mcpField
P
pentest-ctf-forensics

pentest-ctf-forensics

github.com/jd-opensourceSecurity31556 installsUpdated 28w ago
Repository

About pentest-ctf-forensics

A security skill for extracting hidden information from memory dumps, network captures, images, and disk images. It lays out workflows for file analysis, steganography, network and memory forensics, and data recovery, for CTF and penetration-testing tasks.

Key features

  1. 01Identify file types, metadata, and strings
  2. 02Detect and extract steganographic data
  3. 03Inspect PCAP traffic for flag transmission
  4. 04Analyze memory processes and connections
  5. 05Carve files and recover deleted data

Use cases

  1. 01Investigate suspicious network captures
  2. 02Search images for concealed data
  3. 03Examine memory dumps for injected code
  4. 04Recover files from disk images

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/jd-opensource/joysafeter --skill pentest-ctf-forensics

After installing, type/pentest-ctf-forensicsin Claude Code to confirm it loaded.

Bundled filesreferences/tools.mdreferences/workflows.md

Details

From the project README

Pentest CTF Forensics

Purpose

Extract hidden information from various artifacts: memory dumps, network captures (PCAP), images, and disk images.

Core Workflow

  1. File Analysis: Identify file type, metadata, and embedded strings using file, exiftool, and strings.
  2. Steganography: Detect and extract hidden data in images/audio using steghide and stegsolve.
  3. Network Forensics: Analyze PCAP files for suspicious traffic and flag transmission using wireshark or tshark.
  4. Memory Forensics: Analyze memory dumps for processes, connections, and injected code using volatility.
  5. Data Extraction: Carve files and recover deleted data using foremost and binwalk.

References

  • references/tools.md
  • references/workflows.md

Comments

Markdown supported