Sato Hub
← Skills

ctf-forensicsskills.sh · ljagiello

8,788 installs

Provides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions, steganography, PDF analysis, Windows registry, Volatility, PCAP, Docker images, coredumps, side-channel power traces, DTMF audio spectrograms, packet timing analysis, CD audio disc images, or recovering deleted files

Generates or handles private keysReads secret paths (~/.ssh, .env …)
Hosts contacted: mempool.spaceapi.etherscan.iomacvendors.comwww.columbia.eduwww.spammimic.comjpinsoft.netschemas.microsoft.com
Credentials it expects: SESSION_KEY
Evidence lines
  • generates_or_handles_keys — SKILL.md: - **TLS keylog decryption:** Import SSLKEYLOGFILE or RSA private key into Wireshark (Edit → Preferences → Protocols → TLS)
  • generates_or_handles_keys — SKILL.md: - **TLS weak RSA:** Extract cert, factor modulus, generate private key with `rsatool`, add to Wireshark
  • generates_or_handles_keys — linux-forensics.md: 4. Generate private key: `rsatool -p P -q Q -o private.pem`
  • generates_or_handles_keys — network-advanced.md: PCAP contains a PKCS12 (.p12/.pfx) file transmitted over UDP. Extract the private key from the PKCS12 container, then load it into Wireshark to decrypt the RDP
  • generates_or_handles_keys — network-advanced.md: # Extract private key from PKCS12 (no cert, no passphrase protection)
  • reads_secret_paths — disk-and-memory.md: # /app/.env, /app/config/* — application secrets

Our disclosure is a static description of what the skill declares and does; it is not a safety verdict. Source record: www.skills.sh/ljagiello/ctf-skills/ctf-forensics.

Install

npx skills add ljagiello/ctf-skills@ctf-forensics

Copied from the registry's documented install form. Read the disclosure above first; it is the whole point of this page.

Observed record

First seen 2026-10-19. The weekly re-scan will record install growth and any change to the skill's content hash; one observation so far.

Cite this page

Sato Hub. "ctf-forensics — skill disclosure on Sato Hub." Sato Hub, updated 2026-10-23, accessed 2026-10-23. https://satohub.ai/skills/skillssh%3Aljagiello%2Fctf-skills%2Fctf-forensics

Data last refreshed 2026-10-23; this page is rebuilt daily. Citations carry the date so a reader can tell which snapshot a claim came from. Catalog data is licensed CC-BY-4.0.