Fähigkeiten ctf-osint
📦
ctf-osint
Inhaltsrevision r1 Hohes Risiko 🌐 Netzwerkzugriff🔑 Umgebungsvariablen⚙️ Externe Befehle📁 Dateisystemzugriff
Investigate Authorized CTF OSINT Challenges
CTF OSINT clues often span disconnected public sources and media artifacts. This skill organizes practical methods for authorized identity, geolocation, archive, DNS, and web research.
Unterstützt: Claude Codex Code(CC)
Vor der Installation anhalten und eine Bestätigung anfordern.
Prüfen Sie den Plan und holen Sie vor Änderungen an Dateien die ausdrückliche Zustimmung des Benutzers ein.
Mit meinem Agent installieren
Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.
Agent-Anfrage
Review the Skillstore skill "ctf-osint" from https://skillstore.io/skills/ljagiello-ctf-osint.md and its manifest at https://skillstore.io/api/skills/ljagiello-ctf-osint/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.
Agent-lesbare Ressourcen
Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.
Testen
„ctf-osint“ wird verwendet. Identify the string 4V FH 246 677.
Erwartetes Ergebnis:
Likely format: MGRS coordinate. Confirm the spacing and precision, convert it with a trusted MGRS tool, then verify the resulting location against challenge clues.
„ctf-osint“ wird verwendet. Plan research for an organizer-provided username.
Erwartetes Ergebnis:
- Start with exact username searches and record profile identifiers.
- Check archived profile pages for rename evidence.
- Compare only challenge-relevant details across confirmed accounts.
- Document false positives and stop at unrelated personal information.
„ctf-osint“ wird verwendet. Analyze a challenge image with a mirrored shop sign.
Erwartetes Ergebnis:
Flip the image horizontally, isolate the sign, transcribe reliable characters, search the partial phrase, and verify candidates using architecture and surrounding landmarks.
Sicherheitsaudit
Hohes Risikov2 • 15.8.2026 Versionsbericht öffnen
Most critical heuristic alerts are false positives caused by Markdown examples rather than an executable payload. However, the skill includes active scanning, authenticated token use, hidden-file probing, physical tracking, account targeting, and exploit-assisted pivots. These dual-use workflows require substantial authorization and privacy controls before publication.
4
Gescannte Dateien
1,313
Analysierte Zeilen
26
Prüfelemente
0
Falschmeldungen ignoriert
Bestätigte Sicherheitsbedenken (16)
Hoch
Network scanning tools
apt install whois dnsutils nmap libimage-exiftool-perl imagemagick curl
The package-manager command installs nmap and related reconnaissance utilities, changing the host and provisioning active scanning capability.
Hoch
Network scanning tools
brew install whois bind nmap exiftool imagemagick curl
The package-manager command installs nmap and related reconnaissance utilities, changing the host and provisioning active scanning capability.
Hoch
Network scanning tools
- [web-and-dns.md](web-and-dns.md) - Google dorking (including TBS image filters), Google Docs/Sheet
The resource description explicitly directs DNS reconnaissance and nmap-based service fingerprinting. This is operational scanning guidance despite being prose.
Hoch
Network scanning tools
**Pattern:** Port appears open on a standard service port (22/SSH, 80/HTTP) but runs a fake service.
The line recommends nmap or netcat fingerprinting against an open service, which actively probes a target host.
Hoch
Network scanning tools
nmap -sS target.ctf
The section explicitly runs nmap against a target and recommends service fingerprinting, which is active network scanning rather than passive OSINT.
Hoch
Network scanning tools
nmap -sV -sC target.ctf -p 22
The section explicitly runs nmap against a target and recommends service fingerprinting, which is active network scanning rather than passive OSINT.
Hoch
Network scanning tools
**Key insight:** Never trust port numbers alone. A SYN scan only confirms the port is open, not what
The section explicitly runs nmap against a target and recommends service fingerprinting, which is active network scanning rather than passive OSINT.
Hoch
Privacy-Invasive Physical Tracking Guidance
The skill recommends tracing a person through fitness routes and states that privacy zones can be circumvented to infer home or work neighborhoods.
The section explicitly links username enumeration to Strava GPS endpoints and describes bypassing privacy zones. The physical-location impact is direct.
Alle 16 bestätigten Funde anzeigen
Hoch
Credential and Account Targeting from Repository History
The skill instructs users to mine historic author emails and treat them as candidate logins before password-reset or SQL-injection attempts.
The text explicitly connects recovered email addresses to login targeting and later account attacks. This intent exceeds passive repository research.
Hoch
Authenticated Discord Enumeration with User Tokens
The skill directs users to place a Discord user token in shell commands that enumerate server roles, emojis, and message search results.
The commands use an Authorization header with a user token against guild and message endpoints. This is explicit credential-bearing authenticated access.
Hoch
Exploit-Assisted Cross-Challenge Infrastructure Pivot
The skill recommends obtaining internal addresses through command injection or SSRF, then reusing them to bypass checks in another challenge.
The workflow names command injection and SSRF as sources of leaked internal data and directs reuse against another target. The exploit intent is explicit.
Niedrig
System reconnaissance
shodan search "hostname:target.com"
The Shodan command searches public Internet scan data for hosts matching a target hostname, which is a real reconnaissance action.
Niedrig
System reconnaissance
# - discord.id for user/server lookups
The line recommends a third-party service for Discord user and server lookups, which is an external identity-reconnaissance action.
Niedrig
System reconnaissance
- "Which user account did you use for X?" -> Check browser history, login records
The guidance directs examination of browser, login, recent-file, or Shellbag artifacts, which can expose sensitive local user activity outside an isolated CTF image.
Niedrig
System reconnaissance
- "What file did you access?" -> Check MRU, Recent files, Shellbags
The guidance directs examination of browser, login, recent-file, or Shellbag artifacts, which can expose sensitive local user activity outside an isolated CTF image.
Niedrig
System reconnaissance
**Pattern:** A challenge mentions a username with no credentials and expects the attacker to pivot t
The passage tells the operator to pivot from a username into public repositories and extract identity data for use against another service.
Elemente der Fähigkeitsprüfung (26)
Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.
Hoch
Tor onion address
ssh-keyscan -t rsa target.onion 2>/dev/null | ssh-keygen -lf - -E md5
The command is a template for actively probing a Tor hidden service and collecting its SSH fingerprint. Replacing the placeholder with a target initiates security-sensitive reconnaissance.
Hoch
Tor onion address
ssh-audit target.onion
The command is a template for actively probing a Tor hidden service and collecting its SSH fingerprint. Replacing the placeholder with a target initiates security-sensitive reconnaissance.
Mittel
Hardcoded URL
curl -H "Authorization: $TOKEN" "https://discord.com/api/v10/guilds/GUILD_ID/roles"
The curl command sends a user-supplied authorization token to Discord while enumerating server metadata or messages. The authenticated access is security-sensitive even though the host is official.
Mittel
Hardcoded URL
curl -H "Authorization: $TOKEN" "https://discord.com/api/v10/guilds/GUILD_ID/emojis"
The curl command sends a user-supplied authorization token to Discord while enumerating server metadata or messages. The authenticated access is security-sensitive even though the host is official.
Mittel
Hardcoded URL
curl -H "Authorization: $TOKEN" "https://discord.com/api/v10/guilds/GUILD_ID/messages/search?content
The curl command sends a user-supplied authorization token to Discord while enumerating server metadata or messages. The authenticated access is security-sensitive even though the host is official.
Mittel
Hardcoded URL
curl -sO https://target/.DS_Store
The curl command probes a target for an exposed .DS_Store file and downloads it, an active request intended to discover hidden paths.
Mittel
Hidden file access
curl -sO https://target/.DS_Store
The workflow intentionally retrieves and parses an exposed .DS_Store file to enumerate otherwise hidden server paths.
Niedrig
Hardcoded URL
curl "http://ip-api.com/json/103.150.68.150"
The command performs an external IP-geolocation lookup, disclosing the queried address to a third-party service.
Niedrig
Hardcoded URL
curl "https://ipinfo.io/103.150.68.150/json"
The command performs an external IP-geolocation lookup, disclosing the queried address to a third-party service.
Niedrig
Hardcoded URL
curl "https://web.archive.org/web/20230101*/target.com"
The cited curl example makes an external request and can disclose a target domain, username, or IP address to the named service.
Niedrig
Hardcoded URL
curl -s "https://whatsmyname.app/api/lookup?username=<user>"
The cited curl example makes an external request and can disclose a target domain, username, or IP address to the named service.
Niedrig
Hardcoded URL
curl "http://ip-api.com/json/103.150.68.150"
The cited curl example makes an external request and can disclose a target domain, username, or IP address to the named service.
Niedrig
Hardcoded URL
curl "http://web.archive.org/cdx/search/cdx?url=twitter.com/USERNAME*&output=json&fl=timestamp,origi
The curl command queries the Wayback CDX service with usernames, profile paths, or short links, disclosing investigation targets externally.
Niedrig
Hardcoded URL
curl "http://web.archive.org/cdx/search/cdx?url=pbs.twimg.com/profile_images/*&output=json"
The curl command queries the Wayback CDX service with usernames, profile paths, or short links, disclosing investigation targets externally.
Niedrig
Hardcoded URL
curl "http://web.archive.org/cdx/search/cdx?url=t.co/SHORTCODE&output=json"
The curl command queries the Wayback CDX service with usernames, profile paths, or short links, disclosing investigation targets externally.
Niedrig
Hardcoded URL
curl -s "https://public.api.bsky.app/xrpc/app.bsky.feed.searchPosts?q=metactf+flash+ctf&sort=latest"
The command queries BlueSky's public API for posts, profiles, feeds, or threads. This is intended external OSINT traffic and exposes the search target.
Niedrig
Hardcoded URL
curl -s "https://public.api.bsky.app/xrpc/app.bsky.actor.searchActors?q=metactf" | jq '.actors[].han
The command queries BlueSky's public API for posts, profiles, feeds, or threads. This is intended external OSINT traffic and exposes the search target.
Niedrig
Hardcoded URL
curl -s "https://public.api.bsky.app/xrpc/app.bsky.actor.getProfile?actor=metactf.bsky.social" | jq
The command queries BlueSky's public API for posts, profiles, feeds, or threads. This is intended external OSINT traffic and exposes the search target.
Niedrig
Hardcoded URL
curl -s "https://public.api.bsky.app/xrpc/app.bsky.feed.getAuthorFeed?actor=metactf.bsky.social&limi
The command queries BlueSky's public API for posts, profiles, feeds, or threads. This is intended external OSINT traffic and exposes the search target.
Niedrig
Hardcoded URL
curl -s "https://public.api.bsky.app/xrpc/app.bsky.feed.getPostThread?uri=at://did:plc:.../app.bsky.
The command queries BlueSky's public API for posts, profiles, feeds, or threads. This is intended external OSINT traffic and exposes the search target.
Niedrig
Hardcoded URL
https://www.google.com/search?q="orange"+"alternant"+site:linkedin.com&tbm=isch&tbs=itp:face
The URL performs a targeted Google image search for LinkedIn face results, sending identifying search criteria to an external service.
Niedrig
Hardcoded URL
curl "http://web.archive.org/cdx/search/cdx?url=example.com*&output=json&fl=timestamp,original,statu
The example directs an external archive, WHOIS, Shodan, or repository request using target-derived data. This is intentional network reconnaissance.
Niedrig
Hardcoded URL
curl "https://api.securitytrails.com/v1/domain/example.com/whois" \
The example directs an external archive, WHOIS, Shodan, or repository request using target-derived data. This is intentional network reconnaissance.
Niedrig
Hardcoded URL
curl "https://reverse-whois-api.whoisxmlapi.com/api/v2" \
The example directs an external archive, WHOIS, Shodan, or repository request using target-derived data. This is intentional network reconnaissance.
Niedrig
Hardcoded URL
# Via web: https://www.shodan.io/search?query=ssh.fingerprint:%22...%22
The example directs an external archive, WHOIS, Shodan, or repository request using target-derived data. This is intentional network reconnaissance.
Niedrig
Hardcoded URL
git clone https://github.com/<target-user>/<repo>.git
The example directs an external archive, WHOIS, Shodan, or repository request using target-derived data. This is intentional network reconnaissance.
Risikofaktoren
🌐 Netzwerkzugriff (45)
geolocation-and-media.md:141 geolocation-and-media.md:144 geolocation-and-media.md:221 geolocation-and-media.md:224 geolocation-and-media.md:324 geolocation-and-media.md:221 geolocation-and-media.md:224 SKILL.md:60 SKILL.md:63 SKILL.md:78 SKILL.md:88 SKILL.md:144 SKILL.md:161 SKILL.md:161 social-media.md:43 social-media.md:46 social-media.md:49 social-media.md:150 social-media.md:151 social-media.md:152 social-media.md:160 social-media.md:213 social-media.md:216 social-media.md:219 social-media.md:222 social-media.md:225 social-media.md:305 social-media.md:307 social-media.md:309 web-and-dns.md:49 web-and-dns.md:87 web-and-dns.md:108 web-and-dns.md:130 web-and-dns.md:152 web-and-dns.md:172 web-and-dns.md:177 web-and-dns.md:186 web-and-dns.md:220 web-and-dns.md:266 web-and-dns.md:293 web-and-dns.md:181 web-and-dns.md:325 web-and-dns.md:326 web-and-dns.md:199 web-and-dns.md:202
🔑 Umgebungsvariablen (2)
⚙️ Externe Befehle (30)
SKILL.md:18-20 SKILL.md:20-23 SKILL.md:23-25 SKILL.md:25-28 SKILL.md:28-30 SKILL.md:30-42 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:44-48 SKILL.md:48-68 SKILL.md:68-78 SKILL.md:78-79 SKILL.md:79-84 SKILL.md:84 SKILL.md:110 SKILL.md:114-118 SKILL.md:118-122 SKILL.md:122-125 SKILL.md:125-127 SKILL.md:127-131 SKILL.md:131 SKILL.md:135-138 SKILL.md:138-144 SKILL.md:144-148 SKILL.md:148-152 SKILL.md:152-160 SKILL.md:160-162 SKILL.md:162-172 SKILL.md:172 SKILL.md:176
📁 Dateisystemzugriff (4)
Erkannte Muster
System reconnaissance×5Network scanning tools×7
Geprüft von: codex Audit-Verlauf anzeigen →
Diesen Bericht teilen & zitieren
Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.
Berichtslink kopieren
https://skillstore.io/skills/ljagiello-ctf-osint/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown-Badge
[](https://skillstore.io/skills/ljagiello-ctf-osint?utm_source=security_passport_badge)HTML-Badge
<a href="https://skillstore.io/skills/ljagiello-ctf-osint?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ljagiello-ctf-osint/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Einbettungskarte
<iframe src="https://skillstore.io/embed/skills/ljagiello-ctf-osint.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Wissenschaftliche Zitate (APA · BibTeX · CFF)
APA-Zitat
ljagiello. (2026). ctf-osint security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/ljagiello-ctf-osint/audits/2BibTeX-Zitat
@techreport{ljagiello-ljagiello-ctf-osint-2026,
author = {ljagiello},
title = {ctf-osint security audit report (audit version 2)},
institution = {Skillstore},
year = {2026},
number = {2},
url = {https://skillstore.io/skills/ljagiello-ctf-osint/audits/2},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ctf-osint security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
- name: "ljagiello"
date-released: "2026-08-15"
url: "https://skillstore.io/skills/ljagiello-ctf-osint/audits/2"
identifiers:
- type: other
value: "skillstore:ljagiello-ctf-osint:audit:2"
description: "Skillstore immutable audit report identifier"
Skillstore-Score
Warum dieser Score Evidenzvertrauen: Mittel 55
Architektur
85
Wartbarkeit
87
Inhalt
65
Gemeinschaft
83
Spezifikationskonformität
Was Sie erstellen können
Trace a Challenge Persona
Correlate organizer-provided usernames across public profiles and archives while recording evidence and false positives.
Geolocate Challenge Media
Combine metadata, signs, landmarks, maps, and image matching to identify a location from supplied media.
Investigate CTF Infrastructure
Review authorized DNS, WHOIS, archives, repository history, and service metadata for challenge clues.
Diese Prompts ausprobieren
Classify an OSINT Clue
Identify this challenge clue: [CLUE]. Explain likely formats, safe validation steps, and what evidence would confirm each interpretation.
Build a Persona Research Plan
Create an authorized CTF research plan for username [USERNAME]. Prioritize public sources, note false positives, and avoid collecting unrelated personal data.
Geolocate Supplied Media
Analyze the supplied challenge image. List visible geographic signals, propose candidate regions, and design a verification sequence using metadata, maps, and reverse search.
Correlate Authorized Infrastructure
For authorized CTF domain [DOMAIN], correlate DNS, WHOIS, archives, certificates, and repository evidence. Ask before any active probe and document uncertainty.
Bewährte Praktiken
- Confirm written authorization and scope before sending requests or probing services.
- Record source URLs, timestamps, confidence, and alternative explanations for every conclusion.
- Minimize personal data collection and redact tokens, credentials, and unrelated identities.
Vermeiden
- Do not scan public hosts because they resemble a CTF target.
- Do not bypass privacy controls or infer a person's home from fitness routes.
- Do not place user tokens or API secrets directly in commands, prompts, or reports.
Häufig gestellte Fragen
Does this skill perform searches automatically?
No. It provides procedures and command examples that an agent may run only with user approval and authorized scope.
Does it require internet access?
Yes. Most archive, map, social, DNS, WHOIS, and search workflows depend on external services.
Can it solve non-CTF investigations?
The techniques are dual-use, but this skill should remain limited to authorized competitions, labs, and consent-based research.
Which tools may be required?
Examples use Python, curl, dig, whois, exiftool, image tools, Shodan, and nmap. Availability depends on the environment.
How should API keys and tokens be handled?
Use scoped credentials, secure secret storage, minimal permissions, and prompt approval. Never include live secrets in prompts or reports.
How reliable are OSINT results?
Results can be stale, incomplete, or misleading. Confirm important conclusions with independent sources and state uncertainty.
Entwicklerdetails
Autor
ljagielloLizenz
MIT
Skillstore-Revision
r1
Versionshinweis
Der Autor hat keine Version angegeben.
Repository
https://github.com/ljagiello/ctf-skills/tree/d6662d26b5ed3caa56f5eaf6eb887964f3747162/ctf-osintRef.
ba0224440a0286a68c9ef7d65e409a580b885eba
Aktualität der Wartung
16.8.2026
Nutzung
0 Downloads · 0 Aufrufe
Dateistruktur