mirror of
https://github.com/ljagiello/ctf-skills.git
synced 2026-09-14 14:17:37 +08:00
Lukasz Jagiello
b80ec3f2d5
Extracted 49 novel CTF techniques from 999 CTFTime writeups spanning 2019
competitions (nullcon HackIM, TAMUctf, BSidesSF, CONFidence Teaser, Pragyan,
Evlz, Codegate, UTCTF, STEM CTF, FireShell, Insomni'hack, and others).
Yield ceiling is bounded by source density: 581/999 writeups were under 15
lines (link-only) and only ~235 had substantive technical content.
Techniques added (by category):
- ctf-web (12): SSTI, cache poisoning, deser double-encoding, CVE-2014-9734,
Bazaar VCS reconstruction, CairoSVG XXE width, AMQP sslsplit, quote-adjacent
UNION filter bypass, X-Forwarded-For SQLi oracle, PHP INF juggling, UA-gated
robots.txt, colon/newline serialization injection
- ctf-pwn (12): alphanumeric shellcode push/pop rax bootstrap, scanf canary
skip, IS_MMAPED bit-flip, PIE mmap base predict, OOB dispatch table, static
ret2libc under 3-char limit, LSB-only fastbin, custom-allocator unlink,
Game Genie binary patcher, Go slice capacity aliasing, custom binfmt loader,
OOB accumulator overflow
- ctf-crypto (6): GHASH key recovery over prime modulus, SHA-1 length ext +
AES-CBC cookie, CRC32 collision + RSA homomorphism, Hensel's lemma mod p^k,
Rabin four-roots CRT, CBC previous-block byte flip
- ctf-reverse (5): Android smali + LocalBroadcastManager bypass, GDB strcmp
dynamic XOR recovery, CRT + matrix keygen, PEDA bit-by-bit flag scraper,
VM trace diffing
- ctf-forensics (5): steghide JPEG metadata, PNG magic repair, recursive
binwalk chain, exrex nested zip, multi-color QR brute force
- ctf-misc (6): Ruby unpack CVE-2018-8778, binary grid QR + XOR, sudo vim
symlink privesc, TOCTOU symlink race, TCP Fast Open RCE, closed-stdout jail
- ctf-ai-ml (2): foolbox L1BIM Keras, hand-rolled FGSM via K.gradients
- ctf-malware (1): ARP spoof + TCP RST IRC C2 capture
Structural changes:
- Split 3 files over 800 lines:
* ctf-web/server-side-advanced.md (852 -> 378) + server-side-advanced-4.md
* ctf-pwn/heap-techniques.md (835 -> 513) + heap-techniques-2.md
* ctf-reverse/tools-advanced.md (821 -> 407) + tools-advanced-2.md
- Fixed 69 pre-existing broken cross-file anchor links (missing double hyphens
from stripped `+` / `/` between spaces, missing underscores from `_`-bearing
identifiers like stub_execveat, modprobe_path, script_fields).
- Updated tests/test_cross_references.py: now strips fenced code blocks before
parsing markdown links (prevents false positives on JS `obj['k']('a')` and
similar), and fixed the slugify algorithm to match GitHub's real behavior
(preserve underscores, don't collapse adjacent whitespace).
Verification:
- 49/49 pytest tests pass (incl. TestAnchorLinks, TestLocalMarkdownLinks)
- Anchor validator reports 0 broken anchors, 0 broken links repo-wide
- README skill counts match filesystem (ctf-web 20, ctf-pwn 18, ctf-reverse 18)
- All SKILL.md files under 500 lines; largest supporting file 799 lines