icoa-cli 2.19.459 → 2.19.461

package/refs/python.txt

@@ -1,103 +0,0 @@
-Python 3 Quick Reference
-========================
-
-DATA TYPES
-  x = 42                  int
-  x = 3.14                float
-  s = "hello"             str
-  b = b"\x41\x42"         bytes
-  L = [1, 2, 3]           list
-  T = (1, 2, 3)           tuple
-  D = {"a": 1}            dict
-  S = {1, 2, 3}           set
-
-STRINGS
-  s.upper() / s.lower()   Case conversion
-  s.strip()               Remove whitespace
-  s.split(",")            Split to list
-  ",".join(L)             Join list to string
-  s.replace("a", "b")     Replace
-  s.startswith("he")      Check prefix
-  s.encode()              str → bytes
-  b.decode()              bytes → str
-  f"Value: {x}"           F-string formatting
-
-BYTES & ENCODING
-  bytes.fromhex("4142")   Hex string → bytes
-  b.hex()                 Bytes → hex string
-  import base64
-  base64.b64encode(b)     Base64 encode
-  base64.b64decode(s)     Base64 decode
-
-LIST OPERATIONS
-  L.append(x)             Add to end
-  L.extend([4,5])         Extend list
-  L.pop()                 Remove last
-  L[1:3]                  Slice
-  L[::-1]                 Reverse
-  sorted(L)               Sort (new list)
-  [x*2 for x in L]        List comprehension
-  len(L)                  Length
-
-DICT OPERATIONS
-  D["key"]                Get value
-  D.get("key", default)   Get with default
-  D.keys()                All keys
-  D.values()              All values
-  D.items()               Key-value pairs
-  {**D1, **D2}            Merge dicts
-
-FILE I/O
-  with open("f.txt") as f:
-      content = f.read()
-
-  with open("f.txt", "w") as f:
-      f.write("data")
-
-  with open("f.bin", "rb") as f:
-      data = f.read()
-
-USEFUL MODULES
-  import os                OS operations
-  import sys               System-specific
-  import re                Regular expressions
-  import json              JSON parsing
-  import hashlib           Hash functions
-  import struct            Binary packing
-  import socket            Network sockets
-  import subprocess        Run commands
-  import itertools         Iteration tools
-  import collections       Specialized containers
-
-COMMON PATTERNS
-  # Read binary file
-  data = open("file", "rb").read()
-
-  # Decode an attached-data file (exam practicals save the blob to
-  # challenges/q<N>.txt inside the sandbox — base64, hex, or plain text)
-  import base64, re
-  blob = open("challenges/q36.txt").read().strip()  # replace N
-  raw = base64.b64decode(blob)           # if base64
-  # raw = bytes.fromhex(blob)            # if hex
-  m = re.search(rb"ICOA\{[^}]+\}", raw)
-  print(m.group().decode() if m else "no flag in raw bytes")
-
-  # Hex dump
-  print(data.hex())
-
-  # XOR bytes
-  result = bytes(a ^ b for a, b in zip(d1, d2))
-
-  # HTTP request
-  import requests
-  r = requests.get(url)
-  r = requests.post(url, data={"key": "val"})
-
-  # Run command
-  import subprocess
-  out = subprocess.check_output(["cmd", "arg"])
-
-  # Regex
-  import re
-  m = re.search(r"pattern", text)
-  matches = re.findall(r"pattern", text)

package/refs/r2.txt

@@ -1,85 +0,0 @@
-Radare2 Quick Reference
-=======================
-
-STARTING
-  r2 binary                      Open binary
-  r2 -d binary                   Debug mode
-  r2 -A binary                   Auto-analyze on open
-  r2 -w binary                   Write mode
-
-ANALYSIS
-  aaa                            Full analysis
-  afl                            List functions
-  afl~main                       Find main function
-  afn name addr                  Rename function
-  axt addr                       Cross-references to
-  axf addr                       Cross-references from
-
-NAVIGATION
-  s main                         Seek to function
-  s 0x401000                     Seek to address
-  s+10 / s-10                    Seek forward/back
-
-DISASSEMBLY
-  pd 20                          Disassemble 20 instructions
-  pdf                            Disassemble current function
-  pdf @ main                     Disassemble main
-  pD 100                         Disassemble 100 bytes
-
-PRINT DATA
-  px 64                          Hex dump 64 bytes
-  ps @ addr                      Print string
-  pf d @ addr                    Print as integer
-  p8 16                          Print 16 hex bytes
-
-VISUAL MODE
-  V                              Enter visual mode
-  VV                             Graph mode
-  p/P                            Cycle views in visual
-  q                              Quit visual
-
-SEARCHING
-  / string                       Search for string
-  /x 90909090                    Search hex pattern
-  /R pop rdi                     Search ROP gadget
-  iz                             List strings in data
-  izz                            List all strings
-
-INFORMATION
-  i                              File info
-  ie                             Entry point
-  iS                             Sections
-  ii                             Imports
-  iE                             Exports
-  is                             Symbols
-  il                             Libraries
-
-FLAGS / COMMENTS
-  f name @ addr                  Set flag (bookmark)
-  CC comment @ addr              Add comment
-  CCu                            Remove comment
-
-WRITE MODE (r2 -w)
-  wx 9090 @ addr                 Write hex bytes
-  wa "nop" @ addr                Write assembly
-
-DEBUG
-  db addr                        Breakpoint
-  dc                             Continue
-  ds                             Step
-  dr                             Show registers
-  dr rax=0                       Set register
-
-COMMON CTF PATTERNS
-  # Quick analysis
-  r2 -A binary
-  afl              # list functions
-  s main           # go to main
-  pdf              # disassemble
-
-  # Find strings
-  iz~flag
-  iz~password
-
-  # Decompile (with r2ghidra)
-  pdg @ main       # Ghidra decompiler output

package/refs/regex.txt

@@ -1,73 +0,0 @@
-Regular Expressions Quick Reference
-====================================
-
-BASIC PATTERNS
-  .                 Any character (except newline)
-  \d                Digit [0-9]
-  \D                Non-digit
-  \w                Word character [a-zA-Z0-9_]
-  \W                Non-word character
-  \s                Whitespace
-  \S                Non-whitespace
-  \b                Word boundary
-
-ANCHORS
-  ^                 Start of string/line
-  $                 End of string/line
-  \A                Start of string only
-  \Z                End of string only
-
-QUANTIFIERS
-  *                 0 or more
-  +                 1 or more
-  ?                 0 or 1
-  {n}               Exactly n
-  {n,}              n or more
-  {n,m}             Between n and m
-  *?  +?  ??        Non-greedy versions
-
-CHARACTER CLASSES
-  [abc]             a, b, or c
-  [a-z]             Lowercase letters
-  [A-Z]             Uppercase letters
-  [0-9]             Digits
-  [^abc]            NOT a, b, or c
-  [a-zA-Z0-9]      Alphanumeric
-
-GROUPS & REFERENCES
-  (pattern)         Capture group
-  (?:pattern)       Non-capture group
-  (?P<name>pat)     Named group (Python)
-  \1                Back-reference to group 1
-  (?=pattern)       Lookahead
-  (?!pattern)       Negative lookahead
-  (?<=pattern)      Lookbehind
-  (?<!pattern)      Negative lookbehind
-
-ALTERNATION
-  a|b               a or b
-  (cat|dog)         cat or dog
-
-COMMON CTF PATTERNS
-  # Flag format
-  icoa\{[^}]+\}
-
-  # IP address
-  \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}
-
-  # Hex string
-  [0-9a-fA-F]+
-
-  # Base64
-  [A-Za-z0-9+/]+=*
-
-  # Email
-  [\w.+-]+@[\w-]+\.[\w.]+
-
-  # URL
-  https?://[^\s]+
-
-GREP EXAMPLES
-  grep -E "icoa\{.*\}" file       Find flags
-  grep -oP "\d+\.\d+\.\d+\.\d+" f   Extract IPs
-  grep -rn "password" .           Search recursively

package/refs/requests.txt

@@ -1,83 +0,0 @@
-Python Requests Quick Reference
-===============================
-
-INSTALLATION
-  pip install requests
-
-BASIC REQUESTS
-  import requests
-
-  r = requests.get(url)
-  r = requests.post(url, data={"key": "val"})
-  r = requests.put(url, json={"key": "val"})
-  r = requests.delete(url)
-  r = requests.head(url)
-  r = requests.options(url)
-
-RESPONSE
-  r.status_code            HTTP status code
-  r.text                   Response body (str)
-  r.content                Response body (bytes)
-  r.json()                 Parse JSON response
-  r.headers                Response headers
-  r.cookies                Response cookies
-  r.url                    Final URL (after redirects)
-  r.elapsed                Time elapsed
-  r.history                Redirect history
-
-PARAMETERS
-  # URL parameters
-  r = requests.get(url, params={"q": "search"})
-
-  # Headers
-  r = requests.get(url, headers={"Authorization": "Bearer tok"})
-
-  # Cookies
-  r = requests.get(url, cookies={"session": "abc"})
-
-  # POST data (form-encoded)
-  r = requests.post(url, data={"user": "admin"})
-
-  # POST JSON
-  r = requests.post(url, json={"user": "admin"})
-
-  # File upload
-  r = requests.post(url, files={"file": open("f", "rb")})
-
-  # Timeout
-  r = requests.get(url, timeout=5)
-
-  # Disable SSL verification
-  r = requests.get(url, verify=False)
-
-  # Follow redirects
-  r = requests.get(url, allow_redirects=False)
-
-  # Proxy
-  r = requests.get(url, proxies={"http": "http://127.0.0.1:8080"})
-
-SESSIONS (persist cookies, headers)
-  s = requests.Session()
-  s.headers.update({"Authorization": "Bearer tok"})
-  s.get(url)              # cookies persist
-  s.post(url, data=data)  # same session
-
-AUTH
-  from requests.auth import HTTPBasicAuth
-  r = requests.get(url, auth=HTTPBasicAuth("user", "pass"))
-  # shorthand:
-  r = requests.get(url, auth=("user", "pass"))
-
-CTF PATTERNS
-  # SQL injection test
-  r = requests.get(url, params={"id": "1' OR '1'='1"})
-
-  # Cookie manipulation
-  r = requests.get(url, cookies={"admin": "true"})
-
-  # Brute force
-  for word in open("wordlist.txt"):
-      r = requests.post(url, data={"pass": word.strip()})
-      if "Success" in r.text:
-          print(f"Found: {word}")
-          break

package/refs/rules.txt

@@ -1,28 +0,0 @@
-ICOA 2026 Competition Rules
-===========================
-
-FORMAT
-  Jeopardy-style CTF
-  Categories: Crypto, Web, Pwn, Reverse, Forensics
-  Day 1: AI4CTF — Classic CTF with AI-assisted solving
-  Day 2: CTF4AI — Attacking AI models
-
-HINT BUDGET
-  Level A (General Guidance):   50 uses
-  Level B (Deep Analysis):      10 uses
-  Level C (Critical Assist):     2 uses
-  Token Cap:                    50,000 tokens
-
-RULES
-  - All tools must run inside the Docker sandbox
-  - Flag format: icoa{...}
-  - No collaboration between teams during competition
-  - All AI prompts are logged and auditable
-  - Competition times are enforced server-side
-  - Submitting after competition ends is not allowed
-
-SCORING
-  - Each challenge has fixed point value
-  - First-blood bonus may apply
-  - Final ranking by total score
-  - Ties broken by submission time

package/refs/scapy.txt

@@ -1,80 +0,0 @@
-Scapy Quick Reference
-=====================
-
-INSTALLATION
-  pip install scapy
-
-BASIC USAGE
-  from scapy.all import *
-
-PACKET CREATION
-  # IP packet
-  pkt = IP(dst="10.0.0.1")
-
-  # TCP SYN
-  pkt = IP(dst="10.0.0.1")/TCP(dport=80, flags="S")
-
-  # UDP packet
-  pkt = IP(dst="10.0.0.1")/UDP(dport=53)/DNS()
-
-  # ICMP ping
-  pkt = IP(dst="10.0.0.1")/ICMP()
-
-  # HTTP request
-  pkt = IP(dst="10.0.0.1")/TCP(dport=80)/Raw(b"GET / HTTP/1.1\r\n\r\n")
-
-SEND / RECEIVE
-  send(pkt)                Layer 3 send (no response)
-  sr(pkt)                  Send and receive (layer 3)
-  sr1(pkt)                 Send and receive 1 packet
-  sendp(pkt)               Layer 2 send
-  srp(pkt)                 Layer 2 send and receive
-
-READING PCAP
-  pkts = rdpcap("capture.pcap")
-  pkts.summary()
-  pkts[0].show()
-
-  # Filter packets
-  tcp_pkts = [p for p in pkts if TCP in p]
-  http = [p for p in pkts if p.haslayer(Raw)]
-
-  # Extract data
-  for p in pkts:
-      if Raw in p:
-          print(p[Raw].load)
-
-WRITING PCAP
-  wrpcap("output.pcap", pkts)
-
-PACKET INSPECTION
-  pkt.show()               Show packet details
-  pkt.summary()            One-line summary
-  ls(TCP)                  List TCP fields
-  pkt[TCP].sport           Access field
-  pkt.haslayer(TCP)        Check layer exists
-  hexdump(pkt)             Hex dump
-
-SNIFFING
-  pkts = sniff(count=10)
-  pkts = sniff(filter="tcp port 80", count=10)
-  sniff(prn=lambda p: p.summary())
-
-COMMON CTF PATTERNS
-  # Extract HTTP data from pcap
-  pkts = rdpcap("capture.pcap")
-  for p in pkts:
-      if TCP in p and Raw in p:
-          data = p[Raw].load
-          if b"flag" in data or b"icoa{" in data:
-              print(data)
-
-  # DNS exfiltration
-  dns_pkts = [p for p in pkts if DNS in p]
-  for p in dns_pkts:
-      if DNSQR in p:
-          print(p[DNSQR].qname)
-
-  # Reconstruct TCP stream
-  from scapy.layers.http import *
-  load_layer("http")

package/refs/sqlmap.txt

@@ -1,69 +0,0 @@
-SQLMap Quick Reference
-=====================
-
-BASIC USAGE
-  sqlmap -u "http://target/page?id=1"
-  sqlmap -u "http://target/page?id=1" --dbs       List databases
-  sqlmap -u "http://target/page?id=1" -D db --tables    List tables
-  sqlmap -u "http://target/page?id=1" -D db -T tbl --dump   Dump table
-
-POST REQUEST
-  sqlmap -u "http://target/login" --data="user=a&pass=b"
-  sqlmap -u "http://target/login" --data="user=a&pass=b" -p user
-
-FROM FILE (Burp/ZAP request)
-  sqlmap -r request.txt
-
-DETECTION
-  --level=5             Increase test level (1-5)
-  --risk=3              Increase risk level (1-3)
-  -p param              Test specific parameter
-  --dbms=mysql          Specify DBMS
-  --technique=BEUSTQ    Specify techniques
-
-ENUMERATION
-  --current-user        Current database user
-  --current-db          Current database
-  --dbs                 List all databases
-  --tables              List tables
-  --columns             List columns
-  --dump                Dump data
-  --dump-all            Dump everything
-  --passwords           Enumerate password hashes
-  --privileges          User privileges
-
-AUTHENTICATION
-  --cookie="session=abc"          Cookie
-  --headers="Authorization: Bearer tok"   Header
-  --auth-type=basic --auth-cred=user:pass
-  --proxy=http://127.0.0.1:8080
-
-TECHNIQUES
-  B  Boolean-based blind
-  E  Error-based
-  U  Union query
-  S  Stacked queries
-  T  Time-based blind
-  Q  Inline queries
-
-OPTIONS
-  --batch              Auto-answer all questions
-  --threads=5          Parallel threads
-  --random-agent       Random User-Agent
-  --tamper=space2comment   Use tamper script
-  --os-shell           OS command shell
-  --sql-shell          SQL interactive shell
-  --file-read=/etc/passwd   Read file
-  --file-write=shell.php --file-dest=/var/www/shell.php
-
-COMMON CTF PATTERNS
-  # Basic enumeration
-  sqlmap -u "http://target/?id=1" --batch --dbs
-  sqlmap -u "http://target/?id=1" --batch -D ctf --tables
-  sqlmap -u "http://target/?id=1" --batch -D ctf -T flag --dump
-
-  # Bypass WAF
-  sqlmap -u URL --tamper=space2comment,between,randomcase
-
-  # Read flag file
-  sqlmap -u URL --file-read="/flag.txt"

package/refs/steghide.txt

@@ -1,71 +0,0 @@
-Steghide & Steganography Quick Reference
-=========================================
-
-STEGHIDE
-  # Embed data in image
-  steghide embed -cf image.jpg -ef secret.txt
-  steghide embed -cf image.jpg -ef secret.txt -p "password"
-
-  # Extract hidden data
-  steghide extract -sf image.jpg
-  steghide extract -sf image.jpg -p "password"
-
-  # Get info about embedded data
-  steghide info image.jpg
-
-  # Supported formats: JPEG, BMP, WAV, AU
-
-ZSTEG (PNG/BMP)
-  zsteg image.png                All checks
-  zsteg -a image.png             Try all combinations
-  zsteg image.png -b 1           Check LSB
-  zsteg image.png -E "b1,r,lsb" Extract specific channel
-
-STEGSOLVE (GUI)
-  java -jar stegsolve.jar
-  # Cycle through bit planes
-  # XOR / AND / OR images
-
-OTHER TOOLS
-  # strings — find readable text
-  strings file
-  strings -n 10 file             Min length 10
-  strings -e l file              Little-endian
-
-  # exiftool — metadata
-  exiftool image.jpg
-  exiftool -all= image.jpg       Remove all metadata
-
-  # pngcheck — PNG structure
-  pngcheck -v image.png
-
-  # foremost — file carving
-  foremost -i image.png -o ./output/
-
-  # outguess
-  outguess -r image.jpg output.txt
-  outguess -k "password" -r image.jpg output.txt
-
-LSB STEGANOGRAPHY (Python)
-  from PIL import Image
-
-  img = Image.open("steg.png")
-  px = img.load()
-  bits = ""
-  for y in range(img.height):
-      for x in range(img.width):
-          r, g, b = px[x, y][:3]
-          bits += str(r & 1)
-          bits += str(g & 1)
-          bits += str(b & 1)
-
-  msg = bytes(int(bits[i:i+8], 2) for i in range(0, len(bits), 8))
-  print(msg)
-
-COMMON CTF WORKFLOW
-  1. strings file           Look for readable text
-  2. exiftool file           Check metadata / comments
-  3. binwalk file            Check for embedded files
-  4. steghide info file      Check for steghide data
-  5. zsteg file (if PNG)     Check LSB channels
-  6. Compare with original   Visual / binary diff

package/refs/struct.txt

@@ -1,61 +0,0 @@
-Python struct Module Quick Reference
-====================================
-
-IMPORT
-  import struct
-
-PACK (Python → bytes)
-  struct.pack("<I", 0x41414141)    Little-endian uint32
-  struct.pack(">I", 0x41414141)    Big-endian uint32
-  struct.pack("<Q", addr)          Little-endian uint64
-  struct.pack("<HH", 0x1234, 0x5678)  Two uint16
-
-UNPACK (bytes → Python)
-  struct.unpack("<I", data)        → (value,)  tuple
-  struct.unpack("<II", data)       → (val1, val2)
-  val = struct.unpack("<I", data)[0]  Single value
-
-FORMAT CHARACTERS
-  Byte order:
-    <         Little-endian
-    >         Big-endian
-    !         Network (big-endian)
-    =         Native
-
-  Types:
-    b / B     int8 / uint8      (1 byte)
-    h / H     int16 / uint16    (2 bytes)
-    i / I     int32 / uint32    (4 bytes)
-    l / L     int32 / uint32    (4 bytes)
-    q / Q     int64 / uint64    (8 bytes)
-    f         float             (4 bytes)
-    d         double            (8 bytes)
-    s         char[]            (N bytes)
-    x         padding           (1 byte)
-
-SIZE
-  struct.calcsize("<IHH")         Calculate packed size
-
-COMMON CTF PATTERNS
-  # Read binary header
-  with open("file", "rb") as f:
-      magic = struct.unpack("<I", f.read(4))[0]
-      size = struct.unpack("<H", f.read(2))[0]
-
-  # Parse ELF header fields
-  data = open("binary", "rb").read()
-  e_entry = struct.unpack("<Q", data[0x18:0x20])[0]
-
-  # Build payload with addresses
-  payload = b""
-  payload += struct.pack("<Q", 0x400000)   # return addr
-  payload += struct.pack("<Q", 0x601020)   # GOT entry
-
-  # Unpack multiple values
-  fields = struct.unpack("<IIHH", data[:12])
-  id, flags, type, size = fields
-
-  # Iterate over array of structs
-  ENTRY_SIZE = struct.calcsize("<IIQ")
-  for i in range(0, len(data), ENTRY_SIZE):
-      a, b, c = struct.unpack("<IIQ", data[i:i+ENTRY_SIZE])