skills.rest
salmanabdurrahman
salmanabdurrahmanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

ctf-forensics-network

Analyze PCAP files for TLS decryption, USB HID reconstruction, and covert channels.

Updated Jul 30, 2026
Search Tags:#network#ctf#forensics#pcap#tshark#decryption
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill ctf-forensics-network
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ctf-forensics-network
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/ctf-forensics-network
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill ctf-forensics-network

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill streamlines the complex, multi-step process of analyzing network packet captures during CTF competitions, ensuring that forensic workflows are performed safely and systematically.

Core Features & Use Cases

  • Protocol Dissection: Automates the analysis of PCAP/PCAPNG files, including TCP stream reconstruction, TLS decryption, and DNS covert channel detection.
  • Evidence Collection: Provides a structured framework for extracting credentials, files, and hidden data from network traffic while maintaining strict evidence discipline.
  • Use Case: When faced with a network-based CTF challenge, use this skill to triage traffic, identify exfiltration patterns, and recover flags from encrypted or obfuscated streams.

Quick Start

Use the ctf-forensics-network skill to analyze the provided capture file challenge-traffic.pcap and extract all HTTP objects.

Frequently Asked Questions about ctf-forensics-network

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I decrypt TLS traffic in a pcap file for a CTF challenge?▼

Decrypt TLS traffic in a pcap file by applying the provided session keys to reconstruct encrypted streams. This skill automates protocol dissection and TLS decryption to extract hidden data and security artifacts.

How do I extract hidden files and credentials from a pcap network capture?▼

Extract files and credentials from a pcap network capture by reconstructing TCP streams and isolating protocol artifacts. This skill automates evidence collection to systematically recover hidden data.

What is the best way to detect DNS covert channels in network traffic?▼

Detect DNS covert channels in network traffic by analyzing query patterns and payload anomalies within the pcap file. This skill automates protocol dissection to identify exfiltration patterns.

Can I reconstruct USB HID inputs from network traffic?▼

Reconstruct USB HID inputs from network traffic by analyzing packet captures to map raw data to keyboard or mouse events. This skill automates specialized forensic workflows to recover hidden data.

How do I triage a network-based CTF challenge with packet captures?▼

Triage a network-based CTF challenge by systematically analyzing packet captures to identify exfiltration patterns and recover flags. This skill provides a structured forensic framework for traffic analysis.

Do I need to validate scope before analyzing packet captures?▼

This skill requires strict adherence to authorized scope and policy validation gates before performing any tool invocations or data extraction tasks on network traffic.

Related Skills

Explore More Education & Research Skills→
YukiIto1999YukiIto1999

performing-network-forensics-with-wireshark

Analyzes PCAP captures to identify network indicators of compromise and extract artifacts using pyshark and Wireshark/tshark workflows.

Community
Advanced
xjtu-wangxjtu-wang
4

competition-pcap-protocol

Reconstruct TCP/UDP sessions from PCAP captures and decode HTTP, WebSocket, and DNS protocols.

Community
Advanced
sayseven7sayseven7
11

traffic-analysis-pcap

Analyze PCAP files to reconstruct network activity and extract evidence.

Community
Advanced
258369123258369123
2

CTF Misc Solver

Analyze CTF Misc files and network traffic to extract hidden flags.

Community
Advanced