers: every\n   endpoint with its params, and every middleware (auth, body parsing).\n2. Grep the sinks, then trace each hit back to user input:\n\n| Language | Grep sink list |\n|---|---|\n| PHP | `unserialize\\(`, `include`, `require`, `eval\\(`, `assert\\(`, `system\\(`, `shell_exec\\(`, `passthru\\(`, `exec\\(`, `popen\\(`, `proc_open`, `preg_replace` with `\u002Fe`, backticks, `move_uploaded_file\\(`, `simplexml_load_string\\(`, `DOMDocument->load`, `curl_exec\\(`, `md5\\(`+`==`, `extract\\(`, `header('Location` |\n| Python | `pickle`, `yaml.load`, `eval\\(`, `exec\\(`, `os.system`, `subprocess`, `render_template_string`, `requests.get(` with user URL, f-string\u002Fformat SQL, `jinja2.Environment` |\n| Node | `child_process`, `exec`, `execSync`, `spawn`, `eval\\(`, `new Function`, `serialize`, deep `merge`\u002F`extend`\u002F`_.set` (proto pollution), `res.redirect(`, `jwt.verify`, `Object.assign` |\n| Java | `readObject`, `ObjectInputStream`, `Runtime.getRuntime`, `ProcessBuilder`, `SpelExpressionParser`, `Velocity`, `Statement`\u002F`executeQuery` with concat, `\u003C%=`, JSP EL `${}`, `XMLDecoder` |\n| Any | SQL built by concatenation\u002F`${}`; `==` vs `===`; `jwt.decode` (not verify); `Crypto` with `aes-128-ecb`; `random` for tokens |\n\n3. Match sink to bug class table (below), build the payload against a local mirror,\n   then fire at the remote target (gated).\n4. No obvious sink? Audit business logic: register\u002Flogin flows, IDOR on every\n   object reference, race-prone endpoints (balance\u002Fcoupon\u002Fvote), mass assignment.\n\n### Flow B — blackbox (no source)\n\n1. Recon sweep (`references\u002Frecon.md`): fingerprint, exposed files, dirs, vhosts,\n   param mining, wayback.\n2. Injection probes on every input point, one class at a time — error\u002Fboolean\u002Ftime\n   triage in `references\u002Finjection.md`.\n3. Auth surface: default creds, JWT\u002Fsession weaknesses, OAuth flow, IDOR\u002Fmass\n   assignment — `references\u002Fauth.md`.\n4. File\u002FURL surfaces: uploads, `?file=` params, importers (SSRF) — `references\u002Fdeser-files.md`.\n5. Admin bot \u002F browser-only behavior: `references\u002Fclient.md`.\n6. Escalate breadth (deeper wordlists, more params) and depth (chain two bugs:\n   LFI+log poison, open redirect+OAuth, XSS+CSRF) before concluding.\n\n### Bug class index\n\n| Bug class | Preconditions | Reference |\n|---|---|---|\n| SQLi (manual + sqlmap), NoSQL, command injection, SSTI, XSLT, LDAP | any user input reaching a query\u002Fparser\u002Fshell\u002Ftemplate | `references\u002Finjection.md` |\n| JWT\u002Fsession\u002FOAuth\u002FIDOR\u002Fmass assignment\u002Frace\u002FCSRF\u002Fdefault creds | any auth or object reference | `references\u002Fauth.md` |\n| Deserialization (PHP\u002FPython\u002FJava\u002FRuby\u002FYAML\u002FNode), LFI\u002FRFI, php:\u002F\u002Ffilter chain, log poisoning, upload bypasses, XXE, SSRF | user data unserialized \u002F included \u002F fetched | `references\u002Fdeser-files.md` |\n| XSS + admin bot, CSP bypass, prototype pollution, postMessage, CORS, smuggling, cache poisoning, open redirect | client-side render or bot | `references\u002Fclient.md` |\n| Recon: fingerprint, ffuf, exposed source, vhosts, wayback, param mining | always first (Flow B) | `references\u002Frecon.md` |\n| Proxies (mitmproxy\u002FBurp), browsers, websockets, listeners, local mirrors | tooling for all of the above | `references\u002Ftooling.md` |\n\n## References\n\n- `references\u002Frecon.md` — manual Wappalyzer-style fingerprinting, quick exposed-file\n  probes, git-dumper, source maps, Swagger\u002FGraphQL introspection, ffuf patterns\n  (extensions\u002Frecursion\u002Fmulti-wordlist\u002Fvhost), wayback CDX, arjun.\n- `references\u002Finjection.md` — SQLi triage + UNION method + sqlmap, NoSQL `$ne`\u002F`$regex`\u002F\n  `$where`, command injection channels, SSTI engine decision tree + per-engine RCE\n  payloads, SpEL\u002FOGNL\u002FEL, XSLT, LDAP.\n- `references\u002Fauth.md` — JWT attack table (none\u002Fcrack\u002FRS→HS confusion\u002Fkid\u002Fjku\u002Fx5u),\n  session bugs, OAuth flows, IDOR methodology, mass assignment, races, CSRF,\n  default creds, register\u002Flogin logic flaws.\n- `references\u002Fdeser-files.md` — PHP\u002FPython\u002FJava\u002FRuby\u002FYAML\u002FNode deserialization,\n  phar, LFI path list + wrappers, php:\u002F\u002Ffilter chain RCE, log\u002Fsession poisoning,\n  upload bypass table, XXE, SSRF (ports, cloud metadata, gopher, rebinding), SVG XSS.\n- `references\u002Fclient.md` — XSS contexts + exfil listeners (HTTP\u002FWebSocket, HttpOnly\n  workaround), CSP bypass table, prototype pollution (client + Node RCE gadget),\n  postMessage, CORS, request smuggling basics, cache poisoning, open redirect.\n- `references\u002Ftooling.md` — mitmproxy scripting, Burp install, sqlmap via proxy,\n  ffuf modes, websocat, interactsh, local mirrors, workspace hygiene.\n\n## Scripts in this skill\n\n| Script | Purpose |\n|---|---|\n| `scripts\u002Fdirquick.sh` | one-shot recon: header dump, exposed-file probes, ffuf content (+ optional vhost); falls back to a bundled wordlist without seclists |\n| `scripts\u002Fjwt-inspect.py` | JWT decode + suspicious-flag triage + optional HMAC wordlist crack (stdlib only) |\n\n## Toolbox\n\n| Tool | Install | Purpose |\n|---|---|---|\n| `ffuf` | `paru -S ffuf` (AUR) or https:\u002F\u002Fgithub.com\u002Fffuf\u002Fffuf\u002Freleases | content\u002Fvhost\u002Fparam fuzzing |\n| `seclists` | `paru -S seclists` (AUR; → `\u002Fusr\u002Fshare\u002Fseclists`) or clone github.com\u002Fdanielmiessler\u002FSecLists | wordlists |\n| `sqlmap` | `sudo pacman -S sqlmap` | automated SQL injection |\n| `mitmproxy` | `sudo pacman -S mitmproxy` | scriptable intercepting proxy |\n| Burp Suite | `paru -S burpsuite` (AUR) or upstream community jar | manual proxy, Repeater\u002FIntruder, races |\n| `websocat` | `sudo pacman -S websocat` | websocket client + listener |\n| `httpie` | `sudo pacman -S httpie` | ergonomic HTTP client |\n| `hashcat` | `sudo pacman -S hashcat` | `-m 16500` JWT secret cracking |\n| `php` | `sudo pacman -S php` | local mirrors, phar\u002Fphpggc payload crafting |\n| `git-dumper` | `uv tool install git-dumper` | recover exposed `.git\u002F` |\n| `arjun` | `uv pip install --python .venv\u002Fbin\u002Fpython arjun` | hidden parameter discovery |\n| `jwt_tool` | clone github.com\u002Fticarpi\u002Fjwt_tool + `uv pip install --python .venv\u002Fbin\u002Fpython pycryptodomex` | JWT forgery\u002Fattack suite |\n| `tplmap` | clone github.com\u002Fepinna\u002Ftplmap | SSTI detection + auto-RCE |\n| `ysoserial` | clone github.com\u002Ffrohoff\u002Fysoserial + `mvn package` | Java deserialization payloads |\n| `phpggc` | clone github.com\u002Fambionics\u002Fphpggc | PHP gadget chains (Laravel...) |\n| `php_filter_chain_generator` | clone github.com\u002Fsynacktiv\u002Fphp_filter_chain_generator | php:\u002F\u002Ffilter → RCE chain |\n| `Gopherus` | clone github.com\u002Ftarunkant\u002FGopherus | gopher:\u002F\u002F SSRF payloads |\n| `interactsh-client` | `go install -v github.com\u002Fprojectdiscovery\u002Finteractsh\u002Fcmd\u002Finteractsh-client@latest` | out-of-band callback host |\n| browser tool | built into this agent (skill `agent-browser`) | interactive apps, login flows, bot debugging |\n\nReport files to the user with the flag; log to `work\u002F\u003Cevent>\u002Fflags.md` per the router.\n",{},"main","3df1d0d67b30ff15236561f8c0f9f06d33f42dfd","skills\u002Fchains\u002Friegan-ctf-web",17,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia","https:\u002F\u002Feth2030.com","Hardcore infra. Building @alt-research and applied cryptography.","2026-11-15 02:28:10",{"source":7,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add jiayaoqijia\u002Fcryptoskill --skill riegan-ctf-web",{"tool":42,"command":43},"bunx","bunx skills add jiayaoqijia\u002Fcryptoskill --skill riegan-ctf-web",{"tool":45,"command":46},"pnpm","pnpm dlx skills add jiayaoqijia\u002Fcryptoskill --skill riegan-ctf-web","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-web\u002FSKILL.md",true,[50,56,60,64,68,72,76,82,86,90],{"path":51,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":54,"sourceHtmlUrl":55},"references\u002Fauth.md","REFERENCE","参考文档",9077,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-web\u002Freferences\u002Fauth.md",{"path":57,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":58,"sourceHtmlUrl":59},"references\u002Fclient.md",8577,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-web\u002Freferences\u002Fclient.md",{"path":61,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":62,"sourceHtmlUrl":63},"references\u002Fdeser-files.md",12410,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-web\u002Freferences\u002Fdeser-files.md",{"path":65,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":66,"sourceHtmlUrl":67},"references\u002Finjection.md",10246,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-web\u002Freferences\u002Finjection.md",{"path":69,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":70,"sourceHtmlUrl":71},"references\u002Frecon.md",8252,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-web\u002Freferences\u002Frecon.md",{"path":73,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":74,"sourceHtmlUrl":75},"references\u002Ftooling.md",5176,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-web\u002Freferences\u002Ftooling.md",{"path":77,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":80,"sourceHtmlUrl":81},"scripts\u002Fdirquick.sh","SCRIPT","脚本",5924,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-web\u002Fscripts\u002Fdirquick.sh",{"path":83,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":84,"sourceHtmlUrl":85},"scripts\u002Fjwt-inspect.py",7453,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-web\u002Fscripts\u002Fjwt-inspect.py",{"path":87,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":88,"sourceHtmlUrl":89},"SOURCE.md",327,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-web\u002FSOURCE.md",{"path":91,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":92,"sourceHtmlUrl":93},"TRUST.auto.yaml",2153,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fchains\u002Friegan-ctf-web\u002FTRUST.auto.yaml",[95,124,147,165,178,188],{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":99,"licenseFileUrl":100,"sourceHtmlUrl":101,"categories":102,"keywords":103,"publishedAt":22},"01M712C436EQYE43342Q4E7GG1","recipe-performance","Diagnose a specific MetaMask user flow's real-app performance and Sentry critical-user-flow telemetry with deterministic mm-harness recipes. Use for CUF boundaries, cold\u002Fwarm\u002Fbackground-resume behavior, latency regressions, lifecycle tags, duplicate or blocking network requests, long tasks, layout\u002Fpaint cost, screen redraws, React rerenders, or browser trace analysis where tests alone cannot prove the real app.","MIT","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FSKILL.md",[],[104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123],"performance","recipe performance","recipe","mm","sentry","harness","app","deterministic","recipes","flow","cold","critical","analysis","tasks","react","browser","layout","screen","network","metamask",{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":128,"licenseFileUrl":129,"sourceHtmlUrl":130,"categories":131,"keywords":132,"publishedAt":22},"01M70XT2F8A5CQZ81JBP98KSW3","mexc-spot-websocket","MEXC Spot WebSocket workflows for public streams, protobuf handling, depth maintenance, listen keys, and private streams without exposing API keys.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FSKILL.md",[],[133,134,135,136,137,138,139,140,141,142,143,144,145,146],"mexc spot websocket","spot","websocket","api","workflows","public","listen","streams","depth","keys","for","api keys","maintenance","protobuf",{"skillNo":148,"name":149,"nameZh":6,"description":150,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":128,"licenseFileUrl":151,"sourceHtmlUrl":152,"categories":153,"keywords":154,"publishedAt":22},"01M70XT0MBXN3WZY1BKN0CPNKR","mexc-spot-rest","MEXC Spot REST workflows for public data, signed account requests, orders, wallet\u002Fadmin actions, and secure signing without exposing API keys.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FSKILL.md",[],[155,134,156,157,158,159,160,144,143,142,161,162,163,138,164,137,136],"mexc spot rest","REST","admin","signing","Wallet","requests","actions","secure","data","orders",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":128,"licenseFileUrl":169,"sourceHtmlUrl":170,"categories":171,"keywords":172,"publishedAt":22},"01M70XSYSVZ2N0N91XCAR2CAK0","mexc-futures-websocket","MEXC Futures WebSocket workflows for public streams, private account\u002Forder\u002Fposition streams, ping\u002Fpong, subscriptions, and depth maintenance.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FSKILL.md",[],[173,174,135,175,176,145,143,177,141,140,138,137],"mexc futures websocket","futures","position","ping","subscriptions",{"skillNo":179,"name":180,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":99,"licenseFileUrl":181,"sourceHtmlUrl":182,"categories":183,"keywords":184,"publishedAt":22},"01M6H0ZWHVE5W04WG2DKQE2SQC","0xklen-version-and-refresh-sanctions-lists","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FSKILL.md",[],[185,186,187],"refresh","0xklen version and refresh sanctions lists","version",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":99,"licenseFileUrl":192,"sourceHtmlUrl":193,"categories":194,"keywords":195,"publishedAt":22},"01M6H0Z28Q3R8J0S799GJQWXM3","verify-tests-cover-changed-lines","Use when a PR adds code that the existing suite may not exercise. Measures patch coverage — the share of newly changed lines hit by tests — before approving.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FSKILL.md",[],[196,197,198,199,200,201,202,203,204,205,206],"tests","cover","verify tests cover changed lines","verify","coverage","pr","exercise","use","patch","code","share"]