mcpField
C
ctf-forensics

ctf-forensics

github.com/wgpsecSecurity1.8k51 installsUpdated 5d ago
Repository

About ctf-forensics

ctf-forensics is a reference skill for CTF digital forensics. It helps participants find analysis paths, tools, and commands by evidence type, covering disks, networks, logs, and steganography.

Key features

  1. 01Load topic-specific references as needed
  2. 02Analyze disk and memory images
  3. 03Investigate Windows and Linux evidence
  4. 04Analyze network traffic
  5. 05Examine image, audio, and video steganography

Use cases

  1. 01Inspect a disk or memory image
  2. 02Analyze Windows event logs
  3. 03Look for hidden data in media files

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/wgpsec/aboutsecurity --skill ctf-forensics

After installing, type/ctf-forensicsin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

evals/
evals.json
recall.json
references/
3d-printing.md
disk-advanced.md
disk-and-memory.md
disk-recovery.md
linux-forensics.md
network-advanced.md
network.md
peripheral-capture.md
signals-and-hardware.md
steganography.md
stego-advanced-2.md
stego-advanced.md
stego-image.md
windows.md

Details

From the project README

CTF 数字取证

深入参考

以下参考资料按需加载，根据识别出的具体方向选择对应文件：

分类决策树

拿到取证题？
├─ 文件分析
│  ├─ file/exiftool/binwalk → 识别格式与嵌入文件
│  ├─ 图片 → steghide/zsteg/stegsolve → [references/stego-image.md](references/stego-image.md)
│  ├─ 音频 → 频谱图/DTMF/SSTV → [references/stego-advanced.md](references/stego-advanced.md)
│  └─ PDF → 元数据/隐藏文本/多层 → [references/steganography.md](references/steganography.md)
├─ 磁盘/内存镜像
│  ├─ .dd/.img → mount -o loop,ro → fls/photorec
│  ├─ .ova/.vmdk → tar xf → 7z 提取
│  ├─ 内存 → Volatility3 (pslist/filescan/dumpfiles)
│  └─ RAID/ZFS/BTRFS → [references/disk-recovery.md](references/disk-recovery.md)
├─ 网络流量 (.pcap)
│  ├─ HTTP → tshark --export-objects
│  ├─ TLS → SSLKEYLOGFILE / 弱RSA密钥
│  ├─ SMB → 密钥解密 / NTLMv2 提取
│  └─ DNS → 隐蔽通道 / 尾字节编码
├─ Windows 事件日志 → [references/windows.md](references/windows.md)
├─ 硬件信号 → [references/signals-and-hardware.md](references/signals-and-hardware.md)
└─ 区块链 → mempool.space API / 剥离链追踪

快速启动命令

# 文件分析
file suspicious && exiftool suspicious && binwalk suspicious
strings -n 8 suspicious | grep -iE "flag|ctf"

# 磁盘取证
sudo mount -o loop,ro image.dd /mnt/evidence
fls -r image.dd && photorec image.dd

# 内存取证 (Volatility 3)
vol3 -f memory.dmp windows.pslist
vol3 -f memory.dmp windows.filescan
vol3 -f memory.dmp windows.dumpfiles --physaddr ADDR

# 网络流量
tshark -r capture.pcap -Y "http" --export-objects http,/tmp/out

隐写速查

格式工具说明
JPEGsteghide / F5 检测DQT表/DCT系数比
PNG/BMPzsteg / stegsolve位平面/调色板/LSB
音频multimon-ng / soxDTMF/频谱/反转
视频帧累积/逐帧差分闪烁隐藏QR
PDFexiftool + binwalk元数据/注释/EOF后数据

Windows 关键事件 ID

ID含义
1102审计日志清除
4720用户创建
4781账户重命名
21 (TSLocal)RDP 登录成功

Windows 事件日志

  • EVTX 分析关注时间戳（TimeCreated / SystemTime）排序关键事件

Comments

Markdown supported