CTF Web Exploitation

What it does

This skill provides a structured, practical playbook for web-focused CTF challenges. It guides the operator through recon, attack surface mapping, common vulnerability families (XSS, SQLi, SSTI, SSRF, XXE, auth flaws), and chaining techniques to escalate a small primitive into a full exploit path. The SKILL bundles quick-start commands, prioritisation heuristics, and links to in-depth notes for server-side, client-side, and auth-related vectors.

When to use it

Invoke when the challenge is centred on an HTTP application, API, or browser surface — particularly when templates, tokens, identity flows, or upload/parsing features are involved. Avoid for native pwn or deep crypto unless the web interface remains the core attack vector.

What's included

• Scripts: none embedded but recommends tools (sqlmap, ffuf, flask-unsign) and command snippets.
• References: extensive companion documents covering SQLi, SSRF, deserialization, JWT/OAuth, prototype pollution, and field notes.
• Instructions: first-pass workflow, reconnaissance checklist, high-value checks, and exploit chain templates to convert reconnaissance into leaks or code execution.

Compatible agents

Intended for agents with shell and HTTP tooling (ffuf, curl, Python). Works best with Claude Code or other agents that can run local tools for active testing.