skills.rest
hanmujun
hanmujunCOMMUNITY
Explore all skills by this author →
GitHub

ctf-forensics

Solves authorized CTF forensics challenges across packet captures, disk, memory, and steganography.

1|Updated Aug 3, 2026
Search Tags:#log analysis#ctf#memory dump#steganography#forensics#pcap#data recovery
One-click install
npx skills add https://github.com/hanmujun/hanmujun-agent-public --skill ctf-forensics-hanmujun
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ctf-forensics
Source: https://github.com/hanmujun/hanmujun-agent-public/tree/main/.agents/skills/ctf-forensics
Command: npx skills add https://github.com/hanmujun/hanmujun-agent-public --skill ctf-forensics-hanmujun

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? CTF forensics challenges require analyzing diverse evidence artifacts like packet captures, disk images, memory dumps, logs, and steganographic files, and this Skill provides a structured entry point to the full forensics methodology for solving them. ## Core Features & Use Cases - Multi-artifact analysis: Covers packet captures, disk images, memory dumps, log files, file carving, steganography, and data recovery scenarios. - Reference-driven workflow: Routes to the complete technical manual in the skill library and selects in-depth references on demand. - Evidence preservation: Keeps original attachments intact and records derived files in separate directories without directly submitting flags. - Use Case: Given a challenge attachment containing a suspicious pcap file, load this Skill to follow the forensics manual, extract hidden data, and produce a candidate flag with documented evidence. ## Quick Start Load the ctf-forensics skill and analyze the attached challenge file to identify hidden or recoverable flag evidence.

Frequently Asked Questions about ctf-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I solve CTF forensics challenges with packet captures?▼

Load this Skill to access the full forensics manual, which guides packet capture analysis for extracting hidden data and flag evidence. It covers pcap inspection workflows and directs you to detailed references for specific protocols and carving techniques.

What types of files can CTF forensics analysis handle?▼

The Skill covers packet captures, disk images, memory dumps, log files, general files, steganography content, and data recovery artifacts. Each artifact type has dedicated references selected on demand from the skill library.

How to analyze steganography in CTF challenges?▼

Follow the forensics manual referenced by this Skill, which includes steganography detection and extraction techniques for images and other media. Preserve the original attachment and store any derived extraction outputs in a separate directory.

Does this Skill submit flags automatically?▼

No, the Skill explicitly does not submit flags directly. It focuses on analysis and evidence documentation, producing candidate flags that go through the broader agent workflow for verification and submission.

Why should original challenge attachments be preserved during forensics analysis?▼

Preserving originals prevents evidence corruption and allows re-analysis with different techniques if initial attempts fail. The Skill records all derived files in separate directories to maintain a clean chain of evidence.

Related Skills

Explore More Software Engineering Skills→
ljagielloljagiello
3.0k

solve-challenge

Automate CTF challenge analysis by scanning files and connecting to services.

Community
Intermediate
hanc00lhanc00l

competition

Fetch CTF competition challenges, obtain hints, and submit answers via API.

Community
Intermediate
salmanabdurrahmansalmanabdurrahman

ctf-forensics-disk

Analyze disk images and memory dumps with Sleuth Kit, Volatility, and hashcat.

Community
Advanced
dbx0dbx0
7

competition-stego-media

Extract hidden payloads from image, audio, video, and document steganography challenges.

Community
Intermediate