Habilidades ctf-osint
📦
ctf-osint
Revisión del contenido r1 Riesgo alto 🌐 Acceso a red🔑 Variables de entorno⚙️ Comandos externos📁 Acceso al sistema de archivos
Investigate Authorized CTF OSINT Challenges
CTF OSINT clues often span disconnected public sources and media artifacts. This skill organizes practical methods for authorized identity, geolocation, archive, DNS, and web research.
Compatible con: Claude Codex Code(CC)
Detente y solicita confirmación antes de instalar.
Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.
Instalar con mi Agente
Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.
Solicitud de agente
Review the Skillstore skill "ctf-osint" from https://skillstore.io/skills/ljagiello-ctf-osint.md and its manifest at https://skillstore.io/api/skills/ljagiello-ctf-osint/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.
Recursos legibles por agentes
Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.
Pruébalo
Usando "ctf-osint". Identify the string 4V FH 246 677.
Resultado esperado:
Likely format: MGRS coordinate. Confirm the spacing and precision, convert it with a trusted MGRS tool, then verify the resulting location against challenge clues.
Usando "ctf-osint". Plan research for an organizer-provided username.
Resultado esperado:
- Start with exact username searches and record profile identifiers.
- Check archived profile pages for rename evidence.
- Compare only challenge-relevant details across confirmed accounts.
- Document false positives and stop at unrelated personal information.
Usando "ctf-osint". Analyze a challenge image with a mirrored shop sign.
Resultado esperado:
Flip the image horizontally, isolate the sign, transcribe reliable characters, search the partial phrase, and verify candidates using architecture and surrounding landmarks.
Auditoría de seguridad
Riesgo altov2 • 15/8/2026 Abrir el informe versionado
Most critical heuristic alerts are false positives caused by Markdown examples rather than an executable payload. However, the skill includes active scanning, authenticated token use, hidden-file probing, physical tracking, account targeting, and exploit-assisted pivots. These dual-use workflows require substantial authorization and privacy controls before publication.
4
Archivos escaneados
1,313
Líneas analizadas
26
Elementos de revisión
0
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (16)
Alto
Network scanning tools
apt install whois dnsutils nmap libimage-exiftool-perl imagemagick curl
The package-manager command installs nmap and related reconnaissance utilities, changing the host and provisioning active scanning capability.
Alto
Network scanning tools
brew install whois bind nmap exiftool imagemagick curl
The package-manager command installs nmap and related reconnaissance utilities, changing the host and provisioning active scanning capability.
Alto
Network scanning tools
- [web-and-dns.md](web-and-dns.md) - Google dorking (including TBS image filters), Google Docs/Sheet
The resource description explicitly directs DNS reconnaissance and nmap-based service fingerprinting. This is operational scanning guidance despite being prose.
Alto
Network scanning tools
**Pattern:** Port appears open on a standard service port (22/SSH, 80/HTTP) but runs a fake service.
The line recommends nmap or netcat fingerprinting against an open service, which actively probes a target host.
Alto
Network scanning tools
nmap -sS target.ctf
The section explicitly runs nmap against a target and recommends service fingerprinting, which is active network scanning rather than passive OSINT.
Alto
Network scanning tools
nmap -sV -sC target.ctf -p 22
The section explicitly runs nmap against a target and recommends service fingerprinting, which is active network scanning rather than passive OSINT.
Alto
Network scanning tools
**Key insight:** Never trust port numbers alone. A SYN scan only confirms the port is open, not what
The section explicitly runs nmap against a target and recommends service fingerprinting, which is active network scanning rather than passive OSINT.
Alto
Privacy-Invasive Physical Tracking Guidance
The skill recommends tracing a person through fitness routes and states that privacy zones can be circumvented to infer home or work neighborhoods.
The section explicitly links username enumeration to Strava GPS endpoints and describes bypassing privacy zones. The physical-location impact is direct.
Mostrar los 16 problemas confirmados
Alto
Credential and Account Targeting from Repository History
The skill instructs users to mine historic author emails and treat them as candidate logins before password-reset or SQL-injection attempts.
The text explicitly connects recovered email addresses to login targeting and later account attacks. This intent exceeds passive repository research.
Alto
Authenticated Discord Enumeration with User Tokens
The skill directs users to place a Discord user token in shell commands that enumerate server roles, emojis, and message search results.
The commands use an Authorization header with a user token against guild and message endpoints. This is explicit credential-bearing authenticated access.
Alto
Exploit-Assisted Cross-Challenge Infrastructure Pivot
The skill recommends obtaining internal addresses through command injection or SSRF, then reusing them to bypass checks in another challenge.
The workflow names command injection and SSRF as sources of leaked internal data and directs reuse against another target. The exploit intent is explicit.
Bajo
System reconnaissance
shodan search "hostname:target.com"
The Shodan command searches public Internet scan data for hosts matching a target hostname, which is a real reconnaissance action.
Bajo
System reconnaissance
# - discord.id for user/server lookups
The line recommends a third-party service for Discord user and server lookups, which is an external identity-reconnaissance action.
Bajo
System reconnaissance
- "Which user account did you use for X?" -> Check browser history, login records
The guidance directs examination of browser, login, recent-file, or Shellbag artifacts, which can expose sensitive local user activity outside an isolated CTF image.
Bajo
System reconnaissance
- "What file did you access?" -> Check MRU, Recent files, Shellbags
The guidance directs examination of browser, login, recent-file, or Shellbag artifacts, which can expose sensitive local user activity outside an isolated CTF image.
Bajo
System reconnaissance
**Pattern:** A challenge mentions a username with no credentials and expects the attacker to pivot t
The passage tells the operator to pivot from a username into public repositories and extract identity data for use against another service.
Elementos de revisión de capacidades (26)
Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.
Alto
Tor onion address
ssh-keyscan -t rsa target.onion 2>/dev/null | ssh-keygen -lf - -E md5
The command is a template for actively probing a Tor hidden service and collecting its SSH fingerprint. Replacing the placeholder with a target initiates security-sensitive reconnaissance.
Alto
Tor onion address
ssh-audit target.onion
The command is a template for actively probing a Tor hidden service and collecting its SSH fingerprint. Replacing the placeholder with a target initiates security-sensitive reconnaissance.
Medio
Hardcoded URL
curl -H "Authorization: $TOKEN" "https://discord.com/api/v10/guilds/GUILD_ID/roles"
The curl command sends a user-supplied authorization token to Discord while enumerating server metadata or messages. The authenticated access is security-sensitive even though the host is official.
Medio
Hardcoded URL
curl -H "Authorization: $TOKEN" "https://discord.com/api/v10/guilds/GUILD_ID/emojis"
The curl command sends a user-supplied authorization token to Discord while enumerating server metadata or messages. The authenticated access is security-sensitive even though the host is official.
Medio
Hardcoded URL
curl -H "Authorization: $TOKEN" "https://discord.com/api/v10/guilds/GUILD_ID/messages/search?content
The curl command sends a user-supplied authorization token to Discord while enumerating server metadata or messages. The authenticated access is security-sensitive even though the host is official.
Medio
Hardcoded URL
curl -sO https://target/.DS_Store
The curl command probes a target for an exposed .DS_Store file and downloads it, an active request intended to discover hidden paths.
Medio
Hidden file access
curl -sO https://target/.DS_Store
The workflow intentionally retrieves and parses an exposed .DS_Store file to enumerate otherwise hidden server paths.
Bajo
Hardcoded URL
curl "http://ip-api.com/json/103.150.68.150"
The command performs an external IP-geolocation lookup, disclosing the queried address to a third-party service.
Bajo
Hardcoded URL
curl "https://ipinfo.io/103.150.68.150/json"
The command performs an external IP-geolocation lookup, disclosing the queried address to a third-party service.
Bajo
Hardcoded URL
curl "https://web.archive.org/web/20230101*/target.com"
The cited curl example makes an external request and can disclose a target domain, username, or IP address to the named service.
Bajo
Hardcoded URL
curl -s "https://whatsmyname.app/api/lookup?username=<user>"
The cited curl example makes an external request and can disclose a target domain, username, or IP address to the named service.
Bajo
Hardcoded URL
curl "http://ip-api.com/json/103.150.68.150"
The cited curl example makes an external request and can disclose a target domain, username, or IP address to the named service.
Bajo
Hardcoded URL
curl "http://web.archive.org/cdx/search/cdx?url=twitter.com/USERNAME*&output=json&fl=timestamp,origi
The curl command queries the Wayback CDX service with usernames, profile paths, or short links, disclosing investigation targets externally.
Bajo
Hardcoded URL
curl "http://web.archive.org/cdx/search/cdx?url=pbs.twimg.com/profile_images/*&output=json"
The curl command queries the Wayback CDX service with usernames, profile paths, or short links, disclosing investigation targets externally.
Bajo
Hardcoded URL
curl "http://web.archive.org/cdx/search/cdx?url=t.co/SHORTCODE&output=json"
The curl command queries the Wayback CDX service with usernames, profile paths, or short links, disclosing investigation targets externally.
Bajo
Hardcoded URL
curl -s "https://public.api.bsky.app/xrpc/app.bsky.feed.searchPosts?q=metactf+flash+ctf&sort=latest"
The command queries BlueSky's public API for posts, profiles, feeds, or threads. This is intended external OSINT traffic and exposes the search target.
Bajo
Hardcoded URL
curl -s "https://public.api.bsky.app/xrpc/app.bsky.actor.searchActors?q=metactf" | jq '.actors[].han
The command queries BlueSky's public API for posts, profiles, feeds, or threads. This is intended external OSINT traffic and exposes the search target.
Bajo
Hardcoded URL
curl -s "https://public.api.bsky.app/xrpc/app.bsky.actor.getProfile?actor=metactf.bsky.social" | jq
The command queries BlueSky's public API for posts, profiles, feeds, or threads. This is intended external OSINT traffic and exposes the search target.
Bajo
Hardcoded URL
curl -s "https://public.api.bsky.app/xrpc/app.bsky.feed.getAuthorFeed?actor=metactf.bsky.social&limi
The command queries BlueSky's public API for posts, profiles, feeds, or threads. This is intended external OSINT traffic and exposes the search target.
Bajo
Hardcoded URL
curl -s "https://public.api.bsky.app/xrpc/app.bsky.feed.getPostThread?uri=at://did:plc:.../app.bsky.
The command queries BlueSky's public API for posts, profiles, feeds, or threads. This is intended external OSINT traffic and exposes the search target.
Bajo
Hardcoded URL
https://www.google.com/search?q="orange"+"alternant"+site:linkedin.com&tbm=isch&tbs=itp:face
The URL performs a targeted Google image search for LinkedIn face results, sending identifying search criteria to an external service.
Bajo
Hardcoded URL
curl "http://web.archive.org/cdx/search/cdx?url=example.com*&output=json&fl=timestamp,original,statu
The example directs an external archive, WHOIS, Shodan, or repository request using target-derived data. This is intentional network reconnaissance.
Bajo
Hardcoded URL
curl "https://api.securitytrails.com/v1/domain/example.com/whois" \
The example directs an external archive, WHOIS, Shodan, or repository request using target-derived data. This is intentional network reconnaissance.
Bajo
Hardcoded URL
curl "https://reverse-whois-api.whoisxmlapi.com/api/v2" \
The example directs an external archive, WHOIS, Shodan, or repository request using target-derived data. This is intentional network reconnaissance.
Bajo
Hardcoded URL
# Via web: https://www.shodan.io/search?query=ssh.fingerprint:%22...%22
The example directs an external archive, WHOIS, Shodan, or repository request using target-derived data. This is intentional network reconnaissance.
Bajo
Hardcoded URL
git clone https://github.com/<target-user>/<repo>.git
The example directs an external archive, WHOIS, Shodan, or repository request using target-derived data. This is intentional network reconnaissance.
Factores de riesgo
🌐 Acceso a red (45)
geolocation-and-media.md:141 geolocation-and-media.md:144 geolocation-and-media.md:221 geolocation-and-media.md:224 geolocation-and-media.md:324 geolocation-and-media.md:221 geolocation-and-media.md:224 SKILL.md:60 SKILL.md:63 SKILL.md:78 SKILL.md:88 SKILL.md:144 SKILL.md:161 SKILL.md:161 social-media.md:43 social-media.md:46 social-media.md:49 social-media.md:150 social-media.md:151 social-media.md:152 social-media.md:160 social-media.md:213 social-media.md:216 social-media.md:219 social-media.md:222 social-media.md:225 social-media.md:305 social-media.md:307 social-media.md:309 web-and-dns.md:49 web-and-dns.md:87 web-and-dns.md:108 web-and-dns.md:130 web-and-dns.md:152 web-and-dns.md:172 web-and-dns.md:177 web-and-dns.md:186 web-and-dns.md:220 web-and-dns.md:266 web-and-dns.md:293 web-and-dns.md:181 web-and-dns.md:325 web-and-dns.md:326 web-and-dns.md:199 web-and-dns.md:202
🔑 Variables de entorno (2)
⚙️ Comandos externos (30)
SKILL.md:18-20 SKILL.md:20-23 SKILL.md:23-25 SKILL.md:25-28 SKILL.md:28-30 SKILL.md:30-42 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:44-48 SKILL.md:48-68 SKILL.md:68-78 SKILL.md:78-79 SKILL.md:79-84 SKILL.md:84 SKILL.md:110 SKILL.md:114-118 SKILL.md:118-122 SKILL.md:122-125 SKILL.md:125-127 SKILL.md:127-131 SKILL.md:131 SKILL.md:135-138 SKILL.md:138-144 SKILL.md:144-148 SKILL.md:148-152 SKILL.md:152-160 SKILL.md:160-162 SKILL.md:162-172 SKILL.md:172 SKILL.md:176
📁 Acceso al sistema de archivos (4)
Patrones detectados
System reconnaissance×5Network scanning tools×7
Auditado por: codex Ver historial de auditorías →
Compartir y citar este informe
Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.
Copiar enlace del informe
https://skillstore.io/skills/ljagiello-ctf-osint/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportInsignia Markdown
[](https://skillstore.io/skills/ljagiello-ctf-osint?utm_source=security_passport_badge)Insignia HTML
<a href="https://skillstore.io/skills/ljagiello-ctf-osint?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ljagiello-ctf-osint/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Tarjeta para insertar
<iframe src="https://skillstore.io/embed/skills/ljagiello-ctf-osint.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citas académicas (APA · BibTeX · CFF)
Cita APA
ljagiello. (2026). ctf-osint security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/ljagiello-ctf-osint/audits/2Cita BibTeX
@techreport{ljagiello-ljagiello-ctf-osint-2026,
author = {ljagiello},
title = {ctf-osint security audit report (audit version 2)},
institution = {Skillstore},
year = {2026},
number = {2},
url = {https://skillstore.io/skills/ljagiello-ctf-osint/audits/2},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ctf-osint security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
- name: "ljagiello"
date-released: "2026-08-15"
url: "https://skillstore.io/skills/ljagiello-ctf-osint/audits/2"
identifiers:
- type: other
value: "skillstore:ljagiello-ctf-osint:audit:2"
description: "Skillstore immutable audit report identifier"
Puntuación de Skillstore
Por qué esta puntuación Confianza de la evidencia: Medio 55
Arquitectura
85
Mantenibilidad
87
Contenido
65
Comunidad
83
Cumplimiento de la especificación
Lo que puedes crear
Trace a Challenge Persona
Correlate organizer-provided usernames across public profiles and archives while recording evidence and false positives.
Geolocate Challenge Media
Combine metadata, signs, landmarks, maps, and image matching to identify a location from supplied media.
Investigate CTF Infrastructure
Review authorized DNS, WHOIS, archives, repository history, and service metadata for challenge clues.
Prueba estos prompts
Classify an OSINT Clue
Identify this challenge clue: [CLUE]. Explain likely formats, safe validation steps, and what evidence would confirm each interpretation.
Build a Persona Research Plan
Create an authorized CTF research plan for username [USERNAME]. Prioritize public sources, note false positives, and avoid collecting unrelated personal data.
Geolocate Supplied Media
Analyze the supplied challenge image. List visible geographic signals, propose candidate regions, and design a verification sequence using metadata, maps, and reverse search.
Correlate Authorized Infrastructure
For authorized CTF domain [DOMAIN], correlate DNS, WHOIS, archives, certificates, and repository evidence. Ask before any active probe and document uncertainty.
Mejores prácticas
- Confirm written authorization and scope before sending requests or probing services.
- Record source URLs, timestamps, confidence, and alternative explanations for every conclusion.
- Minimize personal data collection and redact tokens, credentials, and unrelated identities.
Evitar
- Do not scan public hosts because they resemble a CTF target.
- Do not bypass privacy controls or infer a person's home from fitness routes.
- Do not place user tokens or API secrets directly in commands, prompts, or reports.
Preguntas frecuentes
Does this skill perform searches automatically?
No. It provides procedures and command examples that an agent may run only with user approval and authorized scope.
Does it require internet access?
Yes. Most archive, map, social, DNS, WHOIS, and search workflows depend on external services.
Can it solve non-CTF investigations?
The techniques are dual-use, but this skill should remain limited to authorized competitions, labs, and consent-based research.
Which tools may be required?
Examples use Python, curl, dig, whois, exiftool, image tools, Shodan, and nmap. Availability depends on the environment.
How should API keys and tokens be handled?
Use scoped credentials, secure secret storage, minimal permissions, and prompt approval. Never include live secrets in prompts or reports.
How reliable are OSINT results?
Results can be stale, incomplete, or misleading. Confirm important conclusions with independent sources and state uncertainty.
Detalles del desarrollador
Autor
ljagielloLicencia
MIT
Revisión de Skillstore
r1
Aviso de versión
El autor no declaró una versión.
Repositorio
https://github.com/ljagiello/ctf-skills/tree/d6662d26b5ed3caa56f5eaf6eb887964f3747162/ctf-osintRef.
ba0224440a0286a68c9ef7d65e409a580b885eba
Actualidad del mantenimiento
16/8/2026
Uso
0 descargas · 0 vistas
Estructura de archivos