ctf-web

This skill is not covert malware, but it is a high-risk offensive exploitation playbook for AI agents. Its capabilities honestly match its CTF purpose, yet it includes explicit exfiltration endpoints, AI jailbreak/system-prompt extraction guidance, and broad exploit execution instructions, making it dangerous to deploy outside tightly scoped, consented CTF use.

This fragment is Markdown documentation, not executable malware, but it contains actionable instructions for harvesting plaintext credentials, extracting managed-host secrets, and achieving command execution through TeamCity build configuration. The PHP example writes usernames and passwords to `/dev/shm/creds.txt`; the TeamCity example runs a command and retrieves its output. No external domain or IP is specified, and no malicious behavior occurs merely by reading this fragment. Severity is elevated for use or deployment in an unauthorized context, while runtime malware risk from this fragment alone is low.

The fragment is an offensive web-security testing guide that includes a functioning concurrent login brute-forcer and numerous exploit examples. The script reads credentials from /usr/share/wordlists/metasploit/http_default_userpass.txt, posts them to the configured http://target/login endpoint, and prints successful credentials; its default password function sends plaintext. No persistence, destructive behavior, suspicious fixed domain, or package-installation payload is visible. Severity is high for unauthorized use against a real target, but the fragment does not itself establish malicious package malware.

This fragment is an offensive web exploitation guide with concrete payloads for XSS, admin-bot compromise, local GraphQL data extraction, timing leaks, and request smuggling. Examples target cookies, passwords, flags, and page content and show exfiltration to webhook[.]site and attacker[.]com or through same-origin uploads. The visible fragment is instructional text and does not demonstrate automatic execution or package-level malware; severity is high if its examples are deployed against systems without authorization, while evidence of malicious behavior in the package itself is limited.

This code fragment is an active web fuzzing/exploitation toolkit (Intruder/Reclab-like): it reads wordlists from disk, transforms payloads through a rule engine, injects them into HTTP requests, evaluates responses for likely ‘hits’, can spray headers/params with cookies/JWTs, and supports out-of-band callback detection via collaborator-style subdomain injection and polling. While it does not obviously contain stealthy backdoor logic (no process/file/secret exfiltration from the running host is shown), it is highly actionable offensive tooling, making it a substantial supply-chain security risk due to straightforward repurposing for unauthorized scanning/exploitation.

The provided code fragment is highly indicative of malicious exploit tooling. It uses SSRF to smuggle raw TCP via gopher, performs time-based blind SQL injection against an internal MySQL service, and reconstructs a secret (flag) by measuring induced delays from SLEEP(3). This is not consistent with legitimate supply-chain dependency behavior and presents a critical security risk if present in a published package.

The fragment is strongly indicative of an exploit/abuse pattern: it injects CRLF-delimited extra HTTP headers and even a second raw HTTP request into the SoapClient user_agent, then triggers transmission via __soapCall. While it does not show broader malware behavior (persistence/exfiltration), it is a high-risk network-layer attack primitive and should be treated as dangerous if it exists in any dependency or is reachable from untrusted input.