Agent Skills
› zhaoxuya520/reverse-skill
› competition-request-normalization-smuggling
competition-request-normalization-smuggling
GitHub用于CTF沙箱环境中分析请求在代理、网关及后端各层解析差异的技能。重点排查路径规范化漂移、HTTP头歧义、传输分帧不匹配及请求走私路由问题，通过复现最小差异请求证明解析分歧点。
Trigger Scenarios
用户要求追踪代理与后端解析差异
涉及Host或转发头歧义分析
检查CL/TE传输分帧问题
探究跨跳点路由结果不一致
Install
npx skills add zhaoxuya520/reverse-skill --skill competition-request-normalization-smuggling -g -y
SKILL.md
Frontmatter
{
"name": "competition-request-normalization-smuggling",
"description": "Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for parser differentials, HTTP normalization gaps, ambiguous headers, path decoding drift, transfer-framing mismatches, and request smuggling routes. Use when the user asks to trace proxy and backend parse differences, conflicting path normalization, Host or forwarded-header ambiguity, CL\/TE issues, or routing outcomes that differ across hops. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here."
}
Competition Request Normalization Smuggling
Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.
Use this skill when request interpretation changes between proxy, middleware, and backend parser layers.
Reply in Simplified Chinese unless the user explicitly requests English.
Quick Start
- Map every parsing hop: client-facing proxy, gateway, app server, and downstream service.
- Record path normalization, header canonicalization, transfer framing, and host derivation at each hop.
- Capture one accepted baseline request and one differential request with minimal delta.
- Prove which hop interprets the request differently.
- Reproduce one minimal differential path that yields decisive behavior.
Workflow
1. Map Parse And Routing Boundaries
- Record
Host, forwarded headers, path decoding, slash collapsing, dot-segment handling, and case behavior. - Note
Content-Length,Transfer-Encoding, chunk framing, and connection reuse behavior when relevant. - Keep edge parser and backend parser decisions side by side.
2. Prove Differential Interpretation
- Build paired requests that differ in one canonicalization dimension only.
- Capture proxy logs, backend logs, route match, and downstream request shape.
- Show where route, auth scope, or body boundary diverges.
3. Reduce To Decisive Smuggling Chain
- Compress to: crafted request -> parser differential across hops -> unintended routed request or hidden endpoint reach -> resulting effect.
- State whether root cause is path normalization drift, header ambiguity, transfer framing differential, or host-derivation confusion.
- If the chain becomes primarily runtime routing without framing tricks, hand off to runtime routing skill.
Read This Reference
- Load
references/request-normalization-smuggling.mdfor parse-differential checklist and evidence packaging.
What To Preserve
- Raw request pairs, hop-by-hop interpretation, and final routed target
- Exact normalization or framing delta that flips behavior
- One minimal replayable differential request path
Version History
- 1bec1f2 Current 2026-07-05 18:45
