CTF Technique Atlas

Purpose

Use this skill as the deep technique index when solving or training CTFs. It maps observable clues to likely vulnerabilities, probes, tools, and solver/exploit patterns. It complements the domain skills: load the matching domain skill after classification.

Operating rule

Do not only explain techniques. User wants practical CTF solving ability first, not mandatory boilerplate. For each challenge, create only the files/scripts needed to solve and verify the result; use full scaffolding only when the challenge is complex or the user asks for it.

Minimal practical artifacts

For each challenge or drill, prefer the lightest useful structure:

~/ctf-training/<category>/<challenge>/
  artifacts/   # original provided files, if any
  solve.py     # or exploit.py / extract.py / interact.py as appropriate
  notes.md     # short command log / key observations, only when useful

Do not spend time generating empty templates. The priority is: run probes, write a working solver/exploit/extractor, verify the flag, and preserve reusable lessons.

Fast workflow

1. Inventory artifact/service/source and flag format.
2. Create minimal working files only if needed.
3. Match clues against references/technique-matrix.md.
4. Load the specific domain skill.
5. Run the first probes from references/first-probes.md.
6. Build and execute a solver/exploit/extractor from references/solver-patterns.md.
7. Verify flag and update skills if a reusable trick appears.

Deep references

• references/technique-matrix.md — category-by-category attack map and clue-to-technique routing.
• references/first-probes.md — first commands/probes for each artifact type.
• references/solver-patterns.md — reusable exploitation and solver script patterns.
• references/tooling-map.md — practical tools by category and when to use them.
• references/mastery-drills.md — progressive drills to strengthen each CTF family.
• references/oscilloscope-bmp-analysis.md — multi-frame BMP time-series analysis workflow (NEW)
• references/scope-trace-bmp-stego.md — encrypted tool + BMP sequence CTF pattern
• references/image-sequence-decoding.md — decoding hidden messages from image sequences

Scripts

• scripts/ctf_router.py — lightweight text/artifact clue classifier that suggests likely CTF categories and first probes.

2025-2026 CTF Resource Quick Reference

Key CTF Archives & Training Resources

• CTF Archives: github.com/sajjadium/ctf-archives — comprehensive challenge archive (0CTF, HITCON, Google, SekaiCTF, etc.)
• Kernel-Exploit-Dojo: github.com/mito753/Kernel-Exploit-Dojo — 100+ kernel CTF challenges with exploit code + writeups
• pyjail-collection: github.com/jailctf/pyjail-collection — 113 pyjail challenges across 20+ CTFs
• how2heap: github.com/shellphish/how2heap — updated for glibc 2.41/2.42
• 7Rocky/CTF-scripts: github.com/7Rocky/CTF-scripts — SageMath/Python CTF solvers
• CTFtime: ctftime.org — event calendar, writeups, team rankings
• CryptoHack: cryptohack.org — interactive crypto challenges including lattice/PQ

AI-Assisted CTF Tools

• IDA Pro MCP: github.com/mrexodia/ida-pro-mcp — MCP server for IDA's decompiler
• GhidraMCP/ReVa: github.com/cyberkaida/reverse-engineering-assistant — 110 tools for Ghidra via MCP
• OGhidra: github.com/LLNL/OGhidra — AI-powered Ghidra with agentic loop + RAG
• angr + dAngr: LLM-guided symbolic execution

2025-2026 New Exploitation Techniques Summary

Maintenance standard

A technique is considered learned only when Hermes can:

• recognize the clue pattern;
• run the right first probes;
• produce a minimal solver/exploit/extractor;
• explain the root cause or hidden signal;
• verify the flag;
• preserve the reusable pattern in a skill or script.