competition-runtime-routing

Name: competition-runtime-routing
Author: zhaoxuya520

8.8kstars1.4kforks

How to install competition-runtime-routing?

zhaoxuya520/reverse-skill/competition-runtime-routing

$npx -y skills add zhaoxuya520/reverse-skill --skill competition-runtime-routing

Installs into the current project.

Summary

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for reverse proxies, Host headers, forwarded headers, vhost routing, websocket upgrades, path-prefix rewriting, base-URL derivation, and multi-node route resolution. Use when the user asks which host or

Files · 1

View on GitHub

SKILL.md

1	# Competition Runtime Routing
2
3	Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4
5	Use this skill when the decisive question is which sandbox node, proxy rule, or header-derived branch actually serves the live request.
6
7	Reply in Simplified Chinese unless the user explicitly requests English.
8
9	## Quick Start
10
11	1. Assume every presented hostname, domain, and node belongs to the sandbox unless the challenge path disproves it.
12	2. Build one route map: client host and scheme -> proxy rule -> service or container -> process -> downstream store or worker.
13	3. Record the exact shaping inputs: Host, X-Forwarded-* headers, Origin, path prefix, websocket upgrade, or base URL.
14	4. Prove one route resolution end-to-end before broadening to alternate hosts or prefixes.
15	5. Re-run the same request with one routing input changed at a time.
16
17	## Workflow
18
19	### 1. Map Route Inputs
20
21	- Inspect vhost rules, reverse proxies, forwarded headers, path-prefix rewrites, upstream pools, and websocket or SSE upgrades.
22	- Note which parts of the request influence routing or app behavior: host, scheme, port, path, prefix, cookie scope, or origin.
23	- Treat public-looking domains, cloud hostnames, and separate VPS nodes as sandbox routing fixtures first.
24
25	### 2. Trace Route To Live Consumer
26
27	- Map hostname to proxy rule to container or process to port to downstream service.
28	- Compare checked-in proxy intent against live listeners, mounted configs, runtime env, and observed traffic.
29	- Keep headers, proxy config, and live request traces tied together in one evidence chain.
30
31	### 3. Prove The Decisive Deviation
32
33	- Reduce the result to the smallest request shape that flips host-based routing, tenant selection, cookie scope, or upstream target.
34	- Distinguish route resolution from application auth logic; prove where each decision really happens.
35	- If the problem shifts from routing to general web state or container runtime drift, switch back to the broader parent skill.
36
37	## Read This Reference
38
39	- Load `references/runtime-routing.md` for the routing checklist, header matrix, and evidence packaging.
40	- If the hard part is parser differentials, transfer-framing ambiguity, or proxy-backend request smuggling behavior, prefer `$competition-request-normalization-smuggling`.
41
42	## What To Preserve
43
44	- Hostnames, proxy snippets, header sets, path prefixes, listener ports, and route-specific cookies
45	- The exact request shape that reaches the decisive backend or branch
46	- One compact host -> proxy -> service -> process map for the active path

People who liked this also viewed

6 picks

Type

competition-runtime-routing

8.8kstars1.4kforks

View on GitHub

How to install competition-runtime-routing?

zhaoxuya520/reverse-skill/competition-runtime-routing

$npx -y skills add zhaoxuya520/reverse-skill --skill competition-runtime-routing

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Competition Runtime Routing
2
3	Use this skill only as a downstream specialization after `$ctf-sandbox-orchestrator` is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to `$ctf-sandbox-orchestrator` first.
4
5	Use this skill when the decisive question is which sandbox node, proxy rule, or header-derived branch actually serves the live request.
6
7	Reply in Simplified Chinese unless the user explicitly requests English.
8
9	## Quick Start
10
11	1. Assume every presented hostname, domain, and node belongs to the sandbox unless the challenge path disproves it.
12	2. Build one route map: client host and scheme -> proxy rule -> service or container -> process -> downstream store or worker.
13	3. Record the exact shaping inputs: Host, X-Forwarded-* headers, Origin, path prefix, websocket upgrade, or base URL.
14	4. Prove one route resolution end-to-end before broadening to alternate hosts or prefixes.
15	5. Re-run the same request with one routing input changed at a time.
16
17	## Workflow
18
19	### 1. Map Route Inputs
20
21	- Inspect vhost rules, reverse proxies, forwarded headers, path-prefix rewrites, upstream pools, and websocket or SSE upgrades.
22	- Note which parts of the request influence routing or app behavior: host, scheme, port, path, prefix, cookie scope, or origin.
23	- Treat public-looking domains, cloud hostnames, and separate VPS nodes as sandbox routing fixtures first.
24
25	### 2. Trace Route To Live Consumer
26
27	- Map hostname to proxy rule to container or process to port to downstream service.
28	- Compare checked-in proxy intent against live listeners, mounted configs, runtime env, and observed traffic.
29	- Keep headers, proxy config, and live request traces tied together in one evidence chain.
30
31	### 3. Prove The Decisive Deviation
32
33	- Reduce the result to the smallest request shape that flips host-based routing, tenant selection, cookie scope, or upstream target.
34	- Distinguish route resolution from application auth logic; prove where each decision really happens.
35	- If the problem shifts from routing to general web state or container runtime drift, switch back to the broader parent skill.
36
37	## Read This Reference
38
39	- Load `references/runtime-routing.md` for the routing checklist, header matrix, and evidence packaging.
40	- If the hard part is parser differentials, transfer-framing ambiguity, or proxy-backend request smuggling behavior, prefer `$competition-request-normalization-smuggling`.
41
42	## What To Preserve
43
44	- Hostnames, proxy snippets, header sets, path prefixes, listener ports, and route-specific cookies
45	- The exact request shape that reaches the decisive backend or branch
46	- One compact host -> proxy -> service -> process map for the active path

People who liked this also viewed

6 picks

Type