CTF•数字取证
用于磁盘镜像、内存转储、事件日志、PCAP、隐写分析、Windows 注册表、音频信号、Docker 镜像、coredump 以及已删除文件与凭据恢复等取证类 CTF 题;触发名:ctf-forensics
Profile →npx skills add asdfgh1445/ctf-super-hub --skill ctf-forensics --agent codex
Same command for any agent — swap --agent for claude-code, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
What it does
Guides an agent to perform various digital forensics tasks related to CTF challenges, including disk imaging, memory analysis, event log inspection, PCAP analysis, steganography, Windows registry review, audio signal analysis, Docker image forensics, coredump handling, and recovery of deleted files and credentials. It enumerates prerequisites, provides a quick-start command set, and offers topic-specific references for deeper exploration.
How it works
The skill outlines concrete procedures and commands for common forensics tasks, such as:
- Installing required Python packages and system tools (e.g., volatility3, Pillow, numpy, matplotlib; binwalk, foremost, exiftool, tshark, sleuthkit, ffmpeg, steghide, testdisk, john, pcapfix; gem install zsteg).
- Performing file and metadata analysis with commands like file, exiftool, binwalk, strings, hexdump, and various OS-specific forensics steps.
- Disk forensics steps: mounting images, listing and carving files, and analyzing memory with Volatility 3 verbs (windows.info, windows.pslist, windows.filescan).
- Windows event log and registry inspection, NTFS ADS handling, and PowerShell history review.
- Steganography techniques and tool usage (steghide, zsteg, stegsolve) with specific techniques listed.
- Disk/VM/Memory forensics sections detailing mounting, extraction, and memory analysis workflows, plus string carving and coredump inspection.
- References to dedicated topic pages (disk-and-memory.md, windows.md, steganography topics) for deeper workflows.
When to use it
Use when approaching CTF forensic challenges that span disk/memory forensics, event logs, PCAPs, steganography, registries, and related artifacts. The quick-start commands and topic sections provide immediate actions aligned with typical forensics tasks in CTF contexts.
What it can touch
The skill declares allowed tools: Bash, Read, Write, Edit, Glob, Grep, Task, WebFetch, WebSearch. It requires a filesystem-based agent with bash, Python 3, and internet access for tool installation. No other direct touch points are specified beyond these tools and the listed commands.
Caveats
Licensed as MIT within the skill, and labeled compatibility requires a filesystem-based agent (Claude Code or similar) with bash, Python 3, and internet access for tool installation. The description emphasizes CTF-focused forensics and provides no guarantees about real-world forensics applicability beyond its stated scope.
# CTF Forensics & Blockchain Quick reference for forensics CTF challenges. Each technique has a one-liner here; see supporting files for full details. ## Prerequisites **Python packages (all platforms):** ```bash pip install volatility3 Pillow numpy matplotlib ``` **Linux (apt):** ```bash apt install binwalk foremost libimage-exiftool-perl tshark sleuthkit \ ffmpeg steghide testdisk john pcapfix ``` **macOS (Homebrew):** ```bash brew install binwalk exiftool wireshark sleuthkit ffmpeg \ testdisk john-jumbo ``` **Ruby gems (all platforms):** ```bash gem install zsteg ``` ## Additional Resources - [3d-printing.md](3d-printing.md) - 3D printing forensics (PrusaSlicer binary G-code, QOIF, heatshrink) - [windows.md](windows.md) - Windows forensics (registry, SAM, event logs, recycle bin, NTFS alternate data streams, USN journal, PowerShell history, Defender MPLog, WMI persistence, Amcache) - [network.md](network.md) - Network forensics basics (tcpdump, TLS/SSL keylog decryption, TLS master key extraction from coredump, Wireshark, PCAP, port scanning, SMB3 decryption, 5G/NR protocols, WordPress recon, credentials, USB HID steno, BCD encoding, HTTP file upload exfiltration, split archive
- Prerequisites
- Additional Resources
- When to Pivot
- Quick Start Commands
- Log Analysis
- Windows Event Logs (.evtx)
- When Logs Are Cleared
- Steganography
- PDF Analysis
- Disk / VM / Memory Forensics
- Windows Password Hashes
- Bitcoin Tracing
- Uncommon File Magic Bytes
- Common Flag Locations
pip install volatility3 Pillow numpy matplotlib apt install binwalk foremost libimage-exiftool-perl tshark sleuthkit \ ffmpeg steghide testdisk john pcapfix brew install binwalk exiftool wireshark sleuthkit ffmpeg \ testdisk john-jumbo gem install zsteg File analysis file suspicious_file exiftool suspicious_file # Metadata binwalk suspicious_file # Embedded files
What does the CTF•数字取证 skill do?
用于磁盘镜像、内存转储、事件日志、PCAP、隐写分析、Windows 注册表、音频信号、Docker 镜像、coredump 以及已删除文件与凭据恢复等取证类 CTF 题;触发名:ctf-forensics
How do I install it?
Run `npx skills add asdfgh1445/ctf-super-hub --skill ctf-forensics --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From asdfgh1445/ctf-super-hub, a repository with 718 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.