Identify forensic artifacts across disk images, memory dumps, logs, and PCAPs.
npx skills add https://github.com/ramzxy/CTF --skill ctf-forensics
Please help me install this Agent Skill. Skill: ctf-forensics Source: https://github.com/ramzxy/CTF/tree/main/.agents/skills/ctf-forensics Command: npx skills add https://github.com/ramzxy/CTF --skill ctf-forensics
This Skill provides a consolidated reference for digital forensics and blockchain analysis in Capture The Flag (CTF) challenges, enabling rapid identification and contextualization of artifacts across multiple data sources.
High-intent search queries and answers about installing and using this skill.
To analyze a memory dump, you inspect it using tools like Volatility 3 to extract process lists, registry hives, and event logs. This structured investigation helps identify hidden flags and indicators of compromise across the captured memory state.
Examining network captures involves using tools like tshark to filter PCAP files for specific protocols such as HTTP. You review the extracted network traffic data to identify flag-like indicators and trace communication patterns.
Scanning a disk image involves using tools like binwalk to identify and extract embedded artifacts. This cross-source analysis enables rapid discovery of evidence and hidden flags within the raw disk data structure.
Yes, you can trace cryptocurrency transactions by applying structured investigation workflows to blockchain artifacts. This process contextualizes transaction data to reveal evidence and flags hidden within the blockchain trace.
Yes, the workflow supports cross-source artifact analysis, allowing you to review Windows event logs alongside disk images and memory dumps. This consolidated reference accelerates evidence discovery and validates findings across multiple data sources.
jd-opensourceIdentify and extract artifacts from memory dumps, PCAPs, and disk images.
doghelWangDetect and parse JSON, XML, Protobuf, SQLite, and raw binary files.
zebbernExtract embedded files and metadata from firmware, memory dumps, and PCAP captures.
langbyyiAnalyze obfuscated malware and decrypt C2 traffic for CTF challenges.
