ctf-web
ljagiello/ctf-skills / ctf-web
guides you through XSS, SQLi, SSTI and JWT , which improves: helps you solve web CTF challenges faster
Details
- judge’s score
- 8/10
- place
- outside the packs
- publisher
- ljagiello
- status
- new
- pinned commit
- 1fdf188 on GitHub (new tab)
- skill’s last commit
- Oct 19, 2026
- repo stars
- 3,483
- main type
- Website
Judgement
Precise triggering (web CTF targets, clear exclusions). Content rich in techniques and CVEs, with concrete commands. Broad scope (CTF, not everyday development use) and appendices on older writeups; quality pulled down by density and scattering.
reservations
- Geared toward CTF competition (writeups from 2012-2026): of little interest for production web development.
- Appendices truncated when read (auth-and-access, auth-infra, auth-jwt, auth-and-access-2): partial assessment of their content.
- Several cited appendices (client-side, server-side, cves, field-notes, etc.) were only partially assessed; some techniques are dated or very specific to a challenge.
- Optional prerequisites (PAT, Burp MCP, Playwright) must be installed manually, making the skill fragile outside the intended environment.
- Triggering
- 2/2
- Added value
- 2/2
- Precision
- 2/2
- Scope
- 1/2
- Quality
- 1/2
Alerts
5 alerts, by category
Network
- high risk
Instructions clone PayloadsAllTheThings from GitHub unpinned (git clone --depth 1) and then run installation scripts, with no integrity check.
- high risk
Encourages sending data (cookies, flags, outputs) to the third-party service webhook.site for exfiltration, with no warning about confidentiality.
Static scan
- info risk
allowed-tools frontmatter
Bash Read Write Edit Glob Grep Task WebFetch WebSearch Skill
- info risk
bundled scripts, not run by the SKILL.md
scripts/async_fuzz.py
Other
- info risk
Recipes for brute-forcing logins and offensive exploitation without an explicitly authorized scope.
Original description
Provides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, identity flow, or smart-contract frontend/backend surface, including XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, request smuggling, OAut…
added on Oct 19, 2026 · license MIT