npx skills add https://github.com/ljagiello/ctf-skills --skill ctf-forensicsCTF 取证挑战快速参考。每种技术在此处都有一行命令;完整细节请参阅支持文件。
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
# 文件分析
file suspicious_file
exiftool suspicious_file # 元数据
binwalk suspicious_file # 嵌入文件
strings -n 8 suspicious_file
hexdump -C suspicious_file | head # 检查魔数
# 磁盘取证
sudo mount -o loop,ro image.dd /mnt/evidence
fls -r image.dd # 列出文件
photorec image.dd # 雕刻已删除文件
# 内存取证 (Volatility 3)
vol3 -f memory.dmp windows.info
vol3 -f memory.dmp windows.pslist
vol3 -f memory.dmp windows.filescan
完整 Volatility 插件参考、虚拟机取证和核心转储分析请参阅 disk-and-memory.md。
grep -iE "(flag|part|piece|fragment)" server.log # 标志片段
grep "FLAGPART" server.log | sed 's/.*FLAGPART: //' | uniq | tr -d '\n' # 重构
sort logfile.log | uniq -c | sort -rn | head # 查找异常
Linux 攻击链分析和 Docker 镜像取证请参阅 linux-forensics.md。
关键事件 ID:
RDP 会话 ID (TerminalServices-LocalSessionManager):
21 - 会话登录成功
24 - 会话断开连接
1149 - RDP 认证成功 (RemoteConnectionManager, 包含源 IP)
import Evtx.Evtx as evtx with evtx.Evtx("Security.evtx") as log: for record in log.records(): print(record.xml())
完整事件 ID 表、注册表分析、SAM 解析、USN 日志和反取证检测请参阅 windows.md。
dir/资源管理器不可见。使用 fls -r image.dd | grep ":" 检测,使用 icat 提取。请参阅 windows.md。如果攻击者清除了事件日志,请使用以下替代来源:
详细解析代码和反取证检测清单请参阅 windows.md。
steghide extract -sf image.jpg
zsteg image.png # PNG/BMP 分析
stegsolve # 视觉分析
二进制边框隐写: 图像边框 1 像素的黑/白像素按顺时针编码比特位
FFT 频域: 隐藏在 2D FFT 幅度谱中的图像数据;尝试 np.fft.fft2 可视化
DTMF 音频: 编码数据的电话音;使用 multimon-ng -a DTMF 解码
多层 PDF: 检查隐藏注释、EOF 后数据、与关键词的 XOR、ROT18 最终层
SSTV + LSB: SSTV 信号可能是障眼法;使用 stegolsb 检查音频样本的 2 位 LSB
SVG 关键帧: 动画 keyTimes/values 属性通过填充颜色交替编码二进制/莫尔斯码
PNG 块重排序: 修复块顺序:IHDR → 辅助块 → IDAT(按顺序)→ IEND
文件叠加: 检查 IEND 后是否有附加的归档文件,其魔数被覆盖
自定义频率 DTMF: 非标准双音频率;先生成频谱图 (ffmpeg -i audio -lavfi showspectrumpic),将自定义网格映射到键盘数字,解码变长 ASCII
JPEG DQT LSB: 未使用的量化表(ID 2, 3)携带 LSB 编码的数据;通过 Image.open().quantization 访问,并从 64 个值中的每一个提取比特 0
多轨音频减法: MKV/视频中两个几乎相同的音频轨道;sox -m a0.wav "|sox a1.wav -p vol -1" diff.wav 抵消共享内容,标志出现在差分信号的频谱图中(5-12 kHz 频段)
数据包间隔时间: 具有两个不同间隔值(例如,10ms/100ms)的相同数据包编码二进制;按接口过滤,计算数据包间增量,阈值化为比特位
完整代码示例和解码工作流程请参阅 steganography.md 和 stego-advanced.md。
exiftool document.pdf # 元数据(经常隐藏标志!)
pdftotext document.pdf - # 提取文本
strings document.pdf | grep -i flag
binwalk document.pdf # 嵌入文件
高级 PDF 隐写 (Nullcon 2026 rdctd): 六种技术 —— 不可见文本分隔符、带转义大括号的 URI 注释、模糊图像的维纳反卷积、矢量矩形 QR 码、压缩对象流 (mutool clean -d)、文档元数据字段。
完整 PDF 隐写技术和代码请参阅 steganography.md。
# 磁盘镜像
sudo mount -o loop,ro image.dd /mnt/evidence
fls -r image.dd && photorec image.dd
# 虚拟机镜像 (OVA/VMDK)
tar -xvf machine.ova
7z x disk.vmdk -oextracted "Windows/System32/config/SAM" -r
# 内存 (Volatility 3)
vol3 -f memory.dmp windows.pslist
vol3 -f memory.dmp windows.cmdline
vol3 -f memory.dmp windows.netscan
vol3 -f memory.dmp windows.dumpfiles --physaddr <addr>
# 字符串雕刻
strings -a -n 6 memdump.bin | grep -E "FLAG|SSH_CLIENT|SESSION_KEY"
# 核心转储
gdb -c core.dump # info registers, x/100x $rsp, find "flag"
完整 Volatility 插件参考、虚拟机取证、VMware 快照、已删除分区恢复、ZFS 取证和勒索软件分析请参阅 disk-and-memory.md。
# 使用 impacket 提取,使用 hashcat -m 1000 破解
python -c "from impacket.examples.secretsdump import *; SAMHashes('SAM', LocalOperations('SYSTEM').getBootKey()).dump()"
SAM 详情请参阅 windows.md,从 PCAP 进行 NTLMv2 破解请参阅 network-advanced.md。
https://mempool.space/api/tx/<TXID>| 魔数 | 格式 | 扩展名 | 备注 |
|---|---|---|---|
OggS | Ogg 容器 | .ogg | 音频/视频 |
RIFF | RIFF 容器 | .wav,.avi | 检查子格式 |
%PDF | .pdf | 检查元数据和嵌入对象 | |
GCDE | PrusaSlicer 二进制 G 代码 | .g, .bgcode | 参见 3d-printing.md |
$R 文件)模式 (Backchimney): 恶意软件使用 WMI 事件订阅实现持久化 (MITRE T1546.003)。
python PyWMIPersistenceFinder.py OBJECTS.DATA
WMI 存储库分析详情请参阅 windows.md。
data.replace(b'\r\n', b'\n').replace(b'\r\x00', b'\r') 修复rsatool 生成私钥,添加到 Wiresharktshark -e usb.iso.data 提取等时数据,在 Audacity 中作为原始 PCM 导入SMB3 解密、凭据提取请参阅 network.md,完整的 TLS/TFTP/USB 工作流程请参阅 linux-forensics.md。
Login Data SQLiteplaces.sqlite -- SELECT url FROM moz_places WHERE url LIKE '%flag%'完整的浏览器凭据解密代码请参阅 linux-forensics.md。
RUN 命令,即使在清理后。tar xf app.tar 然后检查 config blob。请参阅 linux-forensics.md。auth.log、.bash_history、最近的二进制文件、PCAP。请参阅 linux-forensics.md。bytes(a ^ b for a, b in zip(disk1, disk3))。请参阅 disk-and-memory.md。testdisk 或 kpartx -av。请参阅 disk-and-memory.md。.git 目录使用 gitdumper.sh。请参阅 linux-forensics.md。keepass2john 不支持 v4/Argon2;使用 ivanmrsulja/keepass2john 分支或 keepass4brute。使用 cewl 生成单词列表。请参阅 linux-forensics.md。git rebase --squash 留下可通过 git fsck --unreachable --no-reflogs 恢复的孤立对象。请参阅 linux-forensics.md。0x30/0x31) 编码二进制比特;8 位 MSB 优先块 → ASCII。请参阅 network-advanced.md。mount -o subvol=@backup 访问历史副本。请参阅 disk-recovery.md。ESC_G 协议将 zlib 压缩的 RGB 图像数据嵌入 base64 块中。剥离转义序列,连接,解压,重建。请参阅 steganography.md。LsaLookupSids 从 PCAP 枚举 AD 账户。请参阅 network-advanced.md。adb pull 提取 APK,使用 apktool 分析,检查 /data/data/<package>/ 中的 shared_prefs/ 和 SQLite 数据库。请参阅 disk-and-memory.md。docker save 导出分层 tar;已删除的文件在早期层中持续存在。docker history --no-trunc 揭示构建秘密。请参阅 disk-and-memory.md。list-object-versions 恢复已删除的标志。请参阅 disk-and-memory.md。icat 跨事务 ID 读取 inode。请参阅 disk-and-memory.md。.wcm 文件包含带有嵌入加密数据的宏;XOR 公式 (a+b)-2*(a&b) = 按位 XOR。请参阅 disk-and-memory.md。git hash-object 验证。请参阅 linux-forensics.md。Quick reference for forensics CTF challenges. Each technique has a one-liner here; see supporting files for full details.
# File analysis
file suspicious_file
exiftool suspicious_file # Metadata
binwalk suspicious_file # Embedded files
strings -n 8 suspicious_file
hexdump -C suspicious_file | head # Check magic bytes
# Disk forensics
sudo mount -o loop,ro image.dd /mnt/evidence
fls -r image.dd # List files
photorec image.dd # Carve deleted files
# Memory forensics (Volatility 3)
vol3 -f memory.dmp windows.info
vol3 -f memory.dmp windows.pslist
vol3 -f memory.dmp windows.filescan
See disk-and-memory.md for full Volatility plugin reference, VM forensics, and coredump analysis.
grep -iE "(flag|part|piece|fragment)" server.log # Flag fragments
grep "FLAGPART" server.log | sed 's/.*FLAGPART: //' | uniq | tr -d '\n' # Reconstruct
sort logfile.log | uniq -c | sort -rn | head # Find anomalies
See linux-forensics.md for Linux attack chain analysis and Docker image forensics.
Key Event IDs:
RDP Session IDs (TerminalServices-LocalSessionManager):
21 - Session logon succeeded
24 - Session disconnected
1149 - RDP auth succeeded (RemoteConnectionManager, has source IP)
import Evtx.Evtx as evtx with evtx.Evtx("Security.evtx") as log: for record in log.records(): print(record.xml())
See windows.md for full event ID tables, registry analysis, SAM parsing, USN journal, and anti-forensics detection.
dir/Explorer. Detect with fls -r image.dd | grep ":", extract with icat. See windows.md.If attacker cleared event logs, use these alternative sources:
See windows.md for detailed parsing code and anti-forensics detection checklist.
steghide extract -sf image.jpg
zsteg image.png # PNG/BMP analysis
stegsolve # Visual analysis
Binary border stego: Black/white pixels in 1px image border encode bits clockwise
FFT frequency domain: Image data hidden in 2D FFT magnitude spectrum; try np.fft.fft2 visualization
DTMF audio: Phone tones encoding data; decode with multimon-ng -a DTMF
Multi-layer PDF: Check hidden comments, post-EOF data, XOR with keywords, ROT18 final layer
SSTV + LSB: SSTV signal may be red herring; check 2-bit LSB of audio samples with stegolsb
SVG keyframes: Animation keyTimes/values attributes encode binary/Morse via fill color alternation
PNG chunk reorder: Fix chunk order: IHDR → ancillary → IDAT (in order) → IEND
Check after IEND for appended archives with overwritten magic bytes
See steganography.md and stego-advanced.md for full code examples and decoding workflows.
exiftool document.pdf # Metadata (often hides flags!)
pdftotext document.pdf - # Extract text
strings document.pdf | grep -i flag
binwalk document.pdf # Embedded files
Advanced PDF stego (Nullcon 2026 rdctd): Six techniques -- invisible text separators, URI annotations with escaped braces, Wiener deconvolution on blurred images, vector rectangle QR codes, compressed object streams (mutool clean -d), document metadata fields.
See steganography.md for full PDF steganography techniques and code.
# Disk images
sudo mount -o loop,ro image.dd /mnt/evidence
fls -r image.dd && photorec image.dd
# VM images (OVA/VMDK)
tar -xvf machine.ova
7z x disk.vmdk -oextracted "Windows/System32/config/SAM" -r
# Memory (Volatility 3)
vol3 -f memory.dmp windows.pslist
vol3 -f memory.dmp windows.cmdline
vol3 -f memory.dmp windows.netscan
vol3 -f memory.dmp windows.dumpfiles --physaddr <addr>
# String carving
strings -a -n 6 memdump.bin | grep -E "FLAG|SSH_CLIENT|SESSION_KEY"
# Coredump
gdb -c core.dump # info registers, x/100x $rsp, find "flag"
See disk-and-memory.md for full Volatility plugin reference, VM forensics, VMware snapshots, deleted partition recovery, ZFS forensics, and ransomware analysis.
# Extract with impacket, crack with hashcat -m 1000
python -c "from impacket.examples.secretsdump import *; SAMHashes('SAM', LocalOperations('SYSTEM').getBootKey()).dump()"
See windows.md for SAM details and network-advanced.md for NTLMv2 cracking from PCAP.
https://mempool.space/api/tx/<TXID>| Magic | Format | Extension | Notes |
|---|---|---|---|
OggS | Ogg container | .ogg | Audio/video |
RIFF | RIFF container | .wav,.avi | Check subformat |
%PDF | .pdf |
$R files)Pattern (Backchimney): Malware uses WMI event subscriptions for persistence (MITRE T1546.003).
python PyWMIPersistenceFinder.py OBJECTS.DATA
See windows.md for WMI repository analysis details.
data.replace(b'\r\n', b'\n').replace(b'\r\x00', b'\r')rsatool, add to Wiresharktshark -e usb.iso.data, import as raw PCM in AudacitySee network.md for SMB3 decryption, credential extraction, and linux-forensics.md for full TLS/TFTP/USB workflows.
Login Data SQLite with AES-GCM using DPAPI master keyplaces.sqlite -- SELECT url FROM moz_places WHERE url LIKE '%flag%'See linux-forensics.md for full browser credential decryption code.
RUN commands even after cleanup. tar xf app.tar then inspect config blob. See linux-forensics.md.auth.log, .bash_history, recent binaries, PCAP. See linux-forensics.md.bytes(a ^ b for a, b in zip(disk1, disk3)). See disk-and-memory.md.Enumerate AD accounts from PCAP by analyzing LSARPC LsaLookupSids calls with sequential RIDs after Guest auth. Filter: dcerpc.cn_bind_to_str contains lsarpc.
See network-advanced.md for full RPC call sequence and Wireshark filters.
Extract crackable HMAC-MD5 hashes from MS-SNTP responses by sending NTP requests with machine account RIDs. Crack with hashcat -m 31300.
# Extract NTP payloads, convert to hashcat format, crack
tshark -r capture.pcapng -Y "ntp && ip.src == <DC_IP>" -T fields -e udp.payload
hashcat -m 31300 -a 0 -O hashes.txt rockyou.txt --username
See network-advanced.md for payload parsing script and full attack chain.
Quick path: tshark --export-objects http,/tmp/objects extracts uploaded files instantly. Check for multipart POST uploads, unusual User-Agent strings, and exfiltrated files (images with flag text). See network.md.
echo "base64string" | base64 -d
echo "hexstring" | xxd -r -p
# ROT13: tr 'A-Za-z' 'N-ZA-Mn-za-m'
ROT18: ROT13 on letters + ROT5 on digits. Common final layer in multi-stage forensics. See linux-forensics.md for implementation.
Weekly Installs
697
Repository
GitHub Stars
694
First Seen
Feb 1, 2026
Security Audits
Gen Agent Trust HubPassSocketWarnSnykFail
Installed on
codex682
opencode681
github-copilot670
gemini-cli668
amp667
kimi-cli666
Excel财务建模规范与xlsx文件处理指南:专业格式、零错误公式与数据分析
38,100 周安装
Custom freq DTMF: Non-standard dual-tone frequencies; generate spectrogram first (ffmpeg -i audio -lavfi showspectrumpic), map custom grid to keypad digits, decode variable-length ASCII
JPEG DQT LSB: Unused quantization tables (ID 2, 3) carry LSB-encoded data; access via Image.open().quantization and extract bit 0 from each of 64 values
Multi-track audio subtraction: Two nearly-identical audio tracks in MKV/video; sox -m a0.wav "|sox a1.wav -p vol -1" diff.wav cancels shared content, flag appears in spectrogram of difference signal (5-12 kHz band)
Packet interval timing: Identical packets with two distinct interval values (e.g., 10ms/100ms) encode binary; filter by interface, compute inter-packet deltas, threshold to bits
| Check metadata & embedded objects |
GCDE | PrusaSlicer binary G-code | .g, .bgcode | See 3d-printing.md |
testdisk or kpartx -av. See disk-and-memory.md.gitdumper.sh for exposed .git dirs. See linux-forensics.md.keepass2john lacks v4/Argon2 support; use ivanmrsulja/keepass2john fork or keepass4brute. Generate wordlists with cewl. See linux-forensics.md.git rebase --squash leaves orphaned objects recoverable via git fsck --unreachable --no-reflogs. See linux-forensics.md.0x30/0x31) appended after DNS question structure encode binary bits; 8-bit MSB-first chunks → ASCII. See network-advanced.md.mount -o subvol=@backup accesses historical copies. See disk-recovery.md.ESC_G protocol embeds zlib-compressed RGB image data in base64 chunks. Strip escape sequences, concatenate, decompress, reconstruct. See steganography.md.LsaLookupSids with incrementing RIDs enumerates AD accounts from PCAP. See network-advanced.md.adb pull, analyze with apktool, check shared_prefs/ and SQLite databases in /data/data/<package>/. See disk-and-memory.md.docker save exports layered tars; deleted files persist in earlier layers. docker history --no-trunc reveals build secrets. See disk-and-memory.md.list-object-versions recovers deleted flags. See disk-and-memory.md.icat with different XID block offsets to read inodes across transaction IDs. See disk-and-memory.md..wcm files contain macros with embedded encrypted data; XOR formula (a+b)-2*(a&b) = bitwise XOR. See disk-and-memory.md.git hash-object. See linux-forensics.md.sox audio.wav reversed.wav reverse or Audacity Effect → Reverse reveals hidden message. See stego-advanced.md.ffprobe -hide_banner file.mp4 to enumerate, ffmpeg -i file.mp4 -map 0:1 -frames:v 1 flag.jpg to extract. See steganography.md.e2fsck -y disk.img reconnects to /lost+found. Also use debugfs lsdel or icat. See disk-recovery.md.struct input_event binary dump; filter type==1 (EV_KEY), value==1 (press), map keycodes via input-event-codes.h. See signals-and-hardware.md.CByte((val-78)/3) transforms to ELF bytes. Reimplement in Python, never run the macro. See linux-forensics.md.