ctf-web
覆盖XSS/SQLi/SSRF等常见Web漏洞与快速勘测流程。
包含针对Web的攻击技术，可能违反法律或服务条款，仅限测试环境。
面向Web安全的CTF利用技巧与检测手法集合。
面向 Web CTF 的攻防工具箱，覆盖 XSS、SQLi、SSTI、SSRF、XXE、JWT、OAuth/OIDC、SAML、文件上传、请求走私、prototype pollution 等常见漏洞链路。用在目标主要是 HTTP 应用、API、浏览器客户端或前后端交互面时，先画出边界再逐项验证。专注 web 漏洞利用和检测，不适合原生二进制或纯密码学题目。
▸ 展开 SKILL.md 英文原文
Provides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, identity flow, or smart-contract frontend/backend surface, including XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, request smuggling, OAuth/OIDC, SAML, prototype pollution, and similar web bugs. Do not use it for native binary memory corruption, reverse engineering of standalone executables, disk or memory forensics, or pure cryptanalysis unless the web flaw is still the main path to the flag.
帮我安装这个 skill：https://raw.githubusercontent.com/ljagiello/ctf-skills/main/ctf-web/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/ljagiello/ctf-skills/main/ctf-web/SKILL.md"# CTF Web Exploitation Use this skill as a routing and execution guide for web-heavy challenges. Keep the first pass short: map the app, confirm the trust boundary, and only then dive into the detailed technique notes. ## Prerequisites **Python packages (all platforms):** ```bash pip install sqlmap flask-unsign requests ``` **Linux (apt):** ```bash apt install hashcat jq curl ``` **macOS (Homebrew):** ```bash brew install hashcat jq curl ``` **Go tools (all platforms, requires Go):** ```bash go install github.com/ffuf/ffuf/v2@latest ``` **Manual install:** - ysoserial — [GitHub](https://github.com/frohoff/ysoserial), requires Java (Java deserialization payloads) ## Additional Resourc