ctf-forensics
ctf forensics
What it does
- 3d-printing.md - 3D printing forensics (PrusaSlicer binary G-code, QOIF, heatshrink)
- If you recover an encrypted blob and the hard part becomes RSA, AES, or lattice work, switch to /ctf-crypto.
- If the evidence really points to malware staging, beacon config extraction, or packed samples, switch to /ctf-malware.
- If the artifact is a web app backup or API dump and the remaining problem is application logic, switch to /ctf-web.
- If the forensic evidence is really an encoding puzzle, steganography trick, or esoteric format rather than true forensics, switch to /ctf-misc.
- If you need to trace infrastructure, attribute actors, or investigate public records from forensic findings, switch to /ctf-osint.
- If the recovered artifact is a compiled binary or firmware that needs disassembly and analysis, switch to /ctf-reverse.
Requirements & configuration
- If you need to trace infrastructure, attribute actors, or investigate public records from forensic findings, switch to /ctf-osint.
- If the recovered artifact is a compiled binary or firmware that needs disassembly and analysis, switch to /ctf-reverse.
- F5 JPEG DCT detection: Ratio of ±1 to ±2 AC coefficients drops from ~3:1 to ~1:1 with F5; sparse images need secondary ±2/±3 metric. See stego-image.md.
Configuration: RIFFGCDESELECTESC_G
Derived from the skill's own SKILL.md documentation · extracted 2026-07-23
ctf-forensics FAQ
What does the ctf-forensics skill do?
Provides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions, steganography, PDF analysis, Windows registry, Volatility, PCAP, Docker images, coredumps, side-channel power traces, DTMF audio spectrograms, packet timing analysis, CD audio disc images, or recovering deleted files and credentials. 3d-printing.md - 3D printing forensics (PrusaSlicer binary G-code, QOIF, heatshrink) If you recover an encrypted blob and the hard part becomes RSA, AES, or lattice work, switch to /ctf-crypto.
What does ctf-forensics require?
If you need to trace infrastructure, attribute actors, or investigate public records from forensic findings, switch to /ctf-osint. If the recovered artifact is a compiled binary or firmware that needs disassembly and analysis, switch to /ctf-reverse. F5 JPEG DCT detection: Ratio of ±1 to ±2 AC coefficients drops from ~3:1 to ~1:1 with F5; sparse images need secondary ±2/±3 metric. See stego-image.md. Configuration keys: RIFF, GCDE, SELECT, ESC_G.
How do I install ctf-forensics?
Run: npx -y skills add https://github.com/ljagiello/ctf-skills --skill ctf-forensics --agent claude-code — the source lives at github.com/ljagiello/ctf-skills.
Maintain ctf-forensics?
Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.
[](https://getagentictools.com/skills/ljagiello-ctf-skills-ctf-forensics?ref=badge) npx agentictools info skills/ljagiello-ctf-skills-ctf-forensics The second line is the CLI lookup for this page — handy in READMEs and docs.
