competition-custom-protocol-replay

First map the session state machine: identify handshake, authentication, and command phases plus which fields depend on prior messages. Then recover framing and checksums, and build a minimal replay harness that changes one field or message at a time until the server accepts the replayed sequence.

Start with message boundaries: recover lengths, delimiters, and type bytes before interpreting field semantics. Then determine direction, sequence numbers, and integrity fields like checksums or nonces, and compare accepted versus rejected transcripts to find the decisive fields.

Use it when the challenge requires stateful replay, meaning you must reproduce exact message order, sequence counters, or checksum state to reach an accepted branch. If the task is only decoding a capture with no replay requirement, the broader PCAP skill is the better fit.

No. It is a downstream specialization that assumes $ctf-sandbox-orchestrator has already established sandbox assumptions, node ownership, and evidence priorities. If that routing has not happened, return to the orchestrator first.

Rejections usually come from unmet state dependencies: wrong sequence counters, stale nonces, incorrect checksums, or mixing messages from different sessions. Mutate one field at a time against a canonical accepted transcript to isolate the exact field that flips acceptance.