CTF Forensics Quick Reference
Paste the following prompt into your AI chat to install this skill:
Please install @user_257ad2a8/ctf-forensics according to https://skillhub.cn/install/skillhub.md.
About this skill
The Problem
CTF forensics challenges rarely hand you the flag. They scatter evidence across disk images, memory dumps, PCAPs, system logs, and misleading file formats. The hard part is connecting artifacts that cross platforms and file types: Windows event logs, registry values, Recycle Bin data, and NTFS alternate data streams; Linux attack chains, Docker images, browser traces, and Git reflogs; network clues hidden through TLS keylogs, TFTP netascii, NTLMv2, USB audio, or DNS trailing bytes; and file-based payloads embedded in PDF annotations, EXIF fields, audio differential signals, video frame differences, QR reconstruction, or Brotli/ZIP anomalies. This skill organizes those investigation moves into a quick reference, reducing the gap between recognizing an artifact and choosing the next tool.
How It Works
The reference is organized by forensic target and challenge clue rather than as a loose tool list:
- Windows forensics: key event IDs, registry values, SAM, Recycle Bin, fls / icat, NTFS ADS, PowerShell history, Defender MPLog, Prefetch, and WMI persistence.
- Disk and memory: Volatility, VM/OVA/VMDK, coredumps, Android, Docker containers, TrueCrypt/VeraCrypt, ZFS, RAID, APFS snapshots, deleted partitions, and file recovery.
- Network forensics: tcpdump, Wireshark, TLS SSLKEYLOGFILE, TFTP netascii repair, NTLMv2 cracking, USB audio, DNS hidden bytes, TCP flag covert channels, and SMB/RID clues.
- Steganography and format analysis: PNG, JPEG, PDF, SVG, GIF, audio FFT, video frame differencing, QR reconstruction, Brotli/ZIP anomalies, and multi-layer PDF inspection.
- Signals and hardware: UART, HDMI TMDS, DisplayPort, Flipper .sub, keyboard acoustic side channels, CD audio discs, and input-event parsing.
Boundaries
The material is a CTF forensics quick reference, not a full DFIR report template. If the remaining problem is RSA, AES, or lattice cryptography, switch to /ctf-crypto. If the focus is malware beacon configuration, packed samples, or attack-chain reconstruction, use /ctf-malware. If the artifact is a web app backup or API logic puzzle, use /ctf-web. If it is mostly encoding, steganography tricks, or esoteric formats, use /ctf-misc. For infrastructure attribution, use /ctf-osint; for disassembly or firmware analysis, use /ctf-reverse.
Use Cases
- Given a CTF PCAP, follow TLS keylog, TFTP netascii, and NTLMv2 clues to recover plaintext or credentials.
- Given a Windows image or disk file, inspect event logs, registry values, Recycle Bin, NTFS ADS, and WMI persistence.
- When facing PDF, PNG, JPEG, or audio challenges, use EXIF, layered PDF, DQT LSB, and audio differential signals to locate hidden data.
- Given a memory dump, Docker image, or VM file, use Volatility, coredumps, containers, and browser artifacts to recover clues.
Best For
- CTF forensics players who need quick next-tool decisions for Windows, network, and steganography challenges.
- Security course TAs or challenge authors who need to organize forensic clues, standard workflows, and common traps.
- Pentest engineers analyzing CTF samples to reconstruct attacker behavior from images, logs, and traffic.
- Students learning DFIR basics who map Volatility, Wireshark, and fls/icat to concrete evidence types.
Related Skills
An engineer-focused HTTP request smuggling handbook covering CL.TE, TE.CL, TE.TE obfuscation, HTTP/2 downgrade, and client-side desync detection.
Analyzes network captures from Wireshark, tcpdump, Fiddler, and Charles, then pinpoints TCP, HTTP, DNS, and TLS issues with filter expressions and remediation steps.
Lightweight Python Linux HIDS exposing SSH brute-force, web attack, and webshell alerts via MCP with ban controls.
Detects AI-generated images from Stable Diffusion, Midjourney, and GPT-4o via Tencent Cloud image moderation and returns risk scores.