ctf-web

Start by observing the application through normal browser flow and low-cost HTTP requests, then map observed signals to one or two attack routes. Validate each hypothesis with minimal true/false comparison probes before escalating, and record evidence at every step until the flag is captured and verified.

First confirm the mode, target URL, flag format, scope, and allowed resources before sending any request. Then load the attack-network knowledge base, fingerprint the application, and identify the lowest-cost candidate locations where the flag might reside.

CTF solving optimizes for the shortest verified path to a flag inside an authorized, scoped environment, while bug bounty work requires impact assessment and reporting standards for real targets. This Skill explicitly routes CTF tasks away from bug bounty methodology and never treats real targets as practice ranges.

Active requests are only sent in EXECUTE mode after the scope is bound, the target is confirmed reachable, and authorization is explicit. In the default PLAN_ONLY mode, the Skill only reads challenge materials and marks planned actions as PENDING without contacting the target.

A flag is confirmed only when it comes from the authorized target environment, the full request or command path to obtain it is documented, and at least one repeatable verification or raw response evidence exists. A confirmed vulnerability without the flag keeps the status at CONTINUE, not DONE.

Return to normal requests to verify methods, cookies, CSRF tokens, and real parameter names, then compare client-side display against server responses. Limit each hypothesis to two meaningful variants, record failures as dead ends, and switch to the lowest-cost adjacent node in the attack network.