ctf-web
Provides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, identity flow, or smart-contract frontend/backend surface, including XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, request smuggling, O...
Install this skill
or
40/100
Security score
The ctf-web skill was audited on Sep 4, 2026 and we found 8 security issues across 3 threat categories, including 1 critical. Review the findings below before installing.
Categories Tested
Security Issues
medium line 116
Curl to non-GitHub URL
SourceSKILL.md
| 114 | ```bash |
| 115 | # Recon |
| 116 | curl -sI https://target.com |
| 117 | ffuf -u https://target.com/FUZZ -w wordlist.txt |
| 118 | curl -s https://target.com/robots.txt |
medium line 118
Curl to non-GitHub URL
SourceSKILL.md
| 116 | curl -sI https://target.com |
| 117 | ffuf -u https://target.com/FUZZ -w wordlist.txt |
| 118 | curl -s https://target.com/robots.txt |
| 119 | |
| 120 | # SQLi quick test |
medium line 131
Curl to non-GitHub URL
SourceSKILL.md
| 129 | |
| 130 | # SSTI probes |
| 131 | curl "https://target.com/page?name={{7*7}}" |
| 132 | curl "https://target.com/page?name={{config}}" |
| 133 |
medium line 132
Curl to non-GitHub URL
SourceSKILL.md
| 130 | # SSTI probes |
| 131 | curl "https://target.com/page?name={{7*7}}" |
| 132 | curl "https://target.com/page?name={{config}}" |
| 133 | |
| 134 | # Request inspection |
medium line 135
Curl to non-GitHub URL
SourceSKILL.md
| 133 | |
| 134 | # Request inspection |
| 135 | curl -v -X POST https://target.com/api -H "Content-Type: application/json" -d '{}' |
| 136 | ``` |
| 137 |
medium line 175
Upload instruction
SourceSKILL.md
| 173 | |
| 174 | - Recon, SQLi, XSS, traversal, JWT, SSTI, SSRF, XXE, and command injection quick notes |
| 175 | - Deserialization, race conditions, file upload to RCE, and multi-stage chain examples |
| 176 | - Node, OAuth/SAML, CI/CD, Web3, bot abuse, CSP bypasses, and modern browser tricks |
| 177 | - CVE-shaped playbooks and older challenge patterns that still show up in modern CTFs |
critical line 62
Jailbreak keyword
SourceSKILL.md
| 60 | - [client-side.md](client-side.md) - XSS, CSRF, cache poisoning, DOM tricks, admin bot abuse, request smuggling, paywall bypass |
| 61 | - [client-side-advanced.md](client-side-advanced.md) - CSP bypasses, Unicode tricks, XSSI, CSS exfiltration, browser normalization quirks, postMessage null origin bypass |
| 62 | - [auth-and-access.md](auth-and-access.md) - Auth/authz bypasses, hidden endpoints, IDOR, redirect chains, subdomain takeover, AI chatbot jailbreaks |
| 63 | - [auth-and-access-2.md](auth-and-access-2.md) - Part 2 (2018-era): `std::unordered_set` bucket collision auth bypass, `nodeprep.prepare` Unicode homograph username collision, SRP A=0/A=N auth bypass, ArangoDB AQL MERGE privilege escalation |
| 64 | - [auth-jwt.md](auth-jwt.md) - JWT/JWE manipulation, weak secrets, header injection, key confusion, replay |
medium line 151
Webhook reference
SourceSKILL.md
| 149 | - Check obvious metadata and helper paths early: `/robots.txt`, `/sitemap.xml`, `/.well-known/`, `/admin`, `/debug`, `/.git/`, `/.env`. |
| 150 | - Try alternate verbs and content types on interesting routes: `GET`, `POST`, `PUT`, `PATCH`, `TRACE`, JSON, form, multipart, XML. |
| 151 | - Treat file upload, PDF/export, webhook, OAuth callback, and admin bot features as likely exploit multipliers. |
| 152 | |
| 153 | ## Fast Pattern Map |
Scanned on Sep 4, 2026
View Security Dashboard