ctf-web
按流程从映射到利用引导，便于快速定位与验证Web漏洞。
含渗透与攻击技术，可能被滥用，务必在授权范围内操作。
面向CTF的Web渗透与利用技巧速查，包括XSS、SQLi、SSRF等。
给 CTF 场景下的 Web 利用提供速查和实战套路，覆盖 XSS、SQLi、SSRF、SSTI、JWT、文件上传、请求走私等常见漏洞。用于快速定位攻击面、拼 payload 或绕过身份验证，把思路和常用命令、工具串成可执行的步骤。不是做原生内存利用或深度密码学分析，更偏向 Web 层面的速查与落地技巧。
▸ 展开 SKILL.md 英文原文
Provides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, identity flow, or smart-contract frontend/backend surface, including XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, request smuggling, OAuth/OIDC, SAML, prototype pollution, and similar web bugs. Do not use it for native binary memory corruption, reverse engineering of standalone executables, disk or memory forensics, or pure cryptanalysis unless the web flaw is still the main path to the flag.
帮我安装这个 skill：https://raw.githubusercontent.com/OpenAisec/Miko/main/data/skills/ctf-web/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/OpenAisec/Miko/main/data/skills/ctf-web/SKILL.md"# CTF Web Exploitation Use this skill as a routing and execution guide for web-heavy challenges. Keep the first pass short: map the app, confirm the trust boundary, and only then dive into the detailed technique notes. ## Prerequisites **Python packages (all platforms):** ```bash pip install sqlmap flask-unsign requests ``` **Linux (apt):** ```bash apt install hashcat jq curl ``` **macOS (Homebrew):** ```bash brew install hashcat jq curl ``` **Go tools (all platforms, requires Go):** ```bash go install github.com/ffuf/ffuf/v2@latest ``` **Manual install:** - ysoserial — [GitHub](https://github.com/frohoff/ysoserial), requires Java (Java deserialization payloads) ## Additional Resourc