pentest-ctf-forensics

Identify and extract artifacts from memory dumps, PCAPs, and disk images.

299|56|Updated Jan 13, 2026

Search Tags:#ctf #steganography #forensics #pcap #memory-dump #artifact-extraction

Ready to run

npx skills add https://github.com/jd-opensource/JoySafeter --skill pentest-ctf-forensics

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: pentest-ctf-forensics
Source: https://github.com/jd-opensource/JoySafeter/tree/main/skills/pentest-ctf-forensics
Command: npx skills add https://github.com/jd-opensource/JoySafeter --skill pentest-ctf-forensics

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Digital forensics and CTF investigations require rapid identification and extraction of artifacts from heterogeneous data sources such as memory dumps, PCAPs, disk images, and images. This skill provides a structured workflow to identify, correlate, and organize evidence for efficient analysis.

Core Features & Use Cases

Artifact discovery & metadata extraction: Detect file types, metadata, embedded strings, and artifacts across memory, network, and disk images.
Steganography & data recovery: Locate hidden data within images, audio, and other containers and recover it for analysis.
Network & memory forensics: Analyze PCAPs and memory dumps to reveal processes, connections, and suspicious activity.
Use Case: Incident response and threat-hunting in CTF environments or real investigations requiring fast triage.

Quick Start

Analyze a provided PCAP, memory dump, or disk image to begin artifact extraction and analysis.

Frequently Asked Questions about pentest-ctf-forensics

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I extract artifacts from a memory dump during incident response?▼

To extract artifacts from a memory dump, you need to analyze processes, connections, and suspicious activity. This skill provides structured workflows for memory forensics to identify and organize embedded strings and metadata for efficient triage.

What is the best way to analyze PCAP files for CTF forensics challenges?▼

The best way to analyze PCAP files is by applying network forensics workflows to reveal connections and suspicious activity. This approach identifies and correlates network artifacts to gather evidence efficiently during CTF investigations.

How do I find hidden data using steganography in image files?▼

To find hidden data using steganography, you must locate concealed information within images and other containers. This skill provides steganography workflows to recover embedded data for analysis during digital investigations.

Can I extract metadata and embedded strings from disk images?▼

Yes, you can extract metadata and embedded strings from disk images. The artifact discovery process detects file types, metadata, and embedded strings across memory, network, and disk images for thorough evidence gathering.

Does this approach work for both CTF environments and real threat hunting?▼

Yes, this artifact extraction approach works for both CTF environments and real threat hunting. It applies structured workflows to rapidly identify, correlate, and organize evidence from heterogeneous data sources for fast triage.