mcpField
J
judge-ctf

judge-ctf

github.com/wgpsecSecurity1.8k47 installsUpdated 4d ago
Repository

About judge-ctf

judge-ctf is a security skill for evaluating whether a CTF task produced a flag and diagnosing failures. It uses discovered and exploited vulnerabilities to give concrete next-step guidance.

Key features

  1. 01Flag detection across logs and evidence
  2. 02Vulnerability discovery diagnosis
  3. 03Exploit follow-up guidance
  4. 04Specific payload and location suggestions

Use cases

  1. 01Checking whether a CTF run captured a flag
  2. 02Identifying why a discovered vulnerability did not yield a flag
  3. 03Providing targeted next steps after exploitation

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/wgpsec/aboutsecurity --skill judge-ctf

After installing, type/judge-ctfin Claude Code to confirm it loaded.

Details

From the project README

CTF Flag Capture Evaluation Checklist

Sole Success Criterion

Has flag{...} been found?

  • Search agent output logs for flag{
  • Search evidence files for flag{
  • Search vulns.json detail fields

Found → complete: true, no further evaluation needed.

Diagnosis When Flag NOT Found

Step 1: Was any vulnerability discovered?
if vuln_count == 0:
    → Insufficient reconnaissance, expand attack surface
    feedback: "No vulnerabilities discovered. Suggestions:
      1. Carefully inspect all HTTP responses for hidden clues
      2. Try directory bruteforce to discover hidden endpoints
      3. Check page source for comments and hidden parameters
      4. Try common default credentials for login"
Step 2: Was the vulnerability exploited?
if vulns_found but not_exploited:
    → Insufficient exploitation
    feedback: "Discovered {vuln_type} but did not exploit to get flag. Suggestions:
      - SQLi: Use UNION SELECT to read database tables, find flag table
      - LFI: Read /flag.txt, /home/*/flag, /var/www/flag
      - RCE: find / -name 'flag*' 2>/dev/null
      - IDOR: Enumerate all id values, check each response for flag"
Step 3: Exploited but no flag?
if vuln_exploited but no_flag:
    → Flag may not be in expected location
    feedback: "Vulnerability exploited but flag not found. Suggestions:
      1. Database search: SELECT * FROM flags / search all tables
      2. File search: find / grep -r 'flag{' / env | grep FLAG
      3. Check response headers: curl -v for HTTP headers
      4. Check hidden pages: use gained privileges to access /admin, /dashboard
      5. Check source code: decompile/view application source for hardcoded flag"

Common CTF Challenge Patterns

Judge should know these patterns to provide precise feedback:

Vuln TypeFlag Typically Located
SQL InjectionA field in some database table
LFI/Path Traversal/flag.txt or /etc/flag or in application directory
RCE/Command InjectionFilesystem, requires find/grep
IDORContent of a specific resource by id
DeserializationFilesystem after gaining RCE
SSRFResponse from internal service
XSSUsually no direct flag, unless admin bot exists
Info DisclosureSource comments, backup files, config files

Feedback Precision Requirements

FORBIDDEN: vague feedback like "keep testing" or "dig deeper".

MUST provide specific:

  1. Which discovered vulnerability to exploit
  2. Concrete exploitation steps (payload-level)
  3. Most likely flag location

Comments

Markdown supported