ctf-web

# CTF Web Exploitation Use this skill as a routing and execution guide for web-heavy challenges. Keep the first pass short: map the app, confirm the trust boundary, and only then dive into the detailed technique notes. ## Prerequisites **Python packages (all platforms):** ```bash pip install sqlmap flask-unsign requests ``` **Linux (apt):** ```bash apt install hashcat jq curl ``` **macOS (Homebrew):** ```bash brew install hashcat jq curl ``` **Go tools (all platforms, requires Go):** ```bash go install github.com/ffuf/ffuf/v2@latest ``` **Manual install:** - ysoserial — [GitHub](https://github.com/frohoff/ysoserial), requires Java (Java deserialization payloads) ## Additional Resources - [sql-injection.md](sql-injection.md) - SQL injection techniques: auth bypass, UNION extraction, filter bypasses, second-order SQLi, truncation, race-assisted leaks, INSERT ON DUPLICATE KEY UPDATE password overwrite, innodb_table_stats WAF bypass - [server-side.md](server-side.md) - SSTI, SSRF, XXE, command injection, PHP quirks, GraphQL injection, XML injection, Vue.js template injection via constructor chaining - [server-side-exec.md](server-side-exec.md) - Direct code execution paths, upload-to-RCE, deserialization-adjacent execution, LaTeX injection, header and API abuses - [server-side-exec-2.md](server-side-exec-2.md) - More execution chains: SQLi fragmentation, path parser tricks, polyglot uploads, wrapper abuse, filename injection, BMP pixel webshell with filename truncation -...