skills.rest
yhy0
yhy0COMMUNITY
Explore all skills by this author →
Website𝕏@yhy_00GitHub

forensics-misc

Analyze disk images, memory dumps, network captures, and steganography files to solve CTF forensics challenges.

545|48|Updated Nov 10, 2025
Search Tags:#memory analysis#steganography#forensics#pcap#CTF#sandbox escape#Volatility
One-click install
npx skills add https://github.com/yhy0/CHYing-agent --skill forensics-misc
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: forensics-misc
Source: https://github.com/yhy0/CHYing-agent/tree/main/agent-work/.claude/skills/forensics-misc
Command: npx skills add https://github.com/yhy0/CHYing-agent --skill forensics-misc

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pillow, pycryptodome, scapy, volatility3, numpy, scipy, pyzbar, and includes references (resource) components.

What problem does it solve?

CTF forensics and misc challenges require knowing dozens of niche tools and file-format tricks across disk images, memory dumps, PCAPs, steganography, archives, and sandbox escapes. This Skill provides a systematic workflow that identifies the file type, runs immediate reconnaissance commands, and dispatches to deep-dive modules so you can peel back hidden layers and recover the flag without guessing.

Core Features & Use Cases

  • Type-Based Dispatch: Recognizes images, audio, PCAPs, memory dumps, disk images, Windows registry hives, archives, encoding puzzles, pyjails, bashjails, hardware signals, and 3D-printing files, then runs the right commands immediately.
  • Deep Reference Modules: Covers Volatility 3 memory forensics, ZFS/APFS/BTRFS recovery, ZIP fake-encryption and CRC32 attacks, LSB/DCT steganography, DNS covert channels, and sandbox escape payloads.
  • Use Case: Given a suspicious PNG in a CTF, run zsteg, pngcheck, and channel separation instantly, then follow the stego-image module to extract an LSB-hidden flag.

Quick Start

Analyze this challenge file and find the hidden flag using the forensics-misc workflow.

Frequently Asked Questions about forensics-misc

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze a memory dump in a CTF challenge?▼

Use Volatility 3 to identify the OS with windows.info or linux banners, then list processes with pslist or pstree, check command history with cmdline, and search filescan output for flag-related filenames. The skill provides the exact plugin sequence for fast triage.

How do I detect fake encryption in a ZIP file?▼

Check the general purpose bit flag in the ZIP local and central directory headers; if bit 0 is set but no real encryption exists, clear the flag byte to fix it. The skill includes Python snippets that detect and repair fake-encrypted ZIPs automatically.

What tools extract hidden data from PNG images?▼

zsteg scans PNG and BMP files for LSB-encoded data across channels and bit orders, while pngcheck validates chunk structure and CRCs. Channel separation with ImageMagick and steghide for JPEG cover the other common image steganography cases.

How do I escape a restricted Bash shell in a CTF?▼

Probe which characters pass the filter, then use expansions like $0, ${IFS}, glob patterns such as /???/??t, or printf-based command construction to bypass restrictions. The bashjails module documents character-set tricks including the \$$# payload for hash-dollar-backslash filters.

Can this skill analyze network capture files?▼

Yes, it covers PCAP and PCAPNG analysis with tshark, including TCP conversation summaries, HTTP object export, DNS covert channel detection, and direct flag string searches. Advanced modules cover USB HID steganography, NTLMv2 cracking, and multi-layer XOR-obfuscated captures.

What are the limitations of this forensics workflow?▼

The skill assumes a Linux environment with tools like binwalk, volatility3, and tshark installed, and it targets CTF-style artifacts rather than production incident response. Exotic formats may still require manual reverse engineering beyond the provided modules.

Related Skills

Explore More Software Engineering Skills→
wgpsecwgpsec
1.6k

ctf-forensics

Triage and analyze disk images, memory dumps, PCAP captures, and stego media.

Official
Advanced
ljagielloljagiello
3.2k

ctf-writeup

Generates standardized submission-style CTF writeups documenting solution steps, tools, and flags.

Community
Basic
jd-opensourcejd-opensource
299

pentest-ctf-forensics

Identify and extract artifacts from memory dumps, PCAPs, and disk images.

Official
Intermediate
yaklangyaklang
1.6k

classical-cipher-analysis

Break classical ciphers using frequency analysis and Kasiski examination.

Official
Advanced