CTF取证与区块链挑战快速参考：命令速查与高级技术指南

ctf-forensics by ljagiello/ctf-skills

697 周安装量

694 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/ljagiello/ctf-skills --skill ctf-forensics

数据分析区块链安全

🇨🇳中文介绍

CTF 取证与区块链

CTF 取证挑战快速参考。每种技术在此处都有一行命令；完整细节请参阅支持文件。

附加资源

3d-printing.md - 3D 打印取证（PrusaSlicer 二进制 G 代码、QOIF、热缩管）
windows.md - Windows 取证（注册表、SAM、事件日志、回收站、NTFS 备用数据流、USN 日志、PowerShell 历史记录、Defender MPLog、WMI 持久化、Amcache）
network.md - 网络取证基础（tcpdump、TLS/SSL 密钥日志解密、从核心转储中提取 TLS 主密钥、Wireshark、PCAP、端口扫描、SMB3 解密、5G/NR 协议、WordPress 侦察、凭据、USB HID 速记、BCD 编码、HTTP 文件上传外泄、通过时间戳排序重组拆分归档）
network-advanced.md - 高级网络取证（数据包间隔时间编码、USB HID 鼠标/笔绘图恢复、NTLMv2 哈希破解、TCP 标志隐蔽信道、DNS 末字节隐写术、DNS 尾随字节二进制编码、带 XOR + ZIP 和 mDNS 密钥的多层 PCAP、Brotli 解压炸弹接缝分析、通过 LSARPC 进行的 SMB RID 回收、Timeroasting MS-SNTP 哈希提取）
disk-and-memory.md - 磁盘/内存取证（Volatility、磁盘挂载/雕刻、VM/OVA/VMDK、核心转储、已删除分区、ZFS、VMware 快照、勒索软件分析、GPT GUID 编码、VMDK 稀疏解析、APFS 快照恢复、Windows KAPE 分类、WordPerfect 宏 XOR 提取、minidump ISO 9660 恢复、RAID 5 XOR 恢复、Android 取证、Docker 容器取证、云存储取证）
disk-recovery.md - 磁盘恢复和提取模式（LUKS 主密钥恢复、PRNG 时间戳种子暴力破解、VBA 宏二进制恢复、FemtoZip 解压、XFS 文件系统重建、tar 重复条目提取、嵌套套娃文件系统提取、通过空字节交错进行的反雕刻、BTRFS 子卷/快照恢复、FAT16 空闲空间数据恢复、通过 fsck 进行的 ext2 孤立 inode 恢复）
steganography.md - 通用隐写术（二进制边框隐写、PDF 多层隐写、SVG 关键帧、PNG 重排序、文件叠加、GIF 帧差莫尔斯码、GZSteg + spammimic、电子表格频率恢复、Kitty 终端图形协议解码、ANSI 转义序列隐写术、自动立体图求解、两层字节+行交错、多流视频容器隐写）
- 图像专用隐写术（JPEG 未使用的 DQT 表 LSB、BMP 位平面 QR 提取、图像拼图重组、F5 JPEG DCT 比率检测、PNG 未使用的调色板条目隐写、QR 码瓦片重建、基于种子的像素排列 + 多位平面 QR、JPEG 缩略图像素到文本映射、带像素过滤的条件 LSB、JPEG 松弛空间、最近邻插值隐写、RGB 奇偶隐写术）

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

Windows 事件日志 (.evtx)

关键事件 ID:

1001 - Bugcheck/重启
1102 - 审计日志被清除
4720 - 用户账户创建
4781 - 账户重命名

RDP 会话 ID (TerminalServices-LocalSessionManager):

21 - 会话登录成功
24 - 会话断开连接
1149 - RDP 认证成功 (RemoteConnectionManager, 包含源 IP)

import Evtx.Evtx as evtx with evtx.Evtx("Security.evtx") as log: for record in log.records(): print(record.xml())

完整事件 ID 表、注册表分析、SAM 解析、USN 日志和反取证检测请参阅 windows.md。

NTFS 备用数据流 (ADS): 通过命名的 NTFS 流附加到文件的隐藏数据。对 dir/资源管理器不可见。使用 fls -r image.dd | grep ":" 检测，使用 icat 提取。请参阅 windows.md。

当日志被清除时

如果攻击者清除了事件日志，请使用以下替代来源：

USN 日志 ($J) - 文件操作时间线（MFT 引用、时间戳、原因）
SAM 注册表 - 从密钥最后修改时间戳推断账户创建
PowerShell 历史记录 - ConsoleHost_history.txt (USN DATA_EXTEND = 命令执行时间)
Defender MPLog - 包含威胁检测和 ASR 事件的独立日志
Prefetch - 程序执行证据
用户配置文件创建 - 首次登录时间（USN 日志中的配置文件目录）

详细解析代码和反取证检测清单请参阅 windows.md。

steghide extract -sf image.jpg
zsteg image.png              # PNG/BMP 分析
stegsolve                    # 视觉分析

二进制边框隐写: 图像边框 1 像素的黑/白像素按顺时针编码比特位
FFT 频域: 隐藏在 2D FFT 幅度谱中的图像数据；尝试 np.fft.fft2 可视化
DTMF 音频: 编码数据的电话音；使用 multimon-ng -a DTMF 解码
多层 PDF: 检查隐藏注释、EOF 后数据、与关键词的 XOR、ROT18 最终层
SSTV + LSB: SSTV 信号可能是障眼法；使用 stegolsb 检查音频样本的 2 位 LSB
SVG 关键帧: 动画 keyTimes/values 属性通过填充颜色交替编码二进制/莫尔斯码
PNG 块重排序: 修复块顺序：IHDR → 辅助块 → IDAT（按顺序）→ IEND
文件叠加: 检查 IEND 后是否有附加的归档文件，其魔数被覆盖
自定义频率 DTMF: 非标准双音频率；先生成频谱图 (ffmpeg -i audio -lavfi showspectrumpic)，将自定义网格映射到键盘数字，解码变长 ASCII
JPEG DQT LSB: 未使用的量化表（ID 2, 3）携带 LSB 编码的数据；通过 Image.open().quantization 访问，并从 64 个值中的每一个提取比特 0
多轨音频减法: MKV/视频中两个几乎相同的音频轨道；sox -m a0.wav "|sox a1.wav -p vol -1" diff.wav 抵消共享内容，标志出现在差分信号的频谱图中（5-12 kHz 频段）
数据包间隔时间: 具有两个不同间隔值（例如，10ms/100ms）的相同数据包编码二进制；按接口过滤，计算数据包间增量，阈值化为比特位

完整代码示例和解码工作流程请参阅 steganography.md 和 stego-advanced.md。

exiftool document.pdf        # 元数据（经常隐藏标志！）
pdftotext document.pdf -     # 提取文本
strings document.pdf | grep -i flag
binwalk document.pdf         # 嵌入文件

高级 PDF 隐写 (Nullcon 2026 rdctd): 六种技术 —— 不可见文本分隔符、带转义大括号的 URI 注释、模糊图像的维纳反卷积、矢量矩形 QR 码、压缩对象流 (mutool clean -d)、文档元数据字段。

完整 PDF 隐写技术和代码请参阅 steganography.md。

磁盘 / 虚拟机 / 内存取证

# 磁盘镜像
sudo mount -o loop,ro image.dd /mnt/evidence
fls -r image.dd && photorec image.dd

# 虚拟机镜像 (OVA/VMDK)
tar -xvf machine.ova
7z x disk.vmdk -oextracted "Windows/System32/config/SAM" -r

# 内存 (Volatility 3)
vol3 -f memory.dmp windows.pslist
vol3 -f memory.dmp windows.cmdline
vol3 -f memory.dmp windows.netscan
vol3 -f memory.dmp windows.dumpfiles --physaddr <addr>

# 字符串雕刻
strings -a -n 6 memdump.bin | grep -E "FLAG|SSH_CLIENT|SESSION_KEY"

# 核心转储
gdb -c core.dump  # info registers, x/100x $rsp, find "flag"

完整 Volatility 插件参考、虚拟机取证、VMware 快照、已删除分区恢复、ZFS 取证和勒索软件分析请参阅 disk-and-memory.md。

Windows 密码哈希

# 使用 impacket 提取，使用 hashcat -m 1000 破解
python -c "from impacket.examples.secretsdump import *; SAMHashes('SAM', LocalOperations('SYSTEM').getBootKey()).dump()"

SAM 详情请参阅 windows.md，从 PCAP 进行 NTLMv2 破解请参阅 network-advanced.md。

使用 mempool.space API：https://mempool.space/api/tx/<TXID>
剥离链: 始终追踪较大的输出；整数金额表明是剥离交易

不常见的文件魔数

魔数	格式	扩展名	备注
`OggS`	Ogg 容器	`.ogg`	音频/视频
`RIFF`	RIFF 容器	`.wav`,`.avi`	检查子格式
`%PDF`	PDF	`.pdf`	检查元数据和嵌入对象
`GCDE`	PrusaSlicer 二进制 G 代码	`.g`, `.bgcode`	参见 3d-printing.md

常见的标志位置

PDF 元数据字段（作者、标题、关键词）
图像 EXIF 数据
已删除文件（回收站 $R 文件）
注册表值
浏览器历史记录
日志文件片段
内存字符串

模式 (Backchimney): 恶意软件使用 WMI 事件订阅实现持久化 (MITRE T1546.003)。

python PyWMIPersistenceFinder.py OBJECTS.DATA

查找带有 CommandLineEventConsumer 的 FilterToConsumerBindings
消费者命令中的 Base64 编码的 PowerShell
由系统事件（登录、定时器）触发的事件过滤器

WMI 存储库分析详情请参阅 windows.md。

网络取证快速参考

TFTP netascii: 二进制传输损坏；使用 data.replace(b'\r\n', b'\n').replace(b'\r\x00', b'\r') 修复
TLS 密钥日志解密: 将 SSLKEYLOGFILE 或 RSA 私钥导入 Wireshark（编辑 → 首选项 → 协议 → TLS）
TLS 弱 RSA: 提取证书，分解模数，使用 rsatool 生成私钥，添加到 Wireshark
USB 音频: 使用 tshark -e usb.iso.data 提取等时数据，在 Audacity 中作为原始 PCM 导入
来自 PCAP 的 NTLMv2: 从 NTLMSSP_AUTH 提取服务器挑战 + NTProofStr + blob，暴力破解

SMB3 解密、凭据提取请参阅 network.md，完整的 TLS/TFTP/USB 工作流程请参阅 linux-forensics.md。

Chrome/Edge: 使用 DPAPI 主密钥通过 AES-GCM 解密 Login Data SQLite
Firefox: 查询 places.sqlite -- SELECT url FROM moz_places WHERE url LIKE '%flag%'

完整的浏览器凭据解密代码请参阅 linux-forensics.md。

附加技术快速参考

Docker 镜像取证: Config JSON 保留了所有 RUN 命令，即使在清理后。tar xf app.tar 然后检查 config blob。请参阅 linux-forensics.md。
Linux 攻击链: 检查 auth.log、.bash_history、最近的二进制文件、PCAP。请参阅 linux-forensics.md。
RAID 5 XOR 恢复: 3 盘 RAID 5 中的两个磁盘 → 逐字节 XOR 以恢复第三个：bytes(a ^ b for a, b in zip(disk1, disk3))。请参阅 disk-and-memory.md。
PowerShell 勒索软件: 从 minidump 中提取脚本，查找 AES 密钥，解密 SMTP 附件。请参阅 disk-and-memory.md。
Linux 勒索软件 + 内存转储: 如果 Volatility 不可靠，通过原始内存候选扫描和魔数验证恢复 AES 密钥；重新干净地提取 zip 以避免丢失文件/假阴性。请参阅 disk-and-memory.md。
已删除分区: testdisk 或 kpartx -av。请参阅 disk-and-memory.md。
ZFS 取证: 重建标签、Fletcher4 校验和、PBKDF2 破解。请参阅 disk-and-memory.md。
硬件信号: VGA/HDMI TMDS/DisplayPort、旅行者号音频、Saleae UART 解码、Flipper Zero。请参阅 signals-and-hardware.md。
USB HID 鼠标绘图: 根据绘图模式将相对 HID 移动渲染为位图；分离模式，跳过提笔，缩放 5-8 倍。请参阅 network-advanced.md。
侧信道功耗分析: 多维功耗轨迹（位置 × 猜测 × 轨迹 × 样本）。跨轨迹平均，找到方差最大的样本，选择在泄漏点功耗最大的猜测。请参阅 signals-and-hardware.md。
数据包间隔时间: 二进制数据编码为 PCAP 中的数据包间延迟。两个间隔值 = 两个比特值。请参阅 network-advanced.md。
BMP 位平面 QR: 使用 NumPy 提取每个 RGB 通道的位平面 0-2；隐藏的 QR 码通常在位 1（而不是位 0）。请参阅 stego-image.md。
图像拼图重组: 碎片边框之间的像素差异进行边缘匹配，在网格中贪婪放置。请参阅 stego-image.md。
音频 FFT 音符: 主导频率 → 音符名称 (A-G) 拼出单词。请参阅 stego-advanced.md。
音频元数据八进制: Exiftool 注释中带下划线分隔的八进制数字 → 解码为 ASCII/base64。请参阅 stego-advanced.md。
G 代码可视化: 侧投影 (XZ/YZ) 显示文本。请参阅 3d-printing.md。
Git 目录恢复: 针对暴露的 .git 目录使用 gitdumper.sh。请参阅 linux-forensics.md。
KeePass v4 破解: 标准 keepass2john 不支持 v4/Argon2；使用 ivanmrsulja/keepass2john 分支或 keepass4brute。使用 cewl 生成单词列表。请参阅 linux-forensics.md。
跨通道多位 LSB: 每个 RGB 通道的不同比特位置 (R[0], G[1], B[2]) 编码隐藏数据。请参阅 stego-advanced.md。
F5 JPEG DCT 检测: ±1 与 ±2 AC 系数的比率从 ~3:1 下降到 ~1:1（使用 F5 时）；稀疏图像需要辅助的 ±2/±3 度量。请参阅 stego-image.md。
PNG 未使用的调色板隐写: 未使用的 PLTE 条目（未被像素引用）在红色通道值中携带隐藏数据。请参阅 stego-image.md。
键盘声学侧信道: 来自击键音频的 MFCC 特征 + 针对标记参考的 KNN 分类。10ms 窗口捕捉冲击瞬态。请参阅 signals-and-hardware.md。
TCP 标志隐蔽信道: 6 个 TCP 标志位 (FIN/SYN/RST/PSH/ACK/URG) = 值 0-63，编码 base64 字符。在一致的目标端口上出现无意义的标志组合 = 隐蔽数据。请参阅 network-advanced.md。
Brotli 解压炸弹接缝: 压缩炸弹有重复块；标志在接缝处打破模式。比较相邻块以找到不连续性，仅解压该区域。请参阅 network-advanced.md。
Git reflog/fsck squash 恢复: git rebase --squash 留下可通过 git fsck --unreachable --no-reflogs 恢复的孤立对象。请参阅 linux-forensics.md。
DNS 尾随字节二进制: 附加在 DNS 问题结构之后的额外字节 (0x30/0x31) 编码二进制比特；8 位 MSB 优先块 → ASCII。请参阅 network-advanced.md。
伪造 TLS + mDNS 密钥 + 可打印字符合并: 伪装成 TLS 的 TCP 流隐藏 ZIP；来自 mDNS TXT 记录的 XOR 密钥；通过选择可打印字符合并两个解密数组。请参阅 network-advanced.md。
基于种子的像素排列隐写: 确定性像素洗牌（带已知种子的 Fisher-Yates）+ 从 Y 通道提取的多位平面交错 LSB → 隐藏的 QR 码。请参阅 stego-image.md。
BTRFS 快照恢复: 已删除的文件在 BTRFS 快照/替代子卷中持续存在。mount -o subvol=@backup 访问历史副本。请参阅 disk-recovery.md。
JPEG XL TOC 排列: JXL 的渐进式 TOC 排列控制在部分解码期间瓦片的收敛顺序。在递增的偏移量处截断，测量哪些瓦片先收敛 → 收敛顺序编码标志。请参阅 stego-advanced.md。
Kitty 终端图形: ESC_G 协议将 zlib 压缩的 RGB 图像数据嵌入 base64 块中。剥离转义序列，连接，解压，重建。请参阅 steganography.md。
ANSI 转义序列隐写: 标志文本交错在 ANSI 颜色代码和盲文字符之间。渲染时不可见；通过剥离转义序列和非 ASCII 字符提取。请参阅 steganography.md。
自动立体图求解: 复制图层，差值混合，水平移动约 100 像素以显示隐藏的 3D 文本。请参阅 steganography.md。
两层字节+行交错: 两个文件先字节交错，然后扫描线交错。先解交错偶/奇字节（有效图像），然后解交错偶/奇行。请参阅 steganography.md。
SMB RID 回收: 访客认证 + 带递增 RID 的 LSARPC LsaLookupSids 从 PCAP 枚举 AD 账户。请参阅 network-advanced.md。
Timeroasting (MS-SNTP): 带有机器 RID 的 NTP 请求从 DC 提取 HMAC-MD5 哈希；使用 hashcat -m 31300 破解。请参阅 network-advanced.md。
Android 取证: 使用 adb pull 提取 APK，使用 apktool 分析，检查 /data/data/<package>/ 中的 shared_prefs/ 和 SQLite 数据库。请参阅 disk-and-memory.md。
Docker 容器取证: docker save 导出分层 tar；已删除的文件在早期层中持续存在。docker history --no-trunc 揭示构建秘密。请参阅 disk-and-memory.md。
云存储取证: S3/GCP/Azure 版本控制保留已删除的对象。list-object-versions 恢复已删除的标志。请参阅 disk-and-memory.md。
APFS 快照恢复: 写时复制文件系统在快照中保留历史文件状态；使用带有不同 XID 块偏移量的 icat 跨事务 ID 读取 inode。请参阅 disk-and-memory.md。
Windows KAPE 分类: 预收集的工件 ZIP；从 PowerShell 历史记录 → Amcache → MFT → 注册表配置单元开始。请参阅 disk-and-memory.md。
WordPerfect 宏 XOR: .wcm 文件包含带有嵌入加密数据的宏；XOR 公式 (a+b)-2*(a&b) = 按位 XOR。请参阅 disk-and-memory.md。
来自核心转储的 TLS 主密钥: 在核心转储中搜索会话 ID（来自 Wireshark 握手）；读取其前的 48 字节作为主密钥。创建 Wireshark 预主密钥日志文件。请参阅 network.md。
损坏的 git blob 修复: 单字节损坏会改变 SHA-1；暴力破解每个字节位置（256 × 文件大小）并使用 git hash-object 验证。请参阅 linux-forensics.md。
从 PCAP 重组拆分归档: 相同大小的 HTTP 传输文件，带有 MD5 哈希名称，是归档片段；按 Apache 目录列表时间戳排序，连接，从 TCP 聊天流中提取密码。请参阅 network.md。
视频帧累积: 在不同位置闪烁图像的视频；合成所有帧（每像素最大值）显示隐藏的 QR 码或图像。请参阅

🇺🇸English

CTF Forensics & Blockchain

Quick reference for forensics CTF challenges. Each technique has a one-liner here; see supporting files for full details.

Additional Resources

3d-printing.md - 3D printing forensics (PrusaSlicer binary G-code, QOIF, heatshrink)
windows.md - Windows forensics (registry, SAM, event logs, recycle bin, NTFS alternate data streams, USN journal, PowerShell history, Defender MPLog, WMI persistence, Amcache)
network.md - Network forensics basics (tcpdump, TLS/SSL keylog decryption, TLS master key extraction from coredump, Wireshark, PCAP, port scanning, SMB3 decryption, 5G/NR protocols, WordPress recon, credentials, USB HID steno, BCD encoding, HTTP file upload exfiltration, split archive reassembly via timestamp ordering)
network-advanced.md - Advanced network forensics (packet interval timing encoding, USB HID mouse/pen drawing recovery, NTLMv2 hash cracking, TCP flag covert channel, DNS last-byte steganography, DNS trailing byte binary encoding, multi-layer PCAP with XOR + ZIP and mDNS key, Brotli decompression bomb seam analysis, SMB RID recycling via LSARPC, Timeroasting MS-SNTP hash extraction)
disk-and-memory.md - Disk/memory forensics (Volatility, disk mounting/carving, VM/OVA/VMDK, coredumps, deleted partitions, ZFS, VMware snapshots, ransomware analysis, GPT GUID encoding, VMDK sparse parsing, APFS snapshot recovery, Windows KAPE triage, WordPerfect macro XOR extraction, minidump ISO 9660 recovery, RAID 5 XOR recovery, Android forensics, Docker container forensics, cloud storage forensics)
disk-recovery.md - Disk recovery and extraction patterns (LUKS master key recovery, PRNG timestamp seed brute-force, VBA macro binary recovery, FemtoZip decompression, XFS filesystem reconstruction, tar duplicate entry extraction, nested matryoshka filesystem extraction, anti-carving via null byte interleaving, BTRFS subvolume/snapshot recovery, FAT16 free space data recovery, ext2 orphaned inode recovery via fsck)
steganography.md - General steganography (binary border stego, PDF multi-layer stego, SVG keyframes, PNG reorder, file overlays, GIF frame diff Morse code, GZSteg + spammimic, spreadsheet frequency recovery, Kitty terminal graphics protocol decoding, ANSI escape sequence steganography, autostereogram solving, two-layer byte+line interleaving, multi-stream video container stego)
stego-image.md - Image-specific steganography (JPEG unused DQT table LSB, BMP bitplane QR extraction, image puzzle reassembly, F5 JPEG DCT ratio detection, PNG unused palette entry stego, QR code tile reconstruction, seed-based pixel permutation + multi-bitplane QR, JPEG thumbnail pixel-to-text mapping, conditional LSB with pixel filtering, JPEG slack space, nearest-neighbor interpolation stego, RGB parity steganography)
stego-advanced.md - Advanced steganography (FFT frequency domain, DTMF audio, SSTV+LSB, custom frequency dual-tone keypad, multi-track audio differential subtraction, cross-channel multi-bit LSB, audio FFT musical notes, audio metadata octal encoding, nested tar whitespace encoding, audio waveform binary encoding, audio spectrogram hidden QR, video frame accumulation, reversed audio, JPEG XL TOC permutation steganography)
linux-forensics.md - Linux/app forensics (log analysis, Docker image forensics, attack chains, browser credentials, Firefox history, TFTP, TLS weak RSA, USB audio, Git directory recovery, KeePass v4 cracking, Git reflog/fsck squash recovery, browser artifact analysis (Chrome/Chromium/Firefox history, cookies, downloads, local storage, session restore), corrupted git blob repair via byte brute-force, VBA macro Excel cell data to ELF binary extraction)
signals-and-hardware.md - Hardware signal decoding with decode code (VGA frame parsing, HDMI TMDS symbol decode, DisplayPort 8b/10b + LFSR descrambler), Voyager Golden Record audio, Saleae Logic 2 UART decode, Flipper Zero .sub files, side-channel power analysis (DPA), keyboard acoustic side-channel, CD audio disc image steganography (CIRC de-interleaving + spiral rendering), Linux input_event keylogger dump parsing

Quick Start Commands

# File analysis
file suspicious_file
exiftool suspicious_file     # Metadata
binwalk suspicious_file      # Embedded files
strings -n 8 suspicious_file
hexdump -C suspicious_file | head  # Check magic bytes

# Disk forensics
sudo mount -o loop,ro image.dd /mnt/evidence
fls -r image.dd              # List files
photorec image.dd            # Carve deleted files

# Memory forensics (Volatility 3)
vol3 -f memory.dmp windows.info
vol3 -f memory.dmp windows.pslist
vol3 -f memory.dmp windows.filescan

See disk-and-memory.md for full Volatility plugin reference, VM forensics, and coredump analysis.

Log Analysis

grep -iE "(flag|part|piece|fragment)" server.log     # Flag fragments
grep "FLAGPART" server.log | sed 's/.*FLAGPART: //' | uniq | tr -d '\n'  # Reconstruct
sort logfile.log | uniq -c | sort -rn | head         # Find anomalies

See linux-forensics.md for Linux attack chain analysis and Docker image forensics.

Windows Event Logs (.evtx)

Key Event IDs:

1001 - Bugcheck/reboot
1102 - Audit log cleared
4720 - User account created
4781 - Account renamed

RDP Session IDs (TerminalServices-LocalSessionManager):

21 - Session logon succeeded
24 - Session disconnected
1149 - RDP auth succeeded (RemoteConnectionManager, has source IP)

import Evtx.Evtx as evtx with evtx.Evtx("Security.evtx") as log: for record in log.records(): print(record.xml())

See windows.md for full event ID tables, registry analysis, SAM parsing, USN journal, and anti-forensics detection.

NTFS Alternate Data Streams (ADS): Hidden data attached to files via named NTFS streams. Invisible to dir/Explorer. Detect with fls -r image.dd | grep ":", extract with icat. See windows.md.

When Logs Are Cleared

If attacker cleared event logs, use these alternative sources:

USN Journal ($J) - File operations timeline (MFT ref, timestamps, reasons)
SAM registry - Account creation from key last_modified timestamps
PowerShell history - ConsoleHost_history.txt (USN DATA_EXTEND = command timing)
Defender MPLog - Separate log with threat detections and ASR events
Prefetch - Program execution evidence
User profile creation - First login time (profile dir in USN journal)

See windows.md for detailed parsing code and anti-forensics detection checklist.

Steganography

steghide extract -sf image.jpg
zsteg image.png              # PNG/BMP analysis
stegsolve                    # Visual analysis

Binary border stego: Black/white pixels in 1px image border encode bits clockwise
FFT frequency domain: Image data hidden in 2D FFT magnitude spectrum; try np.fft.fft2 visualization
DTMF audio: Phone tones encoding data; decode with multimon-ng -a DTMF
Multi-layer PDF: Check hidden comments, post-EOF data, XOR with keywords, ROT18 final layer
SSTV + LSB: SSTV signal may be red herring; check 2-bit LSB of audio samples with stegolsb
SVG keyframes: Animation keyTimes/values attributes encode binary/Morse via fill color alternation
PNG chunk reorder: Fix chunk order: IHDR → ancillary → IDAT (in order) → IEND
Check after IEND for appended archives with overwritten magic bytes

See steganography.md and stego-advanced.md for full code examples and decoding workflows.

PDF Analysis

exiftool document.pdf        # Metadata (often hides flags!)
pdftotext document.pdf -     # Extract text
strings document.pdf | grep -i flag
binwalk document.pdf         # Embedded files

Advanced PDF stego (Nullcon 2026 rdctd): Six techniques -- invisible text separators, URI annotations with escaped braces, Wiener deconvolution on blurred images, vector rectangle QR codes, compressed object streams (mutool clean -d), document metadata fields.

See steganography.md for full PDF steganography techniques and code.

Disk / VM / Memory Forensics

# Disk images
sudo mount -o loop,ro image.dd /mnt/evidence
fls -r image.dd && photorec image.dd

# VM images (OVA/VMDK)
tar -xvf machine.ova
7z x disk.vmdk -oextracted "Windows/System32/config/SAM" -r

# Memory (Volatility 3)
vol3 -f memory.dmp windows.pslist
vol3 -f memory.dmp windows.cmdline
vol3 -f memory.dmp windows.netscan
vol3 -f memory.dmp windows.dumpfiles --physaddr <addr>

# String carving
strings -a -n 6 memdump.bin | grep -E "FLAG|SSH_CLIENT|SESSION_KEY"

# Coredump
gdb -c core.dump  # info registers, x/100x $rsp, find "flag"

See disk-and-memory.md for full Volatility plugin reference, VM forensics, VMware snapshots, deleted partition recovery, ZFS forensics, and ransomware analysis.

Windows Password Hashes

# Extract with impacket, crack with hashcat -m 1000
python -c "from impacket.examples.secretsdump import *; SAMHashes('SAM', LocalOperations('SYSTEM').getBootKey()).dump()"

See windows.md for SAM details and network-advanced.md for NTLMv2 cracking from PCAP.

Bitcoin Tracing

Use mempool.space API: https://mempool.space/api/tx/<TXID>
Peel chain: ALWAYS follow LARGER output; round amounts indicate peels

Uncommon File Magic Bytes

Magic	Format	Extension	Notes
`OggS`	Ogg container	`.ogg`	Audio/video
`RIFF`	RIFF container	`.wav`,`.avi`	Check subformat
`%PDF`	PDF	`.pdf`

Common Flag Locations

PDF metadata fields (Author, Title, Keywords)
Image EXIF data
Deleted files (Recycle Bin $R files)
Registry values
Browser history
Log file fragments
Memory strings

WMI Persistence Analysis

Pattern (Backchimney): Malware uses WMI event subscriptions for persistence (MITRE T1546.003).

python PyWMIPersistenceFinder.py OBJECTS.DATA

Look for FilterToConsumerBindings with CommandLineEventConsumer
Base64-encoded PowerShell in consumer commands
Event filters triggered on system events (logon, timer)

See windows.md for WMI repository analysis details.

Network Forensics Quick Reference

TFTP netascii: Binary transfers corrupted; fix with data.replace(b'\r\n', b'\n').replace(b'\r\x00', b'\r')
TLS keylog decryption: Import SSLKEYLOGFILE or RSA private key into Wireshark (Edit → Preferences → Protocols → TLS)
TLS weak RSA: Extract cert, factor modulus, generate private key with rsatool, add to Wireshark
USB audio: Extract isochronous data with tshark -e usb.iso.data, import as raw PCM in Audacity
NTLMv2 from PCAP: Extract server challenge + NTProofStr + blob from NTLMSSP_AUTH, brute-force

See network.md for SMB3 decryption, credential extraction, and linux-forensics.md for full TLS/TFTP/USB workflows.

Browser Forensics

Chrome/Edge: Decrypt Login Data SQLite with AES-GCM using DPAPI master key
Firefox: Query places.sqlite -- SELECT url FROM moz_places WHERE url LIKE '%flag%'

See linux-forensics.md for full browser credential decryption code.

Additional Technique Quick References

Docker image forensics: Config JSON preserves ALL RUN commands even after cleanup. tar xf app.tar then inspect config blob. See linux-forensics.md.
Linux attack chains: Check auth.log, .bash_history, recent binaries, PCAP. See linux-forensics.md.
RAID 5 XOR recovery: Two disks of a 3-disk RAID 5 → XOR byte-by-byte to recover the third: bytes(a ^ b for a, b in zip(disk1, disk3)). See disk-and-memory.md.
PowerShell ransomware: Extract scripts from minidump, find AES key, decrypt SMTP attachment. See disk-and-memory.md.
Linux ransomware + memory dump: If Volatility is unreliable, recover AES key via raw-memory candidate scanning and magic-byte validation; re-extract zip cleanly to avoid missing files/false negatives. See .

SMB RID Recycling via LSARPC (Midnight 2026)

Enumerate AD accounts from PCAP by analyzing LSARPC LsaLookupSids calls with sequential RIDs after Guest auth. Filter: dcerpc.cn_bind_to_str contains lsarpc.

See network-advanced.md for full RPC call sequence and Wireshark filters.

Timeroasting / MS-SNTP Hash Extraction (Midnight 2026)

Extract crackable HMAC-MD5 hashes from MS-SNTP responses by sending NTP requests with machine account RIDs. Crack with hashcat -m 31300.

# Extract NTP payloads, convert to hashcat format, crack
tshark -r capture.pcapng -Y "ntp && ip.src == <DC_IP>" -T fields -e udp.payload
hashcat -m 31300 -a 0 -O hashes.txt rockyou.txt --username

See network-advanced.md for payload parsing script and full attack chain.

HTTP Exfiltration in PCAP

Quick path: tshark --export-objects http,/tmp/objects extracts uploaded files instantly. Check for multipart POST uploads, unusual User-Agent strings, and exfiltrated files (images with flag text). See network.md.

Common Encodings

echo "base64string" | base64 -d
echo "hexstring" | xxd -r -p
# ROT13: tr 'A-Za-z' 'N-ZA-Mn-za-m'

ROT18: ROT13 on letters + ROT5 on digits. Common final layer in multi-stage forensics. See linux-forensics.md for implementation.

Weekly Installs

697

Repository

ljagiello/ctf-skills

GitHub Stars

694

First Seen

Feb 1, 2026

Security Audits

Gen Agent Trust HubPass SocketWarn SnykFail

Installed on

codex682

opencode681

github-copilot670

gemini-cli668

amp667

kimi-cli666

Excel财务建模规范与xlsx文件处理指南：专业格式、零错误公式与数据分析

38,100 周安装

Custom freq DTMF: Non-standard dual-tone frequencies; generate spectrogram first (ffmpeg -i audio -lavfi showspectrumpic), map custom grid to keypad digits, decode variable-length ASCII

JPEG DQT LSB: Unused quantization tables (ID 2, 3) carry LSB-encoded data; access via Image.open().quantization and extract bit 0 from each of 64 values

Multi-track audio subtraction: Two nearly-identical audio tracks in MKV/video; sox -m a0.wav "|sox a1.wav -p vol -1" diff.wav cancels shared content, flag appears in spectrogram of difference signal (5-12 kHz band)

Packet interval timing: Identical packets with two distinct interval values (e.g., 10ms/100ms) encode binary; filter by interface, compute inter-packet deltas, threshold to bits

Deleted partitions: testdisk or kpartx -av. See disk-and-memory.md.

ZFS forensics: Reconstruct labels, Fletcher4 checksums, PBKDF2 cracking. See disk-and-memory.md.

Hardware signals: VGA/HDMI TMDS/DisplayPort, Voyager audio, Saleae UART decode, Flipper Zero. See signals-and-hardware.md.

USB HID mouse drawing: Render relative HID movements per draw mode as bitmap; separate modes, skip pen lifts, scale 5-8x. See network-advanced.md.

Side-channel power analysis: Multi-dimensional power traces (positions × guesses × traces × samples). Average across traces, find sample with max variance, select guess with max power at leak point. See signals-and-hardware.md.

Packet interval timing: Binary data encoded as inter-packet delays in PCAP. Two interval values = two bit values. See network-advanced.md.

BMP bitplane QR: Extract bitplanes 0-2 per RGB channel with NumPy; hidden QR often in bit 1 (not bit 0). See stego-image.md.

Image puzzle reassembly: Edge-match pixel differences between piece borders, greedy placement in grid. See stego-image.md.

Audio FFT notes: Dominant frequencies → musical note names (A-G) spell words. See stego-advanced.md.

Audio metadata octal: Exiftool comment with underscore-separated octal numbers → decode to ASCII/base64. See stego-advanced.md.

G-code visualization: Side projections (XZ/YZ) reveal text. See 3d-printing.md.

Git directory recovery: gitdumper.sh for exposed .git dirs. See linux-forensics.md.

KeePass v4 cracking: Standard keepass2john lacks v4/Argon2 support; use ivanmrsulja/keepass2john fork or keepass4brute. Generate wordlists with cewl. See linux-forensics.md.

Cross-channel multi-bit LSB: Different bit positions per RGB channel (R[0], G[1], B[2]) encode hidden data. See stego-advanced.md.

F5 JPEG DCT detection: Ratio of ±1 to ±2 AC coefficients drops from ~3:1 to ~1:1 with F5; sparse images need secondary ±2/±3 metric. See stego-image.md.

PNG unused palette stego: Unused PLTE entries (not referenced by pixels) carry hidden data in red channel values. See stego-image.md.

Keyboard acoustic side-channel: MFCC features from keystroke audio + KNN classification against labeled reference. 10ms window captures impact transient. See signals-and-hardware.md.

TCP flag covert channel: 6 TCP flag bits (FIN/SYN/RST/PSH/ACK/URG) = values 0-63, encoding base64 characters. Nonsensical flag combos on a consistent dest port = covert data. See network-advanced.md.

Brotli decompression bomb seam: Compressed bomb has repeating blocks; flag breaks the pattern at a seam. Compare adjacent blocks to find discontinuity, decompress only that region. See network-advanced.md.

Git reflog/fsck squash recovery: git rebase --squash leaves orphaned objects recoverable via git fsck --unreachable --no-reflogs. See linux-forensics.md.

DNS trailing byte binary: Extra bytes (0x30/0x31) appended after DNS question structure encode binary bits; 8-bit MSB-first chunks → ASCII. See network-advanced.md.

Fake TLS + mDNS key + printability merge: TCP stream disguised as TLS hides ZIP; XOR key from mDNS TXT record; merge two decrypted arrays by selecting printable characters. See network-advanced.md.

Seed-based pixel permutation stego: Deterministic pixel shuffle (Fisher-Yates with known seed) + multi-bitplane interleaved LSB extraction from Y channel → hidden QR code. See stego-image.md.

BTRFS snapshot recovery: Deleted files persist in BTRFS snapshots/alternate subvolumes. mount -o subvol=@backup accesses historical copies. See disk-recovery.md.

JPEG XL TOC permutation: JXL's progressive TOC permutation controls tile convergence order during partial decode. Truncate at increasing offsets, measure which tiles converge first → convergence order encodes flag. See stego-advanced.md.

Kitty terminal graphics: ESC_G protocol embeds zlib-compressed RGB image data in base64 chunks. Strip escape sequences, concatenate, decompress, reconstruct. See steganography.md.

ANSI escape sequence stego: Flag text interleaved between ANSI color codes and braille characters. Invisible when rendered; extract by stripping escape sequences and non-ASCII. See steganography.md.

Autostereogram solving: Duplicate layer, difference blend, shift horizontally ~100px to reveal hidden 3D text. See steganography.md.

Two-layer byte+line interleaving: Two files byte-interleaved, then scanlines interleaved. Deinterleave even/odd bytes first (valid images), then even/odd lines. See steganography.md.

SMB RID recycling: Guest auth + LSARPC LsaLookupSids with incrementing RIDs enumerates AD accounts from PCAP. See network-advanced.md.

Timeroasting (MS-SNTP): NTP requests with machine RIDs extract HMAC-MD5 hashes from DC; crack with hashcat -m 31300. See network-advanced.md.

Android forensics: Extract APK with adb pull, analyze with apktool, check shared_prefs/ and SQLite databases in /data/data/<package>/. See disk-and-memory.md.

Docker container forensics: docker save exports layered tars; deleted files persist in earlier layers. docker history --no-trunc reveals build secrets. See disk-and-memory.md.

Cloud storage forensics: S3/GCP/Azure versioning preserves deleted objects. list-object-versions recovers deleted flags. See disk-and-memory.md.

APFS snapshot recovery: Copy-on-write filesystem preserves historical file states in snapshots; use icat with different XID block offsets to read inodes across transaction IDs. See disk-and-memory.md.

Windows KAPE triage: Pre-collected artifact ZIPs; start with PowerShell history → Amcache → MFT → registry hives. See disk-and-memory.md.

WordPerfect macro XOR: .wcm files contain macros with embedded encrypted data; XOR formula (a+b)-2*(a&b) = bitwise XOR. See disk-and-memory.md.

TLS master key from coredump: Search coredump for session ID (from Wireshark handshake); read 48 bytes before it as master key. Create Wireshark pre-master-secret log file. See network.md.

Corrupted git blob repair: Single-byte corruption changes SHA-1; brute-force each byte position (256 × file_size) verifying with git hash-object. See linux-forensics.md.

Split archive reassembly from PCAP: Same-sized HTTP-transferred files with MD5-hash names are archive fragments; order by Apache directory listing timestamps, concatenate, extract password from TCP chat stream. See network.md.

Video frame accumulation: Video with flashing images at various positions; composite all frames (per-pixel maximum) reveals hidden QR code or image. See stego-advanced.md.

Reversed audio: Garbled audio that sounds like speech played backwards; sox audio.wav reversed.wav reverse or Audacity Effect → Reverse reveals hidden message. See stego-advanced.md.

Multi-stream video container stego: MP4/MKV with multiple video streams; default stream is a red herring, flag in secondary stream. ffprobe -hide_banner file.mp4 to enumerate, ffmpeg -i file.mp4 -map 0:1 -frames:v 1 flag.jpg to extract. See steganography.md.

FAT16 free space recovery: Flag hidden in unallocated clusters of FAT16 filesystem. Parse FAT table, enumerate free clusters (entry = 0x0000), read data region. See disk-recovery.md.

Ext2 orphaned inode recovery: Deleted file leaves orphaned inode; e2fsck -y disk.img reconnects to /lost+found. Also use debugfs lsdel or icat. See disk-recovery.md.

Linux input_event keylogger parsing: 24-byte struct input_event binary dump; filter type==1 (EV_KEY), value==1 (press), map keycodes via input-event-codes.h. See signals-and-hardware.md.

VBA macro cell data to binary: Excel cells with numeric values; VBA CByte((val-78)/3) transforms to ELF bytes. Reimplement in Python, never run the macro. See linux-forensics.md.

RGB parity steganography: Sum R+G+B per pixel; even=white, odd=black renders hidden binary bitmap. See stego-image.md.