ctf-agent 1.2.0

package/skills/ctf-misc/rf-sdr.md

@@ -0,0 +1,91 @@
+# CTF Misc - RF / SDR / IQ Signal Processing
+
+Techniques for Software-Defined Radio (SDR) signal processing using In-phase/Quadrature (IQ) data.
+
+## IQ File Formats
+- **cf32** (complex float 32): GNU Radio standard, `np.fromfile(path, dtype=np.complex64)`
+- **cs16** (complex signed 16-bit): `np.fromfile(path, dtype=np.int16).reshape(-1,2)`, then `I + jQ`
+- **cu8** (complex unsigned 8-bit): RTL-SDR raw format
+
+## Analysis Pipeline
+```python
+import numpy as np
+from scipy import signal
+
+# 1. Load IQ data
+iq = np.fromfile('signal.cf32', dtype=np.complex64)
+
+# 2. Spectrum analysis - find occupied bands
+fft_data = np.fft.fftshift(np.fft.fft(iq[:4096]))
+freqs = np.fft.fftshift(np.fft.fftfreq(4096))
+power_db = 20*np.log10(np.abs(fft_data)+1e-10)
+
+# 3. Identify symbol rate via cyclostationary analysis
+x2 = np.abs(iq_filtered)**2  # squared magnitude
+fft_x2 = np.abs(np.fft.fft(x2, n=65536))
+# Peak in fft_x2 = symbol rate (samples_per_symbol = 1/peak_freq)
+
+# 4. Frequency shift to baseband
+center_freq = 0.14  # normalized frequency of band center
+t = np.arange(len(iq))
+baseband = iq * np.exp(-2j * np.pi * center_freq * t)
+
+# 5. Low-pass filter to isolate band
+lpf = signal.firwin(101, bandwidth/2, fs=1.0)
+filtered = signal.lfilter(lpf, 1.0, baseband)
+```
+
+## QAM-16 Demodulation with Carrier + Timing Recovery
+QAM-16 (Quadrature Amplitude Modulation) — the key challenge is carrier frequency offset causing constellation rotation (circles instead of points).
+
+**Decision-directed carrier recovery + Mueller-Muller timing:**
+```python
+# Loop parameters (2nd order PLL)
+carrier_bw = 0.02  # wider BW = faster tracking, more noise
+damping = 1.0
+theta_n = carrier_bw / (damping + 1/(4*damping))
+Kp = 2 * damping * theta_n      # proportional gain
+Ki = theta_n ** 2                # integral gain
+
+carrier_phase = 0.0
+carrier_freq = 0.0
+
+for each symbol sample:
+    # De-rotate by current phase estimate
+    symbol = raw_sample * np.exp(-1j * carrier_phase)
+
+    # Find nearest constellation point (decision)
+    nearest = min(constellation, key=lambda p: abs(symbol - p))
+
+    # Phase error (decision-directed)
+    error = np.imag(symbol * np.conj(nearest)) / (abs(nearest)**2 + 0.1)
+
+    # Update 2nd order loop
+    carrier_freq += Ki * error
+    carrier_phase += Kp * error + carrier_freq
+```
+
+**Mueller-Muller timing error detector:**
+```python
+timing_error = (Re(y[n]-y[n-1]) * Re(d[n-1]) - Re(d[n]-d[n-1]) * Re(y[n-1]))
+             + (Im(y[n]-y[n-1]) * Im(d[n-1]) - Im(d[n]-d[n-1]) * Im(y[n-1]))
+# y = received symbol, d = decision (nearest constellation point)
+```
+
+## Key Insights for RF CTF Challenges
+- **Circles in constellation** = constant frequency offset (points rotate at fixed rate, forming a ring)
+- **Spirals** = frequency offset that drifts over time (ring radius changes as amplitude/AGC also drifts). If you see points tracing outward arcs rather than closed circles, suspect combined frequency + gain instability
+- **Blobs on grid** = correct sync, just noise
+- **4-fold ambiguity**: DD carrier recovery can lock with 0/90/180/270 rotation - try all 4
+- **Bandwidth vs symbol rate**: BW = Rs x (1 + alpha), where alpha is roll-off factor (0 to 1)
+- **RC vs RRC**: "RC pulse shaping" at TX means receiver just samples (no matched filter needed); "RRC" means apply matched RRC filter at RX
+- **Cyclostationary peak at Rs** confirms symbol rate even without knowing modulation order
+- **AGC**: normalize signal power to match constellation power: `scale = sqrt(target_power / measured_power)`
+- **GNU Radio's QAM-16 default mapping** is NOT Gray code - always check the provided constellation map
+
+## Common Framing Patterns
+- Idle/sync pattern repeating while link is idle
+- Start delimiter (often a single symbol like 0)
+- Data payload (nibble pairs for QAM-16: high nibble first, low nibble)
+- End delimiter (same as start, e.g., 0)
+- The idle pattern itself may contain the delimiter value - distinguish by context (is it part of the 16-symbol repeating pattern?)

package/skills/ctf-osint/SKILL.md

@@ -0,0 +1,198 @@
+---
+name: ctf-osint
+description: Provides open source intelligence techniques for CTF challenges. Use when gathering information from public sources, social media, geolocation, DNS records, username enumeration, reverse image search, Google dorking, Wayback Machine, Tor relays, FEC filings, or identifying unknown data like hashes and coordinates.
+license: MIT
+compatibility: Requires filesystem-based agent (Claude Code or similar) with bash, Python 3, and internet access for OSINT lookups.
+allowed-tools: Bash Read Write Edit Glob Grep Task WebFetch WebSearch
+metadata:
+  user-invocable: "false"
+---
+
+# CTF OSINT
+
+Quick reference for OSINT CTF challenges. Each technique has a one-liner here; see supporting files for full details.
+
+## Prerequisites & Tooling
+
+Pre-installed via [scripts/install_ctf_tools.sh](../../scripts/install_ctf_tools.sh):
+- **Python packages**: `shodan`, `Pillow` (in `~/.ctf-tools/venv`)
+- **System binaries**: `whois`, `dnsutils` (`dig`, `nslookup`), `nmap`, `exiftool`, `imagemagick` (`convert`, `identify`), `curl`
+
+## Execution Environment & Tool Invocation
+
+- **On Windows (WSL Kali Linux)**:
+  - Run OSINT intelligence and recon tools inside WSL:
+    ```bash
+    wsl -d kali-linux bash -c "whois domain.com"
+    wsl -d kali-linux bash -c "dig +nocmd domain.com any +multiline +noall +answer"
+    wsl -d kali-linux bash -c "exiftool photo.jpg"
+    wsl -d kali-linux bash -c "source ~/.ctf-tools/venv/bin/activate && shodan host <IP>"
+    ```
+- **On Native Linux / WSL**:
+  - Activate the CTF virtualenv:
+    ```bash
+    source ~/.ctf-tools/venv/bin/activate
+    ```
+  - Use `whois`, `dig`, `nmap`, `exiftool`, `curl`, and `shodan` directly.
+
+## Additional Resources
+
+- [social-media.md](social-media.md) - Twitter/X (user IDs, Snowflake timestamps, Nitter, memory.lol, Wayback CDX), Tumblr (blog checks, post JSON, avatars), BlueSky search + API, Unicode homoglyph steganography, Discord API, username OSINT (namechk, whatsmyname, Osint Industries), username metadata mining (postal codes), platform false positives, multi-platform chains, Strava fitness route OSINT
+- [geolocation-and-media.md](geolocation-and-media.md) - Image analysis, reverse image search (including Baidu for China), Google Lens cropped region search, reflected/mirrored text reading, geolocation techniques (railroad signs, infrastructure maps, MGRS), Google Plus Codes, EXIF/metadata, hardware identification, newspaper archives, IP geolocation, Google Street View panorama matching, What3Words micro-landmark matching, Google Maps crowd-sourced photo verification, Overpass Turbo spatial queries, music-themed landmark geolocation with key encoding
+- [web-and-dns.md](web-and-dns.md) - Google dorking (including TBS image filters), Google Docs/Sheets enumeration, DNS recon (TXT, zone transfers), Wayback Machine, FEC research, Tor relay lookups, GitHub repository analysis, Telegram bot investigation, WHOIS investigation (reverse WHOIS, historical WHOIS, IP/ASN lookup), fake service banner detection via nmap fingerprinting
+
+---
+
+## When to Pivot
+
+- If you already have the files or packets locally and now need extraction or carving, switch to `/ctf-forensics`.
+- If the task becomes active exploitation of a live HTTP service, switch to `/ctf-web`.
+- If you uncover malware samples, beacons, or suspicious binaries during attribution, switch to `/ctf-malware`.
+
+## Quick Start Commands
+
+```bash
+# DNS recon
+dig -t any target.com
+dig -t txt target.com
+dig axfr @ns.target.com target.com
+whois target.com
+
+# Image metadata
+exiftool image.jpg
+identify -verbose image.jpg | head -30
+
+# Web archive
+curl "https://web.archive.org/web/20230101*/target.com"
+
+# Username lookup
+curl -s "https://whatsmyname.app/api/lookup?username=<user>"
+
+# Shodan
+shodan search "hostname:target.com"
+shodan host <ip>
+```
+
+## String Identification
+
+- 40 hex chars -> SHA-1 (Tor fingerprint)
+- 64 hex chars -> SHA-256
+- 32 hex chars -> MD5
+
+## Twitter/X Account Tracking
+
+- Persistent numeric User ID: `https://x.com/i/user/<id>` works even after renames.
+- Snowflake timestamps: `(id >> 22) + 1288834974657` = Unix ms.
+- Wayback CDX, Nitter, memory.lol for historical data. See [social-media.md](social-media.md).
+
+## Tumblr Investigation
+
+- Blog check: `curl -sI` for `x-tumblr-user` header. Avatar at `/avatar/512`. See [social-media.md](social-media.md).
+
+## Username OSINT
+
+- [whatsmyname.app](https://whatsmyname.app) (741+ sites), [namechk.com](https://namechk.com). Watch for platform false positives. See [social-media.md](social-media.md).
+
+## Image Analysis & Reverse Image Search
+
+- Google Lens (crop to region of interest), Google Images, TinEye, Yandex (faces). Check corners for visual stego. Twitter strips EXIF. See [geolocation-and-media.md](geolocation-and-media.md).
+- **Cropped region search:** Isolate distinctive elements (shop signs, building facades) and search via Google Lens for better results than full-scene search. See [geolocation-and-media.md](geolocation-and-media.md).
+- **Reflected text:** Flip mirrored/reflected text (water, glass) horizontally; search partial text with quoted strings. See [geolocation-and-media.md](geolocation-and-media.md).
+
+## Geolocation
+
+- Railroad signs, infrastructure maps (OpenRailwayMap, OpenInfraMap), process of elimination. See [geolocation-and-media.md](geolocation-and-media.md).
+- **Street View panorama matching:** Feature extraction + multi-metric image similarity ranking against candidate panoramas. Useful when challenge image is a crop of a Street View photo. See [geolocation-and-media.md](geolocation-and-media.md).
+- **Road sign OCR:** Extract text from directional signs (town names, route numbers) to pinpoint road corridors. Driving side + sign style + script identify the country. See [geolocation-and-media.md](geolocation-and-media.md).
+- **Architecture + brand identification:** Post-Soviet concrete = Russia/CIS; named businesses → search locations/branches → cross-reference with coastline/terrain. See [geolocation-and-media.md](geolocation-and-media.md).
+- **Music-themed landmark geolocation:** Multiple images of music-related landmarks worldwide; each yields a piano key number encoding one flag character. Identify all locations first, then decode the key sequence. See [geolocation-and-media.md](geolocation-and-media.md).
+
+## MGRS Coordinates
+
+- Grid format "4V FH 246 677" -> online converter -> lat/long -> Google Maps. See [geolocation-and-media.md](geolocation-and-media.md).
+
+## Google Plus Codes
+
+- Format `XXXX+XXX` (chars: `23456789CFGHJMPQRVWX`). Drop a pin on Google Maps → Plus Code appears in details. Free, no API key needed. See [geolocation-and-media.md](geolocation-and-media.md).
+
+## Metadata Extraction
+
+```bash
+exiftool image.jpg           # EXIF data
+pdfinfo document.pdf         # PDF metadata
+mediainfo video.mp4          # Video metadata
+```
+
+## Google Dorking
+
+```text
+site:example.com filetype:pdf
+intitle:"index of" password
+```
+
+**Image TBS filters:** Append `&tbs=itp:face` to Google Image URLs to filter for faces only (strips logos/banners). See [web-and-dns.md](web-and-dns.md).
+
+## Google Docs/Sheets
+
+- Try `/export?format=csv`, `/pub`, `/gviz/tq?tqx=out:csv`, `/htmlview`. See [web-and-dns.md](web-and-dns.md).
+
+## DNS Reconnaissance
+
+```bash
+dig -t txt subdomain.ctf.domain.com
+dig axfr @ns.domain.com domain.com  # Zone transfer
+```
+
+Always check TXT, CNAME, MX for CTF domains. See [web-and-dns.md](web-and-dns.md).
+
+## Tor Relay Lookups
+
+- `https://metrics.torproject.org/rs.html#simple/<FINGERPRINT>` -- check family, sort by "first seen". See [web-and-dns.md](web-and-dns.md).
+
+## GitHub Repository Analysis
+
+- Check issue comments, PR reviews, commit messages, wiki edits via `gh api`. See [web-and-dns.md](web-and-dns.md).
+
+## Telegram Bot Investigation
+
+- Find bot references in browser history, interact via `/start`, answer verification questions. See [web-and-dns.md](web-and-dns.md).
+
+## FEC Political Donation Research
+
+- FEC.gov for committee receipts; 501(c)(4) orgs obscure original funders. See [web-and-dns.md](web-and-dns.md).
+
+## IP Geolocation
+
+```bash
+curl "http://ip-api.com/json/103.150.68.150"
+```
+
+See [geolocation-and-media.md](geolocation-and-media.md).
+
+## Unicode Homoglyph Steganography
+
+**Pattern:** Visually-identical Unicode characters from different blocks (Cyrillic, Greek, Math) encode binary data in social media posts. ASCII = 0, homoglyph = 1. Group bits into bytes for flag. See [social-media.md](social-media.md#unicode-homoglyph-steganography-on-bluesky-metactf-2026).
+
+## BlueSky Public API
+
+No auth needed. Endpoints: `public.api.bsky.app/xrpc/app.bsky.feed.searchPosts?q=...`, `app.bsky.actor.searchActors`, `app.bsky.feed.getAuthorFeed`. Check all replies to official posts. See [social-media.md](social-media.md#unicode-homoglyph-steganography-on-bluesky-metactf-2026).
+
+## Fake Service Banner Detection
+
+**Pattern:** Port appears open on a standard service port (22/SSH, 80/HTTP) but runs a fake service. `nmap -sV` or `nc host port` reveals the flag in the banner. Never trust port numbers alone -- always fingerprint the service. See [web-and-dns.md](web-and-dns.md#fake-service-banner-detection-via-fingerprinting-metactf-flash-2026).
+
+## Shodan SSH Fingerprint Lookup
+
+Search Shodan by SSH host key fingerprint to identify servers: `shodan search "fingerprint:AA:BB:CC:..."`. See [web-and-dns.md](web-and-dns.md#shodan-ssh-fingerprint-lookup-ekoparty-ctf-2016).
+
+## Gaming Platform OSINT
+
+Lookup usernames across gaming platforms (Steam, Xbox, PSN, MMOs) for character profiles, activity, and linked accounts. See [social-media.md](social-media.md#gaming-platform-osint--mmo-character-lookup-csaw-ctf-2016).
+
+## Resources
+
+- **Shodan** - Internet-connected devices
+- **Censys** - Certificate and host search
+- **VirusTotal** - File/URL reputation
+- **WHOIS** - Domain registration
+- **Wayback Machine** - Historical snapshots