CTF Platform Workflow Skill

Description

--- name: ctf-plat-skills description: "Use when: detecting target CTF platform type, collecting user credentials, and routing actions to the correct script under scripts/ by platform." --- # CTF Platform Workflow Skill ## Outcome Produce a reusable automation flow that can: - Detect target CTF platform type from the target URL/domain using the repository detection script only - Collect credentials from the user safely - Route commands to the correct script in `scripts/` based on platform type ## Inputs - Required: - target URL or domain - platform credential(s) from the user - Optional: - desired action (`metadata`, `list`, `fetch`, `download`, `start`, `stop`, `renew`, `submit`) - action arguments (`challenge_id`, `instance_id`, `flag`) ## Script Routing Map - `gzctf` -> `python scripts/gzctf.py ...` - `zerosecone` -> `python scripts/zerosecone.py ...` - More platforms can be added later by creating new scripts in `scripts/` and extending the routing map. ## Core Workflow Run from the workspace root. 1. Detect platform type using the repository detection script only. Fix to url format if needed. ```bash python scripts/detect_platorm.py --url <target_url> ``` Do not infer platform type from manual HTML inspection, browser checks, ad-hoc HTTP probing, or branding heuristics when this script is available. 2. Ask user for required credentials after detection. 3. Save base_url and token (or other credentials) in environment variables or pass as arguments to platform scripts. 4. Route to the matched platform script. - If detected platform is `gzctf`, call: ```bash python scripts/gzctf.py list ``` - If detected platform is `zerosecone`, call: ```bash python scripts/zerosecone.py list ``` 5. Execute user-requested action with routed script. ```bash python scripts/gzctf.py metadata python scripts/gzctf.py list python scripts/gzctf.py fetch <challenge_id> python scripts/gzctf.py download <challenge_id> python scripts/gzctf.py start <challenge_id> python scripts/gzctf.py renew <instance_id> python scripts/gzctf.py stop <instance_id> python scripts/gzctf.py submit <challenge_id> <flag> ``` ```bash python scripts/zerosecone.py fetch <challenge_id> python scripts/zerosecone.py download <challenge_id> python scripts/zerosecone.py start <challenge_id> python scripts/zerosecone.py renew <instance_id> python scripts/zerosecone.py submit <challenge_id> <flag> ``` ## Environment Variable - GZCTF_URL: Base URL of the GZCTF platform (e.g. https://target/api/game/1 or https://target/games/1) - GZCTF_TOKEN: Authentication token for GZCTF API access - ZEROSECONE_URL: Base URL of the Zerosecone CTF platform (e.g., https://www.aliyunctf.com) - ZEROSECONE_TOKEN: Authentication token for API access ## Tool Prerequisites - For websocket challenge environments, `websocat` is required before interaction. - Install by OS: - macOS: ```zsh brew install websocat ``` or ```zsh sudo port install websocat ``` - Linux: Go https://github.com/vi/websocat/releases Download Pre-built Binary and add to PATH - Windows Go https://github.com/vi/websocat/releases Download Pre-built Binary and add to PATH - If installation fails (network/repo/permission issues), stop automated installation and ask the user to install manually from: ```text https://github.com/vi/websocat ``` - Resume challenge interaction only after `websocat` is available in `PATH`. ## Decision Points - If platform detection script returns no match: - stop and report detection failure - If challenge environment indicates websocket access: - check `websocat` availability first (`command -v websocat`) - try installing `websocat` automatically when missing - if installation fails, ask user to download/install manually from `https://github.com/vi/websocat` - for GZCTF `api/proxy/<uuid>` endpoints, try direct websocket connection first without adding Cookie auth headers - in that case, bind the ws/wss endpoint to a local TCP port with `websocat` and probe it with normal TCP/HTTP tools such as `curl` or `nc` - continue exploitation through the local bound port once protocol type is identified - If detected platform has no mapped script: - stop and report unsupported platform - If credentials are missing: - prompt user for required fields before running platform script - If action fails: - return API JSON/error details and ask whether to retry, switch action, or stop ## Completion Checks - Platform type is identified by `scripts/detect_platorm.py` - For websocket environments, ws/wss endpoint is successfully bound to a local TCP port via `websocat` before exploitation/interaction - For GZCTF websocket proxy endpoints, direct no-cookie connection is attempted before adding extra headers - Required credentials are explicitly collected from the user - Correct script path is selected based on platform type - Routed command executes and returns parseable output - On failures, the response includes next-step options (retry/change action/stop) ## Command Patterns Detection: ```bash python scripts/detect_platorm.py --url <target_url> ``` GZCTF with env token: ```bash python scripts/gzctf.py list ``` GZCTF with explicit credentials: ```bash python scripts/gzctf.py <action> [args] ``` Zerosecone with env token: ```bash python scripts/zerosecone.py list ``` Zerosecone with explicit credentials: ```bash python scripts/zerosecone.py --url <target_url> --token "$ZEROSECONE_TOKEN" <action> [args] ``` Websocket environment port binding (required before interaction): ```bash command -v websocat || <install-websocat-by-os> websocat tcp-l:127.0.0.1:<local_port> ws://<target_ws_endpoint> # or websocat -k tcp-l:127.0.0.1:<local_port> wss://<target_ws_endpoint> ``` Direct GZCTF websocket proxy probe without Cookie: ```bash printf 'help\n' | websocat -v -k -t -E 'wss://<domain>/api/proxy/<instance_uuid>' ``` If installation fails, ask user to install manually from `https://github.com/vi/websocat` and rerun the binding command.

Security Status