Tooluck logoTooluck
SKILL.md

ctf-forensics

Agent skill fromljagiello/ctf-skills

Provides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions, steganography, PDF analysis, Windows registry, Volatility, PCAP, Docker images, coredumps, side-channel power traces, DTMF audio spectrograms, packet timing analysis, CD audio disc images, or recovering deleted files and credentials.

How to install ctf-forensics

install ctf-forensics
# install the ctf-skills pack with the skills CLI
npx skills add ljagiello/ctf-skills

# or add only this skill to Claude Code: copy the folder

ctf-forensics/

# into

~/.claude/skills/ctf-forensics/ (all projects)

.claude/skills/ctf-forensics/ (one project)

ctf-forensics/SKILL.md

MITFull file
1# CTF Forensics & Blockchain
2
3Quick reference for forensics CTF challenges. Each technique has a one-liner here; see supporting files for full details.
4
5## Prerequisites
6
7**Python packages (all platforms):**
8```bash
9pip install volatility3 Pillow numpy matplotlib scipy librosa scikit-learn opencv-python-headless pymongo impacket brotli exrex stegano heatshrink2
10```
11
12**Linux (apt):**
13```bash
14apt install binwalk foremost libimage-exiftool-perl tshark sleuthkit \
15 ffmpeg steghide testdisk john pcapfix
16```
17
18**macOS (Homebrew):**
19```bash
20brew install binwalk exiftool wireshark sleuthkit ffmpeg \
21 testdisk john-jumbo
22```
23
24**Ruby gems (all platforms):**
25```bash
26gem install zsteg
27```
28
29## Additional Resources
30
31- [3d-printing.md](3d-printing.md) - 3D printing forensics (PrusaSlicer binary G-code, QOIF, heatshrink)
32- [windows.md](windows.md) - Windows forensics (registry, SAM, event logs, recycle bin, NTFS alternate data streams, USN journal, PowerShell history, Defender MPLog, WMI persistence, Amcache)
33- [network.md](network.md) - Network forensics basics (tcpdump, TLS/SSL keylog decryption, TLS master key extraction from coredump, Wireshark, PCAP, port scanning, SMB3 decryption, 5G/NR protocols, WordPress recon, credentials, USB HID steno, BCD encoding, HTTP file upload exfiltration, split archive reassembly via timestamp ordering)
34…

Excerpt shown under the repository's MIT license.

More skills in ctf-skills

Keep exploring

Similar skill repositories

Newsletter

Join the Community

Subscribe to our newsletter for the latest news and updates