asdfgh1445/ctf-super-hub

CTF AI/ML Attack Hub collects techniques for adversarial examples, model extraction, prompt injection, membership inference, poisoning, LoRA abuse, and LLM jailbreaking. Use it when a challenge involves attacking or analyzing an AI or ML system.

CTF Binary Exploitation covers buffer overflows, format strings, heap exploitation, ROP, ret2libc, shellcode, seccomp bypass, and sandbox escape for pwn-style CTF challenges. Use it when solving binary exploitation tasks.

CTF Challenge Triage classifies a CTF challenge, performs light initial triage, and routes it to the appropriate ctf-* skill. It can also act as the entry point when the category is already clear.

CTF Cryptography provides quick references for cryptography and math-based CTF challenges, including RSA, AES, ECC, lattices, PRNGs, ZKP, and related attack patterns. Use it when solving crypto puzzles or checking which technique applies.

CTF Forensics covers disk images, memory dumps, logs, PCAPs, steganography, registry artifacts, audio signals, Docker images, coredumps, and deleted-file recovery for forensic CTF challenges. Use it when a puzzle requires extracting or reconstructing evidence from system and network artifacts.

CTF Malware Analysis helps analyze malicious-script, PE/.NET, shellcode, and C2 traffic challenges in CTFs. Use it when you need to deobfuscate payloads, extract configs, decode protocols, or spot anti-analysis tricks.

CTF Misc covers cross-category CTF problems such as encoding, pyjail/bash jail escapes, RF/SDR, DNS quirks, QR/audio puzzles, constraint solving, and sandbox escape. Use it when a challenge spans multiple niche techniques or does not fit a single CTF specialty.

CTF Reverse Engineering covers binary, APK, WASM, firmware, custom VM, bytecode, and anti-analysis challenges. Use it when reversing protected or obfuscated CTF targets and extracting logic or secrets.

CTF Web Exploitation routes and executes web-heavy CTF challenges across injection, auth bypass, uploads, SSRF, XSS, JWT, OAuth/OIDC, SAML, and prototype pollution. Use it to map the app, confirm trust boundaries, and choose the right web exploit family.

CTF 开源情报 covers OSINT techniques for CTF challenges, including public record searches, username enumeration, geolocation, image analysis, DNS, and archive lookup. Use it when a challenge depends on open-source intelligence rather than local files or live exploitation.

CTF 新手入口为中文 CTF 新手提供统一起点，先自动分流或先头脑风暴再分流到合适的 ctf-* 或 strix-* skill。适合拿到题面后不知道从哪一步开始的人。

CTF 超级总控为 CTF 新手和综合题提供统一入口，先自动分流或先头脑风暴再分流。它会在 ctf-* 与 strix-* 之间判断下一步，适合不确定该用哪个 skill 时使用。

Ctf Write-Up Writer turns a solved CTF challenge into a concise, submission-style write-up with reproducible steps, metadata, and one complete solve script. Use it for post-contest review, team sharing, or submission notes.

Information Disclosure Testing covers error messages, debug endpoints, metadata, source maps, and exposed configs to find information leaks. Use it to assess what an app reveals through responses, headers, artifacts, and public endpoints.

Strix CSRF 测试 covers token bypasses, SameSite, CORS misconfigurations, and state-changing request abuse. Use it to assess web endpoints for cross-site request forgery and related weaknesses.

Strix Ffuf 用法整理 ffuf 的常用模糊测试参数、匹配器、过滤器和自动化运行方式。适合在 Web 枚举、递归发现、虚拟主机探测和表单参数 fuzzing 时快速查用。

Strix Httpx 用法 documents httpx CLI flags, output formats, and automation-safe defaults for probing hosts. Use it when you need reproducible HTTP/HTTPS checks, fingerprinting, or stored response artifacts.

Strix IDOR Test is a manual for finding object-level authorization flaws (BOLA/IDOR) that allow cross-account data access and unauthorized state changes. Use it when testing APIs, web apps, GraphQL, microservices, and multi-tenant systems.

Strix JWT Authentication Testing covers JWT and OIDC security testing, including token forgery, algorithm confusion, and claim tampering. Use it when checking authentication flows, JWKS handling, and token validation rules.

Strix Katana Usage documents Katana CLI flags for depth, JavaScript crawling, headless mode, proxies, and concurrency. Use it when you need a repeatable crawl command for target discovery and endpoint collection.

Strix 不安全文件上传 covers testing upload surfaces for extension bypasses, Content-Type manipulation, path traversal, and processing races. Use it when reviewing file upload validation, storage, and serving behavior.

Strix 业务逻辑漏洞 helps test workflow bypasses, state manipulation, and broken domain constraints in applications. Use it when checking for pricing, refund, quota, role, or approval logic flaws.

Strix 新手入口先判断该用哪个 strix-* 工具或漏洞测试 skill，再给最小化起手步骤。适合中文用户在 Web 安全测试、工具链使用、漏洞验证时不知道先选哪个 Strix skill。

Strix•功能级授权缺陷 is a testing manual for broken function-level authorization, covering privilege bypass, admin-only actions, and API drift. Use it to verify whether restricted actions can be invoked across different transports and encodings.

头脑风暴用于在正式动手前先澄清目标、约束、边界与方案。适合需要先理清问题再决定后续 skill 或实现路径的场景。