Awesome CTF

A curated list of Capture The Flag (CTF) frameworks, libraries, resources, softwares and tutorials. This list aims to help starters as well as seasoned CTF players to find everything related to CTFs at one place.

Contributing

Please take a quick look at the contribution guidelines first.

If you know a tool that isn't present here, feel free to open a pull request.

Why?

It takes time to build up collection of tools used in CTF and remember them all. This repo helps to keep all these scattered tools at one place.

Contents

• Awesome CTF
• Create
  • Forensics
  • Platforms
  • Steganography
  • Web

• Solve

  • Attacks
  • Bruteforcers
  • Cryptography
  • Exploits
  • Forensics
  • Networking
  • Reversing
  • Services
  • Steganography
  • Web

• Resources

• Operating Systems
• Starter Packs
• Tutorials
• Wargames
• Websites
• Wikis
• Writeups Collections

Create

Tools used for creating CTF challenges

• Kali Linux CTF Blueprints - Online book on building, testing, and customizing your own Capture the Flag challenges.

Forensics

Tools used for creating Forensics challenges

• Dnscat2 - Hosts communication through DNS.
• Kroll Artifact Parser and Extractor (KAPE) - Triage program.
• Magnet AXIOM - Artifact-centric DFIR tool.
• Registry Dumper - Dump your registry.

Platforms

Projects that can be used to host a CTF

• CTFd - Platform to host jeopardy style CTFs from ISISLab, NYU Tandon.
• echoCTF.RED - Develop, deploy and maintain your own CTF infrastructure.
• FBCTF - Platform to host Capture the Flag competitions from Facebook.
• Haaukins- A Highly Accessible and Automated Virtualization Platform for Security Education.
• HackTheArch - CTF scoring platform.
• Mellivora - A CTF engine written in PHP.
• MotherFucking-CTF - Badass lightweight plaform to host CTFs. No JS involved.
• NightShade - A simple security CTF framework.
• OpenCTF - CTF in a box. Minimal setup required.
• PicoCTF - The platform used to run picoCTF. A great framework to host any CTF.
• PyChallFactory - Small framework to create/manage/package jeopardy CTF challenges.
• RootTheBox - A Game of Hackers (CTF Scoreboard & Game Manager).
• Scorebot - Platform for CTFs by Legitbs (Defcon).
• SecGen - Security Scenario Generator. Creates randomly vulnerable virtual machines.

Steganography

Tools used to create stego challenges

Check solve section for steganography.

Web

Tools used for creating Web challenges

JavaScript Obfustcators

• Metasploit JavaScript Obfuscator
• Uglify

Solve

Tools used for solving CTF challenges

Attacks

Tools used for performing various kinds of attacks

• Bettercap - Framework to perform MITM (Man in the Middle) attacks.
• Yersinia - Attack various protocols on layer 2.

Crypto

Tools used for solving Crypto challenges

• CyberChef - Web app for analysing and decoding data.
• FeatherDuster - An automated, modular cryptanalysis tool.
• Hash Extender - A utility tool for performing hash length extension attacks.
• padding-oracle-attacker - A CLI tool to execute padding oracle attacks.
• PkCrack - A tool for Breaking PkZip-encryption.
• QuipQuip - An online tool for breaking substitution ciphers or vigenere ciphers (without key).
• RSACTFTool - A tool for recovering RSA private key with various attack.
• RSATool - Generate private key with knowledge of p and q.
• XORTool - A tool to analyze multi-byte xor cipher.

Bruteforcers

Tools used for various kind of bruteforcing (passwords etc.)

• Hashcat - Password Cracker
• Hydra - A parallelized login cracker which supports numerous protocols to attack
• John The Jumbo - Community enhanced version of John the Ripper.
• John The Ripper - Password Cracker.
• Nozzlr - Nozzlr is a bruteforce framework, trully modular and script-friendly.
• Ophcrack - Windows password cracker based on rainbow tables.
• Patator - Patator is a multi-purpose brute-forcer, with a modular design.
• Turbo Intruder - Burp Suite extension for sending large numbers of HTTP requests

Exploits

Tools used for solving Exploits challenges

• DLLInjector - Inject dlls in processes.
• libformatstr - Simplify format string exploitation.
• Metasploit - Penetration testing software.
• Cheatsheet
• one_gadget - A tool to find the one gadget execve('/bin/sh', NULL, NULL) call.
• gem install one_gadget
• Pwntools - CTF Framework for writing exploits.
• Qira - QEMU Interactive Runtime Analyser.
• ROP Gadget - Framework for ROP exploitation.
• V0lt - Security CTF Toolkit.

Forensics

Tools used for solving Forensics challenges

• Aircrack-Ng - Crack 802.11 WEP and WPA-PSK keys.
• apt-get install aircrack-ng
• Audacity - Analyze sound files (mp3, m4a, whatever).
• apt-get install audacity
• Bkhive and Samdump2 - Dump SYSTEM and SAM files.
• apt-get install samdump2 bkhive
• CFF Explorer - PE Editor.
• Creddump - Dump windows credentials.
• DVCS Ripper - Rips web accessible (distributed) version control systems.
• Exif Tool - Read, write and edit file metadata.
• Extundelete - Used for recovering lost data from mountable images.
• Fibratus - Tool for exploration and tracing of the Windows kernel.
• Foremost - Extract particular kind of files using headers.
• apt-get install foremost
• Fsck.ext4 - Used to fix corrupt filesystems.
• Malzilla - Malware hunting tool.
• NetworkMiner - Network Forensic Analysis Tool.
• PDF Streams Inflater - Find and extract zlib files compressed in PDF files.
• Pngcheck - Verifies the integrity of PNG and dump all of the chunk-level information in human-readable form.
• apt-get install pngcheck
• ResourcesExtract - Extract various filetypes from exes.
• Shellbags - Investigate NT_USER.dat files.
• Snow - A Whitespace Steganography Tool.
• USBRip - Simple CLI forensics tool for tracking USB device artifacts (history of USB events) on GNU/Linux.
• Volatility - To investigate memory dumps.
• Wireshark - Used to analyze pcap or pcapng files

Registry Viewers - OfflineRegistryView - Simple tool for Windows that allows you to read offline Registry files from external drive and view the desired Registry key in .reg file format. - Registry Viewer® - Used to view Windows registries.

Networking

Tools used for solving Networking challenges

• Masscan - Mass IP port scanner, TCP port scanner.
• Monit - A linux tool to check a host on the network (and other non-network activities).
• Nipe - Nipe is a script to make Tor Network your default gateway.
• Nmap - An open source utility for network discovery and security auditing.
• Wireshark - Analyze the network dumps.
• apt-get install wireshark
• Zeek - An open-source network security monitor.
• Zmap - An open-source network scanner.

Reversing

Tools used for solving Reversing challenges

• Androguard - Reverse engineer Android applications.
• Angr - platform-agnostic binary analysis framework.
• Apk2Gold - Yet another Android decompiler.
• ApkTool - Android Decompiler.
• Barf - Binary Analysis and Reverse engineering Framework.
• Binary Ninja - Binary analysis framework.
• BinUtils - Collection of binary tools.
• BinWalk - Analyze, reverse engineer, and extract firmware images.
• Boomerang - Decompile x86/SPARC/PowerPC/ST-20 binaries to C.
• ctf_import – run basic functions from stripped binaries cross platform.
• cwe_checker - cwe_checker finds vulnerable patterns in binary executables.
• demovfuscator - A work-in-progress deobfuscator for movfuscated binaries.
• Frida - Dynamic Code Injection.
• GDB - The GNU project debugger.
• GEF - GDB plugin.
• Ghidra - Open Source suite of reverse engineering tools. Similar to IDA Pro.
• Hopper - Reverse engineering tool (disassembler) for OSX and Linux.
• IDA Pro - Most used Reversing software.
• Jadx - Decompile Android files.
• Java Decompilers - An online decompiler for Java and Android APKs.
• Krakatau - Java decompiler and disassembler.
• Objection - Runtime Mobile Exploration.
• PEDA - GDB plugin (only python2.7).
• Pin - A dynamic binary instrumentaion tool by Intel.
• PINCE - GDB front-end/reverse engineering tool, focused on game-hacking and automation.
• PinCTF - A tool which uses intel pin for Side Channel Analysis.
• Plasma - An interactive disassembler for x86/ARM/MIPS which can generate indented pseudo-code with colored syntax.
• Pwndbg - A GDB plugin that provides a suite of utilities to hack around GDB easily.
• radare2 - A portabl