ΠΠ°Π²ΡΠΊΠΈ ctf-osint
π¦
ctf-osint
Π Π΅Π²ΠΈΠ·ΠΈΡ ΡΠΎΠ΄Π΅ΡΠΆΠΈΠΌΠΎΠ³ΠΎ r1 ΠΡΡΠΎΠΊΠΈΠΉ ΡΠΈΡΠΊ π ΠΠΎΡΡΡΠΏ ΠΊ ΡΠ΅ΡΠΈπ ΠΠ΅ΡΠ΅ΠΌΠ΅Π½Π½ΡΠ΅ ΠΎΠΊΡΡΠΆΠ΅Π½ΠΈΡβοΈ ΠΠ½Π΅ΡΠ½ΠΈΠ΅ ΠΊΠΎΠΌΠ°Π½Π΄Ρπ ΠΠΎΡΡΡΠΏ ΠΊ ΡΠ°ΠΉΠ»ΠΎΠ²ΠΎΠΉ ΡΠΈΡΡΠ΅ΠΌΠ΅
Investigate Authorized CTF OSINT Challenges
CTF OSINT clues often span disconnected public sources and media artifacts. This skill organizes practical methods for authorized identity, geolocation, archive, DNS, and web research.
ΠΠΎΠ΄Π΄Π΅ΡΠΆΠΈΠ²Π°Π΅Ρ: Claude Codex Code(CC)
ΠΡΡΠ°Π½ΠΎΠ²ΠΈΡΠ΅ΡΡ ΠΈ Π·Π°ΠΏΡΠΎΡΠΈΡΠ΅ ΠΏΠΎΠ΄ΡΠ²Π΅ΡΠΆΠ΄Π΅Π½ΠΈΠ΅ ΠΏΠ΅ΡΠ΅Π΄ ΡΡΡΠ°Π½ΠΎΠ²ΠΊΠΎΠΉ.
ΠΡΠΎΠ²Π΅ΡΡΡΠ΅ ΠΏΠ»Π°Π½ ΠΈ ΠΏΠΎΠ»ΡΡΠΈΡΠ΅ ΡΠ²Π½ΠΎΠ΅ ΡΠΎΠ³Π»Π°ΡΠΈΠ΅ ΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°ΡΠ΅Π»Ρ ΠΏΠ΅ΡΠ΅Π΄ ΠΈΠ·ΠΌΠ΅Π½Π΅Π½ΠΈΠ΅ΠΌ ΡΠ°ΠΉΠ»ΠΎΠ².
Π£ΡΡΠ°Π½ΠΎΠ²ΠΈΡΡ Ρ ΠΏΠΎΠΌΠΎΡΡΡ ΠΌΠΎΠ΅Π³ΠΎ ΠΠ³Π΅Π½ΡΠ°
Π‘ΠΊΠΎΠΏΠΈΡΡΠΉΡΠ΅ ΡΡΠΎΡ Π·Π°ΠΏΡΠΎΡ Π² ΡΠ²ΠΎΠ΅Π³ΠΎ ΠΠ³Π΅Π½ΡΠ°. ΠΠ½ ΡΠΎΠ΄Π΅ΡΠΆΠΈΡ ΠΊΠ°Π½ΠΎΠ½ΠΈΡΠ΅ΡΠΊΡΡ ΡΡΡΠ°Π½ΠΈΡΡ Skill ΠΈ ΠΌΠ°Π½ΠΈΡΠ΅ΡΡ.
ΠΠ°ΠΏΡΠΎΡ Π°Π³Π΅Π½ΡΠ°
Review the Skillstore skill "ctf-osint" from https://skillstore.io/skills/ljagiello-ctf-osint.md and its manifest at https://skillstore.io/api/skills/ljagiello-ctf-osint/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.ΠΠ°Ρ ΠΠ³Π΅Π½Ρ ΠΏΠΎ-ΠΏΡΠ΅ΠΆΠ½Π΅ΠΌΡ Π΄ΠΎΠ»ΠΆΠ΅Π½ ΠΏΠΎΠΊΠ°Π·Π°ΡΡ ΠΏΠ»Π°Π½ ΠΈ Π·Π°ΠΏΡΠΎΡΠΈΡΡ Π²ΡΠ΅ ΠΏΠΎΠ΄ΡΠ²Π΅ΡΠΆΠ΄Π΅Π½ΠΈΡ, ΡΡΠ΅Π±ΡΠ΅ΠΌΡΠ΅ ΠΏΠΎΠ»ΠΈΡΠΈΠΊΠΎΠΉ Π±Π΅Π·ΠΎΠΏΠ°ΡΠ½ΠΎΡΡΠΈ.
Π Π΅ΡΡΡΡΡ Π΄Π»Ρ AI-Π°Π³Π΅Π½ΡΠΎΠ²
ΠΡΠΏΠΎΠ»ΡΠ·ΡΠΉΡΠ΅ ΡΡΠΈ ΡΡΡΠ»ΠΊΠΈ, ΠΊΠΎΠ³Π΄Π° AI-Π°Π³Π΅Π½ΡΡ, crawler ΠΈΠ»ΠΈ script Π½ΡΠΆΠ΅Π½ ΡΠΈΡΡΡΠΉ ΠΊΠΎΠ½ΡΠ΅ΠΊΡΡ Π²ΠΌΠ΅ΡΡΠΎ ΠΏΠΎΠ»Π½ΠΎΠΉ ΡΡΡΠ°Π½ΠΈΡΡ.
ΠΡΠΎΡΠ΅ΡΡΠΈΡΠΎΠ²Π°ΡΡ
ΠΡΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°Π½ΠΈΠ΅ Β«ctf-osintΒ». Identify the string 4V FH 246 677.
ΠΠΆΠΈΠ΄Π°Π΅ΠΌΡΠΉ ΡΠ΅Π·ΡΠ»ΡΡΠ°Ρ:
Likely format: MGRS coordinate. Confirm the spacing and precision, convert it with a trusted MGRS tool, then verify the resulting location against challenge clues.
ΠΡΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°Π½ΠΈΠ΅ Β«ctf-osintΒ». Plan research for an organizer-provided username.
ΠΠΆΠΈΠ΄Π°Π΅ΠΌΡΠΉ ΡΠ΅Π·ΡΠ»ΡΡΠ°Ρ:
- Start with exact username searches and record profile identifiers.
- Check archived profile pages for rename evidence.
- Compare only challenge-relevant details across confirmed accounts.
- Document false positives and stop at unrelated personal information.
ΠΡΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°Π½ΠΈΠ΅ Β«ctf-osintΒ». Analyze a challenge image with a mirrored shop sign.
ΠΠΆΠΈΠ΄Π°Π΅ΠΌΡΠΉ ΡΠ΅Π·ΡΠ»ΡΡΠ°Ρ:
Flip the image horizontally, isolate the sign, transcribe reliable characters, search the partial phrase, and verify candidates using architecture and surrounding landmarks.
ΠΡΠ΄ΠΈΡ Π±Π΅Π·ΠΎΠΏΠ°ΡΠ½ΠΎΡΡΠΈ
ΠΡΡΠΎΠΊΠΈΠΉ ΡΠΈΡΠΊv2 β’ 15.08.2026 ΠΡΠΊΡΡΡΡ Π²Π΅ΡΡΠΈΠΎΠ½Π½ΡΠΉ ΠΎΡΡΠ΅Ρ
Most critical heuristic alerts are false positives caused by Markdown examples rather than an executable payload. However, the skill includes active scanning, authenticated token use, hidden-file probing, physical tracking, account targeting, and exploit-assisted pivots. These dual-use workflows require substantial authorization and privacy controls before publication.
4
ΠΡΠΎΡΠΊΠ°Π½ΠΈΡΠΎΠ²Π°Π½ΠΎ ΡΠ°ΠΉΠ»ΠΎΠ²
1,313
ΠΡΠΎΠ°Π½Π°Π»ΠΈΠ·ΠΈΡΠΎΠ²Π°Π½ΠΎ ΡΡΡΠΎΠΊ
26
ΠΡΠ½ΠΊΡΡ ΠΏΡΠΎΠ²Π΅ΡΠΊΠΈ
0
ΠΠΎΠΆΠ½ΡΠ΅ ΡΡΠ°Π±Π°ΡΡΠ²Π°Π½ΠΈΡ ΠΏΡΠΎΠΈΠ³Π½ΠΎΡΠΈΡΠΎΠ²Π°Π½Ρ
ΠΠΎΠ΄ΡΠ²Π΅ΡΠΆΠ΄ΡΠ½Π½ΡΠ΅ ΠΏΡΠΎΠ±Π»Π΅ΠΌΡ Π±Π΅Π·ΠΎΠΏΠ°ΡΠ½ΠΎΡΡΠΈ (16)
ΠΡΡΠΎΠΊΠΈΠΉ
Network scanning tools
apt install whois dnsutils nmap libimage-exiftool-perl imagemagick curl
The package-manager command installs nmap and related reconnaissance utilities, changing the host and provisioning active scanning capability.
ΠΡΡΠΎΠΊΠΈΠΉ
Network scanning tools
brew install whois bind nmap exiftool imagemagick curl
The package-manager command installs nmap and related reconnaissance utilities, changing the host and provisioning active scanning capability.
ΠΡΡΠΎΠΊΠΈΠΉ
Network scanning tools
- [web-and-dns.md](web-and-dns.md) - Google dorking (including TBS image filters), Google Docs/Sheet
The resource description explicitly directs DNS reconnaissance and nmap-based service fingerprinting. This is operational scanning guidance despite being prose.
ΠΡΡΠΎΠΊΠΈΠΉ
Network scanning tools
**Pattern:** Port appears open on a standard service port (22/SSH, 80/HTTP) but runs a fake service.
The line recommends nmap or netcat fingerprinting against an open service, which actively probes a target host.
ΠΡΡΠΎΠΊΠΈΠΉ
Network scanning tools
nmap -sS target.ctf
The section explicitly runs nmap against a target and recommends service fingerprinting, which is active network scanning rather than passive OSINT.
ΠΡΡΠΎΠΊΠΈΠΉ
Network scanning tools
nmap -sV -sC target.ctf -p 22
The section explicitly runs nmap against a target and recommends service fingerprinting, which is active network scanning rather than passive OSINT.
ΠΡΡΠΎΠΊΠΈΠΉ
Network scanning tools
**Key insight:** Never trust port numbers alone. A SYN scan only confirms the port is open, not what
The section explicitly runs nmap against a target and recommends service fingerprinting, which is active network scanning rather than passive OSINT.
ΠΡΡΠΎΠΊΠΈΠΉ
Privacy-Invasive Physical Tracking Guidance
The skill recommends tracing a person through fitness routes and states that privacy zones can be circumvented to infer home or work neighborhoods.
The section explicitly links username enumeration to Strava GPS endpoints and describes bypassing privacy zones. The physical-location impact is direct.
ΠΠΎΠΊΠ°Π·Π°ΡΡ Π²ΡΠ΅ ΠΏΠΎΠ΄ΡΠ²Π΅ΡΠΆΠ΄ΡΠ½Π½ΡΠ΅ Π½Π°Ρ ΠΎΠ΄ΠΊΠΈ (16)
ΠΡΡΠΎΠΊΠΈΠΉ
Credential and Account Targeting from Repository History
The skill instructs users to mine historic author emails and treat them as candidate logins before password-reset or SQL-injection attempts.
The text explicitly connects recovered email addresses to login targeting and later account attacks. This intent exceeds passive repository research.
ΠΡΡΠΎΠΊΠΈΠΉ
Authenticated Discord Enumeration with User Tokens
The skill directs users to place a Discord user token in shell commands that enumerate server roles, emojis, and message search results.
The commands use an Authorization header with a user token against guild and message endpoints. This is explicit credential-bearing authenticated access.
ΠΡΡΠΎΠΊΠΈΠΉ
Exploit-Assisted Cross-Challenge Infrastructure Pivot
The skill recommends obtaining internal addresses through command injection or SSRF, then reusing them to bypass checks in another challenge.
The workflow names command injection and SSRF as sources of leaked internal data and directs reuse against another target. The exploit intent is explicit.
ΠΠΈΠ·ΠΊΠΈΠΉ
System reconnaissance
shodan search "hostname:target.com"
The Shodan command searches public Internet scan data for hosts matching a target hostname, which is a real reconnaissance action.
ΠΠΈΠ·ΠΊΠΈΠΉ
System reconnaissance
# - discord.id for user/server lookups
The line recommends a third-party service for Discord user and server lookups, which is an external identity-reconnaissance action.
ΠΠΈΠ·ΠΊΠΈΠΉ
System reconnaissance
- "Which user account did you use for X?" -> Check browser history, login records
The guidance directs examination of browser, login, recent-file, or Shellbag artifacts, which can expose sensitive local user activity outside an isolated CTF image.
ΠΠΈΠ·ΠΊΠΈΠΉ
System reconnaissance
- "What file did you access?" -> Check MRU, Recent files, Shellbags
The guidance directs examination of browser, login, recent-file, or Shellbag artifacts, which can expose sensitive local user activity outside an isolated CTF image.
ΠΠΈΠ·ΠΊΠΈΠΉ
System reconnaissance
**Pattern:** A challenge mentions a username with no credentials and expects the attacker to pivot t
The passage tells the operator to pivot from a username into public repositories and extract identity data for use against another service.
ΠΡΠ½ΠΊΡΡ ΠΏΡΠΎΠ²Π΅ΡΠΊΠΈ Π²ΠΎΠ·ΠΌΠΎΠΆΠ½ΠΎΡΡΠ΅ΠΉ (26)
ΠΡΠΎ ΡΠ΅Π°Π»ΡΠ½ΡΠ΅ Π»ΠΎΠΊΠ°Π»ΡΠ½ΡΠ΅ Π²ΠΎΠ·ΠΌΠΎΠΆΠ½ΠΎΡΡΠΈ, ΠΊΠΎΡΠΎΡΡΠ΅ ΠΌΠΎΠ³ΡΡ ΠΎΠΆΠΈΠ΄Π°ΡΡΡΡ Π΄Π»Ρ ΡΡΠΎΠ³ΠΎ Π½Π°Π²ΡΠΊΠ°, ΠΏΠΎΡΡΠΎΠΌΡ ΠΎΠ½ΠΈ ΡΡΠ΅Π±ΡΡΡ ΠΏΡΠΎΠ²Π΅ΡΠΊΠΈ, Π½ΠΎ Π½Π΅ ΡΡΠΈΡΠ°ΡΡΡΡ ΠΏΠΎΠ΄ΡΠ²Π΅ΡΠΆΠ΄ΡΠ½Π½ΡΠΌ Π²ΡΠ΅Π΄ΠΎΠ½ΠΎΡΠ½ΡΠΌ ΠΏΠΎΠ²Π΅Π΄Π΅Π½ΠΈΠ΅ΠΌ.
ΠΡΡΠΎΠΊΠΈΠΉ
Tor onion address
ssh-keyscan -t rsa target.onion 2>/dev/null | ssh-keygen -lf - -E md5
The command is a template for actively probing a Tor hidden service and collecting its SSH fingerprint. Replacing the placeholder with a target initiates security-sensitive reconnaissance.
ΠΡΡΠΎΠΊΠΈΠΉ
Tor onion address
ssh-audit target.onion
The command is a template for actively probing a Tor hidden service and collecting its SSH fingerprint. Replacing the placeholder with a target initiates security-sensitive reconnaissance.
Π‘ΡΠ΅Π΄Π½ΠΈΠΉ
Hardcoded URL
curl -H "Authorization: $TOKEN" "https://discord.com/api/v10/guilds/GUILD_ID/roles"
The curl command sends a user-supplied authorization token to Discord while enumerating server metadata or messages. The authenticated access is security-sensitive even though the host is official.
Π‘ΡΠ΅Π΄Π½ΠΈΠΉ
Hardcoded URL
curl -H "Authorization: $TOKEN" "https://discord.com/api/v10/guilds/GUILD_ID/emojis"
The curl command sends a user-supplied authorization token to Discord while enumerating server metadata or messages. The authenticated access is security-sensitive even though the host is official.
Π‘ΡΠ΅Π΄Π½ΠΈΠΉ
Hardcoded URL
curl -H "Authorization: $TOKEN" "https://discord.com/api/v10/guilds/GUILD_ID/messages/search?content
The curl command sends a user-supplied authorization token to Discord while enumerating server metadata or messages. The authenticated access is security-sensitive even though the host is official.
Π‘ΡΠ΅Π΄Π½ΠΈΠΉ
Hardcoded URL
curl -sO https://target/.DS_Store
The curl command probes a target for an exposed .DS_Store file and downloads it, an active request intended to discover hidden paths.
Π‘ΡΠ΅Π΄Π½ΠΈΠΉ
Hidden file access
curl -sO https://target/.DS_Store
The workflow intentionally retrieves and parses an exposed .DS_Store file to enumerate otherwise hidden server paths.
ΠΠΈΠ·ΠΊΠΈΠΉ
Hardcoded URL
curl "http://ip-api.com/json/103.150.68.150"
The command performs an external IP-geolocation lookup, disclosing the queried address to a third-party service.
ΠΠΈΠ·ΠΊΠΈΠΉ
Hardcoded URL
curl "https://ipinfo.io/103.150.68.150/json"
The command performs an external IP-geolocation lookup, disclosing the queried address to a third-party service.
ΠΠΈΠ·ΠΊΠΈΠΉ
Hardcoded URL
curl "https://web.archive.org/web/20230101*/target.com"
The cited curl example makes an external request and can disclose a target domain, username, or IP address to the named service.
ΠΠΈΠ·ΠΊΠΈΠΉ
Hardcoded URL
curl -s "https://whatsmyname.app/api/lookup?username=<user>"
The cited curl example makes an external request and can disclose a target domain, username, or IP address to the named service.
ΠΠΈΠ·ΠΊΠΈΠΉ
Hardcoded URL
curl "http://ip-api.com/json/103.150.68.150"
The cited curl example makes an external request and can disclose a target domain, username, or IP address to the named service.
ΠΠΈΠ·ΠΊΠΈΠΉ
Hardcoded URL
curl "http://web.archive.org/cdx/search/cdx?url=twitter.com/USERNAME*&output=json&fl=timestamp,origi
The curl command queries the Wayback CDX service with usernames, profile paths, or short links, disclosing investigation targets externally.
ΠΠΈΠ·ΠΊΠΈΠΉ
Hardcoded URL
curl "http://web.archive.org/cdx/search/cdx?url=pbs.twimg.com/profile_images/*&output=json"
The curl command queries the Wayback CDX service with usernames, profile paths, or short links, disclosing investigation targets externally.
ΠΠΈΠ·ΠΊΠΈΠΉ
Hardcoded URL
curl "http://web.archive.org/cdx/search/cdx?url=t.co/SHORTCODE&output=json"
The curl command queries the Wayback CDX service with usernames, profile paths, or short links, disclosing investigation targets externally.
ΠΠΈΠ·ΠΊΠΈΠΉ
Hardcoded URL
curl -s "https://public.api.bsky.app/xrpc/app.bsky.feed.searchPosts?q=metactf+flash+ctf&sort=latest"
The command queries BlueSky's public API for posts, profiles, feeds, or threads. This is intended external OSINT traffic and exposes the search target.
ΠΠΈΠ·ΠΊΠΈΠΉ
Hardcoded URL
curl -s "https://public.api.bsky.app/xrpc/app.bsky.actor.searchActors?q=metactf" | jq '.actors[].han
The command queries BlueSky's public API for posts, profiles, feeds, or threads. This is intended external OSINT traffic and exposes the search target.
ΠΠΈΠ·ΠΊΠΈΠΉ
Hardcoded URL
curl -s "https://public.api.bsky.app/xrpc/app.bsky.actor.getProfile?actor=metactf.bsky.social" | jq
The command queries BlueSky's public API for posts, profiles, feeds, or threads. This is intended external OSINT traffic and exposes the search target.
ΠΠΈΠ·ΠΊΠΈΠΉ
Hardcoded URL
curl -s "https://public.api.bsky.app/xrpc/app.bsky.feed.getAuthorFeed?actor=metactf.bsky.social&limi
The command queries BlueSky's public API for posts, profiles, feeds, or threads. This is intended external OSINT traffic and exposes the search target.
ΠΠΈΠ·ΠΊΠΈΠΉ
Hardcoded URL
curl -s "https://public.api.bsky.app/xrpc/app.bsky.feed.getPostThread?uri=at://did:plc:.../app.bsky.
The command queries BlueSky's public API for posts, profiles, feeds, or threads. This is intended external OSINT traffic and exposes the search target.
ΠΠΈΠ·ΠΊΠΈΠΉ
Hardcoded URL
https://www.google.com/search?q="orange"+"alternant"+site:linkedin.com&tbm=isch&tbs=itp:face
The URL performs a targeted Google image search for LinkedIn face results, sending identifying search criteria to an external service.
ΠΠΈΠ·ΠΊΠΈΠΉ
Hardcoded URL
curl "http://web.archive.org/cdx/search/cdx?url=example.com*&output=json&fl=timestamp,original,statu
The example directs an external archive, WHOIS, Shodan, or repository request using target-derived data. This is intentional network reconnaissance.
ΠΠΈΠ·ΠΊΠΈΠΉ
Hardcoded URL
curl "https://api.securitytrails.com/v1/domain/example.com/whois" \
The example directs an external archive, WHOIS, Shodan, or repository request using target-derived data. This is intentional network reconnaissance.
ΠΠΈΠ·ΠΊΠΈΠΉ
Hardcoded URL
curl "https://reverse-whois-api.whoisxmlapi.com/api/v2" \
The example directs an external archive, WHOIS, Shodan, or repository request using target-derived data. This is intentional network reconnaissance.
ΠΠΈΠ·ΠΊΠΈΠΉ
Hardcoded URL
# Via web: https://www.shodan.io/search?query=ssh.fingerprint:%22...%22
The example directs an external archive, WHOIS, Shodan, or repository request using target-derived data. This is intentional network reconnaissance.
ΠΠΈΠ·ΠΊΠΈΠΉ
Hardcoded URL
git clone https://github.com/<target-user>/<repo>.git
The example directs an external archive, WHOIS, Shodan, or repository request using target-derived data. This is intentional network reconnaissance.
Π€Π°ΠΊΡΠΎΡΡ ΡΠΈΡΠΊΠ°
π ΠΠΎΡΡΡΠΏ ΠΊ ΡΠ΅ΡΠΈ (45)
geolocation-and-media.md:141 geolocation-and-media.md:144 geolocation-and-media.md:221 geolocation-and-media.md:224 geolocation-and-media.md:324 geolocation-and-media.md:221 geolocation-and-media.md:224 SKILL.md:60 SKILL.md:63 SKILL.md:78 SKILL.md:88 SKILL.md:144 SKILL.md:161 SKILL.md:161 social-media.md:43 social-media.md:46 social-media.md:49 social-media.md:150 social-media.md:151 social-media.md:152 social-media.md:160 social-media.md:213 social-media.md:216 social-media.md:219 social-media.md:222 social-media.md:225 social-media.md:305 social-media.md:307 social-media.md:309 web-and-dns.md:49 web-and-dns.md:87 web-and-dns.md:108 web-and-dns.md:130 web-and-dns.md:152 web-and-dns.md:172 web-and-dns.md:177 web-and-dns.md:186 web-and-dns.md:220 web-and-dns.md:266 web-and-dns.md:293 web-and-dns.md:181 web-and-dns.md:325 web-and-dns.md:326 web-and-dns.md:199 web-and-dns.md:202
π ΠΠ΅ΡΠ΅ΠΌΠ΅Π½Π½ΡΠ΅ ΠΎΠΊΡΡΠΆΠ΅Π½ΠΈΡ (2)
βοΈ ΠΠ½Π΅ΡΠ½ΠΈΠ΅ ΠΊΠΎΠΌΠ°Π½Π΄Ρ (30)
SKILL.md:18-20 SKILL.md:20-23 SKILL.md:23-25 SKILL.md:25-28 SKILL.md:28-30 SKILL.md:30-42 SKILL.md:42-43 SKILL.md:43-44 SKILL.md:44-48 SKILL.md:48-68 SKILL.md:68-78 SKILL.md:78-79 SKILL.md:79-84 SKILL.md:84 SKILL.md:110 SKILL.md:114-118 SKILL.md:118-122 SKILL.md:122-125 SKILL.md:125-127 SKILL.md:127-131 SKILL.md:131 SKILL.md:135-138 SKILL.md:138-144 SKILL.md:144-148 SKILL.md:148-152 SKILL.md:152-160 SKILL.md:160-162 SKILL.md:162-172 SKILL.md:172 SKILL.md:176
π ΠΠΎΡΡΡΠΏ ΠΊ ΡΠ°ΠΉΠ»ΠΎΠ²ΠΎΠΉ ΡΠΈΡΡΠ΅ΠΌΠ΅ (4)
ΠΠ±Π½Π°ΡΡΠΆΠ΅Π½Π½ΡΠ΅ ΠΏΠ°ΡΡΠ΅ΡΠ½Ρ
System reconnaissanceΓ5Network scanning toolsΓ7
ΠΡΠ΄ΠΈΡΠΎΡ:: codex ΠΠΎΡΠΌΠΎΡΡΠ΅ΡΡ ΠΈΡΡΠΎΡΠΈΡ Π°ΡΠ΄ΠΈΡΠΎΠ² β
ΠΠΎΠ΄Π΅Π»ΠΈΡΡΡΡ ΠΈ ΡΠΈΡΠΈΡΠΎΠ²Π°ΡΡ ΡΡΠΎΡ ΠΎΡΡΠ΅Ρ
ΠΠ΅Π»ΠΈΡΠ΅ΡΡ Π²Π΅ΡΡΠΈΠΎΠ½Π½ΡΠΌ ΠΎΡΡΠ΅ΡΠΎΠΌ ΠΎΠ± ΠΎΡΠ΅Π½ΠΊΠ΅, Π½Π΅ΠΉΡΡΠ°Π»ΡΠ½ΡΠΌ Π·Π½Π°ΡΠΊΠΎΠΌ, Π²ΡΡΡΠ°ΠΈΠ²Π°Π΅ΠΌΠΎΠΉ ΠΊΠ°ΡΡΠΎΡΠΊΠΎΠΉ ΠΈ ΡΠΈΡΠ°ΡΠ°ΠΌΠΈ. Skillstore ΠΏΡΠ±Π»ΠΈΠΊΡΠ΅Ρ Π΄ΠΎΠΊΠ°Π·Π°ΡΠ΅Π»ΡΡΡΠ²Π°, Π½Π΅ ΡΠ΅ΡΠ°Ρ, Π±Π΅Π·ΠΎΠΏΠ°ΡΠ΅Π½ Π»ΠΈ ΡΡΠΎΡ Skill.
ΠΠΎΠΏΠΈΡΠΎΠ²Π°ΡΡ ΡΡΡΠ»ΠΊΡ Π½Π° ΠΎΡΡΡΡ
https://skillstore.io/skills/ljagiello-ctf-osint/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportΠΠ½Π°ΡΠΎΠΊ Markdown
[](https://skillstore.io/skills/ljagiello-ctf-osint?utm_source=security_passport_badge)ΠΠ½Π°ΡΠΎΠΊ HTML
<a href="https://skillstore.io/skills/ljagiello-ctf-osint?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ljagiello-ctf-osint/security.svg" alt="Skillstore security assessment" loading="lazy"></a>ΠΡΡΡΠ°ΠΈΠ²Π°Π΅ΠΌΠ°Ρ ΠΊΠ°ΡΡΠΎΡΠΊΠ°
<iframe src="https://skillstore.io/embed/skills/ljagiello-ctf-osint.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>ΠΠΊΠ°Π΄Π΅ΠΌΠΈΡΠ΅ΡΠΊΠΈΠ΅ ΡΡΡΠ»ΠΊΠΈ (APA Β· BibTeX Β· CFF)
Π¦ΠΈΡΠ°ΡΠ° APA
ljagiello. (2026). ctf-osint security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/ljagiello-ctf-osint/audits/2Π¦ΠΈΡΠ°ΡΠ° BibTeX
@techreport{ljagiello-ljagiello-ctf-osint-2026,
author = {ljagiello},
title = {ctf-osint security audit report (audit version 2)},
institution = {Skillstore},
year = {2026},
number = {2},
url = {https://skillstore.io/skills/ljagiello-ctf-osint/audits/2},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ctf-osint security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
- name: "ljagiello"
date-released: "2026-08-15"
url: "https://skillstore.io/skills/ljagiello-ctf-osint/audits/2"
identifiers:
- type: other
value: "skillstore:ljagiello-ctf-osint:audit:2"
description: "Skillstore immutable audit report identifier"
ΠΡΠ΅Π½ΠΊΠ° Skillstore
ΠΠΎΡΠ΅ΠΌΡ ΡΠ°ΠΊΠ°Ρ ΠΎΡΠ΅Π½ΠΊΠ° ΠΠΎΡΡΠΎΠ²Π΅ΡΠ½ΠΎΡΡΡ Π΄ΠΎΠΊΠ°Π·Π°ΡΠ΅Π»ΡΡΡΠ²: Π‘ΡΠ΅Π΄Π½ΠΈΠΉ 55
ΠΡΡ
ΠΈΡΠ΅ΠΊΡΡΡΠ°
85
Π‘ΠΎΠΏΡΠΎΠ²ΠΎΠΆΠ΄Π°Π΅ΠΌΠΎΡΡΡ
87
ΠΠΎΠ½ΡΠ΅Π½Ρ
65
Π‘ΠΎΠΎΠ±ΡΠ΅ΡΡΠ²ΠΎ
83
Π‘ΠΎΠΎΡΠ²Π΅ΡΡΡΠ²ΠΈΠ΅ ΡΠΏΠ΅ΡΠΈΡΠΈΠΊΠ°ΡΠΈΠΈ
Π§ΡΠΎ Π²Ρ ΠΌΠΎΠΆΠ΅ΡΠ΅ ΠΏΠΎΡΡΡΠΎΠΈΡΡ
Trace a Challenge Persona
Correlate organizer-provided usernames across public profiles and archives while recording evidence and false positives.
Geolocate Challenge Media
Combine metadata, signs, landmarks, maps, and image matching to identify a location from supplied media.
Investigate CTF Infrastructure
Review authorized DNS, WHOIS, archives, repository history, and service metadata for challenge clues.
ΠΠΎΠΏΡΠΎΠ±ΡΠΉΡΠ΅ ΡΡΠΈ ΠΏΡΠΎΠΌΠΏΡΡ
Classify an OSINT Clue
Identify this challenge clue: [CLUE]. Explain likely formats, safe validation steps, and what evidence would confirm each interpretation.
Build a Persona Research Plan
Create an authorized CTF research plan for username [USERNAME]. Prioritize public sources, note false positives, and avoid collecting unrelated personal data.
Geolocate Supplied Media
Analyze the supplied challenge image. List visible geographic signals, propose candidate regions, and design a verification sequence using metadata, maps, and reverse search.
Correlate Authorized Infrastructure
For authorized CTF domain [DOMAIN], correlate DNS, WHOIS, archives, certificates, and repository evidence. Ask before any active probe and document uncertainty.
ΠΡΡΡΠΈΠ΅ ΠΏΡΠ°ΠΊΡΠΈΠΊΠΈ
- Confirm written authorization and scope before sending requests or probing services.
- Record source URLs, timestamps, confidence, and alternative explanations for every conclusion.
- Minimize personal data collection and redact tokens, credentials, and unrelated identities.
ΠΠ·Π±Π΅Π³Π°ΡΡ
- Do not scan public hosts because they resemble a CTF target.
- Do not bypass privacy controls or infer a person's home from fitness routes.
- Do not place user tokens or API secrets directly in commands, prompts, or reports.
Π§Π°ΡΡΠΎ Π·Π°Π΄Π°Π²Π°Π΅ΠΌΡΠ΅ Π²ΠΎΠΏΡΠΎΡΡ
Does this skill perform searches automatically?
No. It provides procedures and command examples that an agent may run only with user approval and authorized scope.
Does it require internet access?
Yes. Most archive, map, social, DNS, WHOIS, and search workflows depend on external services.
Can it solve non-CTF investigations?
The techniques are dual-use, but this skill should remain limited to authorized competitions, labs, and consent-based research.
Which tools may be required?
Examples use Python, curl, dig, whois, exiftool, image tools, Shodan, and nmap. Availability depends on the environment.
How should API keys and tokens be handled?
Use scoped credentials, secure secret storage, minimal permissions, and prompt approval. Never include live secrets in prompts or reports.
How reliable are OSINT results?
Results can be stale, incomplete, or misleading. Confirm important conclusions with independent sources and state uncertainty.
Π‘Π²Π΅Π΄Π΅Π½ΠΈΡ Π΄Π»Ρ ΡΠ°Π·ΡΠ°Π±ΠΎΡΡΠΈΠΊΠΎΠ²
ΠΠ²ΡΠΎΡ
ljagielloΠΠΈΡΠ΅Π½Π·ΠΈΡ
MIT
Π Π΅Π²ΠΈΠ·ΠΈΡ Skillstore
r1
ΠΡΠΈΠΌΠ΅ΡΠ°Π½ΠΈΠ΅ ΠΎ Π²Π΅ΡΡΠΈΠΈ
ΠΠ²ΡΠΎΡ Π½Π΅ ΡΠΊΠ°Π·Π°Π» Π²Π΅ΡΡΠΈΡ.
Π Π΅ΠΏΠΎΠ·ΠΈΡΠΎΡΠΈΠΉ
https://github.com/ljagiello/ctf-skills/tree/d6662d26b5ed3caa56f5eaf6eb887964f3747162/ctf-osintΠ‘ΡΡΠ»ΠΊΠ°
ba0224440a0286a68c9ef7d65e409a580b885eba
ΠΠΊΡΡΠ°Π»ΡΠ½ΠΎΡΡΡ ΠΏΠΎΠ΄Π΄Π΅ΡΠΆΠΊΠΈ
16.08.2026
ΠΡΠΏΠΎΠ»ΡΠ·ΠΎΠ²Π°Π½ΠΈΠ΅
0 Π·Π°Π³ΡΡΠ·ΠΎΠΊ Β· 0 ΠΏΡΠΎΡΠΌΠΎΡΡΠΎΠ²
Π‘ΡΡΡΠΊΡΡΡΠ° ΡΠ°ΠΉΠ»ΠΎΠ²