skills.rest
langbyyi
langbyyiCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

ctf-forensics

Analyze disk images, memory dumps, and network captures to recover flags.

96|1|Updated Jun 4, 2026
Search Tags:#ctf#memory dump#steganography#forensics#volatility#pcap#disk analysis
One-click install
npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill ctf-forensics-langbyyi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ctf-forensics
Source: https://github.com/langbyyi/CyberStrikeAI-SRC/tree/main/skills/ctf-forensics
Command: npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill ctf-forensics-langbyyi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill eliminates the guesswork in CTF forensics challenges by providing structured, battle-tested techniques for analyzing disk images, memory dumps, network captures, steganography, and hardware signals. It transforms overwhelming forensic artifacts into actionable steps, helping you recover flags faster.

Core Features & Use Cases

  • Disk and Memory Forensics: Recover deleted files, analyze memory dumps with Volatility, mount VM images, and extract encryption keys from LUKS or TrueCrypt volumes.
  • Network Traffic Analysis: Decrypt TLS sessions, extract credentials from PCAP files, decode covert channels in DNS and ICMP, and reassemble split archives from HTTP transfers.
  • Steganography and Signal Analysis: Detect hidden data in images, audio, video, PDFs, and terminal art; decode VGA/HDMI signals, side-channel power traces, and keyboard acoustic recordings.

Quick Start

Use the ctf-forensics skill to analyze the provided forensic artifact and recover the hidden flag.

Frequently Asked Questions about ctf-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze a memory dump to recover a flag in a CTF competition?▼

To analyze a memory dump, this Skill applies structured Volatility workflows to extract processes, credentials, and encryption keys, transforming raw artifacts into actionable steps for flag recovery.

What is the best way to extract hidden data from steganography files?▼

Extracting hidden steganography data requires structured decoding workflows applied to images, audio, video, and PDFs, detecting concealed information to successfully recover the hidden flag.

How do I decode covert channels and extract credentials from PCAP files?▼

Decoding covert channels in PCAP files involves analyzing network captures to extract credentials from DNS and ICMP traffic, decrypt TLS sessions, and reassemble split archives from HTTP transfers.

Can I recover deleted files and extract encryption keys from disk images?▼

Yes, you can recover deleted files and extract encryption keys from disk images and VM images by applying deterministic forensic analysis pipelines to unlock LUKS or TrueCrypt volumes.

Do I need Python 3 and Volatility installed to use these forensic workflows?▼

Yes, executing these deterministic forensic analysis pipelines requires Python 3, Volatility, Wireshark, and standard forensic tooling, along with filesystem access to process disk images and memory dumps.

Can this Skill decode hardware signals like VGA and side-channel power traces?▼

Yes, this Skill provides structured extraction workflows to decode hardware signals, including VGA and HDMI signals, side-channel power traces, and keyboard acoustic recordings for flag recovery.

Related Skills

Explore More Data & Analytics Skills→
bdsqqqbdsqqq
59

tmux

Manage background processes in tmux windows with commands.

Community
Intermediate
trungdo9trungdo9
3

cti-expert

Automate cyber threat intelligence investigations using OSINT and forensic analysis.

Community
Advanced
kiwamizamuraikiwamizamurai
7

networking

Analyze PCAP captures for data exfiltration and protocol misuse.

Community
Intermediate
Oruga420Oruga420

st3gg

Encode, decode, and analyze hidden data in images via CLI.

Community
Advanced