ctf-web

Guide web exploitation techniques for HTTP applications and CTF challenges.

1|Updated Feb 1, 2026

Search Tags:#XSS #SQL injection #CTF #SSRF #web exploitation

Ready to run

npx skills add https://github.com/safzanpirani/pi-config --skill ctf-web-safzanpirani

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: ctf-web
Source: https://github.com/safzanpirani/pi-config/tree/main/skills/ctf-web
Command: npx skills add https://github.com/safzanpirani/pi-config --skill ctf-web-safzanpirani

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires sqlmap, ffuf, requests, flask-unsign, hashcat, jq, curl, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill provides a comprehensive guide to web exploitation techniques, enabling users to solve CTF challenges more effectively by targeting HTTP applications, APIs, and web interfaces.

Core Features & Use Cases

Web Exploitation Guide: Offers detailed techniques for XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, and other web vulnerabilities.
Reconnaissance Tools: Integrates with tools like curl, ffuf, and sqlmap for quick reconnaissance and testing.
Use Case: When participating in a CTF that involves a web application, use this Skill to identify vulnerabilities and plan an exploitation strategy.

Quick Start

Use the ctf-web skill to identify SQL injection vulnerabilities in a target application.

Frequently Asked Questions about ctf-web

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I identify SQL injection vulnerabilities in a web application during a CTF?▼

The skill integrates sqlmap and curl to probe HTTP applications and analyze database responses for injection points, providing structured techniques for exploiting these flaws during CTF challenges.

What web exploitation techniques are needed to bypass authentication in CTF challenges?▼

Auth bypass in CTF challenges often involves exploiting SQLi, SSTI, XSS, or JWT token manipulation. This skill provides structured guides on these techniques to help identify and bypass authentication mechanisms in web interfaces.

Can I use ffuf and sqlmap together for web reconnaissance and exploitation?▼

Yes, ffuf and sqlmap are integrated together for web exploitation. This skill uses ffuf for quick reconnaissance and directory enumeration, and sqlmap for targeted SQL injection testing against discovered HTTP interfaces and APIs.

How do I decode and analyze JWT tokens for web exploitation?▼

The skill provides dedicated techniques for JSON Web Token manipulation and decoding, leveraging tools like flask-unsign and jq to inspect and forge tokens for auth bypass scenarios.

Do I need bash and Python 3 to run web exploitation tools for CTFs?▼

Yes, bash and Python 3 are required. This skill needs a filesystem-based agent environment with internet access to install dependencies like sqlmap, ffuf, hashcat, and requests for executing exploitation scripts.