ctf-web
ctf web
What it does
- ysoserial — GitHub, requires Java (Java deserialization payloads)
- server-side-exec.md - Direct code execution paths, upload-to-RCE, deserialization-adjacent execution, LaTeX injection, header and API abuses
- server-side-deser.md - Java/Python/PHP deserialization and race-condition playbooks, PHP SoapClient CRLF SSRF via deserialization
- server-side-advanced.md - Advanced SSRF, traversal, archive, parser, framework, and modern app-server issues, Nginx alias traversal
- server-side-advanced-2.md - Docker API SSRF, Castor/XML, Apache expression reads, parser discrepancies, Windows path tricks, rogue MySQL server file read
- client-side.md - XSS, CSRF, cache poisoning, DOM tricks, admin bot abuse, request smuggling, paywall bypass
- client-side-advanced.md - CSP bypasses, Unicode tricks, XSSI, CSS exfiltration, browser normalization quirks, postMessage null origin bypass
Requirements & configuration
- Go tools (all platforms, requires Go):
- ysoserial — GitHub, requires Java (Java deserialization payloads)
- If the challenge requires gathering intelligence from public web sources, DNS records, or social media before exploitation, switch to /ctf-osint.
- echo '<token>' | cut -d. -f2 | base64 -d 2>/dev/null | jq .
- Can you turn the bug into a smaller primitive first: read one file, forge one token, call one internal endpoint, trigger one bot visit?
Configuration: POSTPATCHTRACE
Derived from the skill's own SKILL.md documentation · extracted 2026-07-23
ctf-web FAQ
What does the ctf-web skill do?
Provides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, identity flow, or smart-contract frontend/backend surface, including XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, request smuggling, OAuth/OIDC, SAML, prototype pollution, and similar web bugs. Do not use it for native binary memory corruption, reverse engineering of standalone executables, disk or memory forensics, or pure cryptanalysis unless the web flaw is still the main path to the flag. ysoserial — GitHub, requires Java (Java deserialization payloads) server-side-exec.md - Direct code execution paths, upload-to-RCE, deserialization-adjacent execution, LaTeX injection, header and API abuses
What does ctf-web require?
Go tools (all platforms, requires Go): ysoserial — GitHub, requires Java (Java deserialization payloads) If the challenge requires gathering intelligence from public web sources, DNS records, or social media before exploitation, switch to /ctf-osint. echo '<token>' | cut -d. -f2 | base64 -d 2>/dev/null | jq . Can you turn the bug into a smaller primitive first: read one file, forge one token, call one internal endpoint, trigger one bot visit? Configuration keys: POST, PATCH, TRACE.
How do I install ctf-web?
Run: npx -y skills add https://github.com/ljagiello/ctf-skills --skill ctf-web --agent claude-code — the source lives at github.com/ljagiello/ctf-skills.
Maintain ctf-web?
Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.
[](https://getagentictools.com/skills/ljagiello-ctf-skills-ctf-web?ref=badge) npx agentictools info skills/ljagiello-ctf-skills-ctf-web The second line is the CLI lookup for this page — handy in READMEs and docs.
