mcpField
C
competition-runtime-routing

competition-runtime-routing

github.com/zhaoxuya520Security43.7k93 installsUpdated 5w ago
Repository

About competition-runtime-routing

A specialized skill for CTF sandbox analysis that traces live requests through nodes, proxy rules, and header-driven branches. It depends on `$ctf-sandbox-orchestrator` to establish sandbox assumptions first, and focuses on end-to-end route verification and evidence preservation.

Key features

  1. 01Map host-to-process routes
  2. 02Trace headers and path prefixes
  3. 03Compare proxy config with live traffic
  4. 04Test minimal routing changes
  5. 05Package route evidence

Use cases

  1. 01Identify which node handles a live request
  2. 02Find routing branches driven by Host or forwarded headers
  3. 03Verify the backend selected by a proxy rule

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/zhaoxuya520/reverse-skill --skill competition-runtime-routing

After installing, type/competition-runtime-routingin Claude Code to confirm it loaded.

Bundled filesagents/openai.yamlreferences/runtime-routing.md

Details

From the project README

Competition Runtime Routing

Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.

Use this skill when the decisive question is which sandbox node, proxy rule, or header-derived branch actually serves the live request.

Reply in Simplified Chinese unless the user explicitly requests English.

Quick Start

  1. Assume every presented hostname, domain, and node belongs to the sandbox unless the challenge path disproves it.
  2. Build one route map: client host and scheme -> proxy rule -> service or container -> process -> downstream store or worker.
  3. Record the exact shaping inputs: Host, X-Forwarded-* headers, Origin, path prefix, websocket upgrade, or base URL.
  4. Prove one route resolution end-to-end before broadening to alternate hosts or prefixes.
  5. Re-run the same request with one routing input changed at a time.

Workflow

1. Map Route Inputs
  • Inspect vhost rules, reverse proxies, forwarded headers, path-prefix rewrites, upstream pools, and websocket or SSE upgrades.
  • Note which parts of the request influence routing or app behavior: host, scheme, port, path, prefix, cookie scope, or origin.
  • Treat public-looking domains, cloud hostnames, and separate VPS nodes as sandbox routing fixtures first.
2. Trace Route To Live Consumer
  • Map hostname to proxy rule to container or process to port to downstream service.
  • Compare checked-in proxy intent against live listeners, mounted configs, runtime env, and observed traffic.
  • Keep headers, proxy config, and live request traces tied together in one evidence chain.
3. Prove The Decisive Deviation
  • Reduce the result to the smallest request shape that flips host-based routing, tenant selection, cookie scope, or upstream target.
  • Distinguish route resolution from application auth logic; prove where each decision really happens.
  • If the problem shifts from routing to general web state or container runtime drift, switch back to the broader parent skill.

Read This Reference

  • Load references/runtime-routing.md for the routing checklist, header matrix, and evidence packaging.
  • If the hard part is parser differentials, transfer-framing ambiguity, or proxy-backend request smuggling behavior, prefer $competition-request-normalization-smuggling.

What To Preserve

  • Hostnames, proxy snippets, header sets, path prefixes, listener ports, and route-specific cookies
  • The exact request shape that reaches the decisive backend or branch
  • One compact host -> proxy -> service -> process map for the active path

Comments

Markdown supported