flag{r3s0urc3s}
A curated collection of essential resources for CTF competitions, covering a range of categories such as cryptography, forensics, exploitation, and more.
crypto
-
bkcrack
https://github.com/kimci86/bkcrackOpen source tool to crack legacy zip encryption using known plaintext attacks on PKZIP stream ciphers
-
CacheSleuth
https://www.cachesleuth.com/multidecoder/Multi-decoder tool for various encoding schemes including base64, hex, URL encoding, and many others
-
Ciphey
https://github.com/bee-san/CipheyAutomatically decrypt encryptions without knowing the key or cipher, decode encodings, and crack hashes using AI
-
Crackstation
https://crackstation.net/Massive pre-computed lookup tables to crack password hashes using rainbow tables and hash databases
-
Cryptii
https://cryptii.com/Web-based application for encoding, decoding, and converting data between different formats and encodings
-
dCode
https://dcode.frOnline decoder and cipher identifier supporting various encoding schemes, ciphers, and cryptographic algorithms
-
FactorDB
https://factordb.com/Database of integer factorizations for looking up factors of large numbers, useful for RSA and crypto challenges
-
hashcat
https://hashcat.net/hashcat/World's fastest and most advanced password recovery utility supporting multiple hash types and attack modes
-
Hex Packet Decoder
https://hpd.gasmi.net/Online hex packet decoder and analyzer for decoding network packets and binary data in various formats
-
Hob0Rules
https://github.com/praetorian-inc/Hob0RulesPassword cracking rules for Hashcat based on statistics and industry patterns
-
Kaonashi
https://github.com/kaonashi-passwords/KaonashiWordlist, rules and masks from Kaonashi project for password cracking with hashcat
-
KoreLogic
https://github.com/SpiderLabs/KoreLogic-RulesUpdated version of the 2010 KoreLogic password cracking rules for John the Ripper
-
Pantagrule
https://github.com/rarecoil/pantagruleLarge hashcat rulesets generated from real-world compromised passwords
-
pdfcrack
https://pdfcrack.sourceforge.net/PDF password recovery tool that can crack PDF file passwords using dictionary and brute force attacks
-
PkCrack
https://www.unix-ag.uni-kl.de/~conrad/krypto/pkcrack.htmlTool for breaking PkZip-encryption using known plaintext attacks and brute force techniques
-
RSACtfTool
https://github.com/RsaCtfTool/RsaCtfToolTool to attack RSA and other public key cryptosystems with various attack methods and techniques
-
RSATool
https://github.com/ius/rsatoolTool to generate RSA private keys with given values including modulus, public exponent, and private exponent
-
SageMath
https://www.sagemath.org/Open-source mathematics software system for advanced mathematics, cryptography, and number theory computations
-
Vigenère Solver
https://www.guballa.de/vigenere-solverOnline tool to solve Vigenère cipher automatically by analyzing letter frequency and key length patterns
-
XORTool
https://github.com/hellman/xortoolTool to analyze multi-byte XOR cipher by finding key length and decrypting XOR-encrypted data
-
yafu
https://sourceforge.net/projects/yafu/Automated integer factorization tool for factoring large integers using various factorization algorithms
forensics
-
Autopsy
https://www.autopsy.com/Digital forensics platform and graphical interface to The Sleuth Kit for analyzing disk images and file systems
-
Binwalk
https://github.com/ReFirmLabs/binwalkFirmware analysis tool designed to assist in the analysis, extraction, and reverse engineering of firmware images
-
enum4linux
https://labs.portcullis.co.uk/tools/enum4linux/Tool for enumerating information from Windows and Samba systems using SMB protocol enumeration
-
Foremost
https://foremost.sourceforge.net/Forensic program to recover lost files based on their headers, footers, and internal data structures
-
tcpdump
https://www.tcpdump.org/Command-line packet analyzer for network traffic capture and analysis with powerful filtering capabilities
-
tshark
https://tshark.dev/Terminal-based version of Wireshark for packet analysis from the command line with scripting support
-
Volatility
https://github.com/volatilityfoundation/volatility3Open-source memory forensics framework for incident response and malware analysis of RAM dumps
-
Wireshark
https://www.wireshark.org/Network protocol analyzer for capturing and examining network traffic with deep inspection of protocols
misc
-
0x0.st
https://0x0.st/File hosting and URL shortening service for sharing files and links during CTF competitions
-
changeme
https://github.com/ztgrace/changemeTool to find default credentials on network devices by testing common default username and password combinations
-
CyberChef
https://gchq.github.io/CyberChef/The Cyber Swiss Army Knife: a web app for encryption, encoding, compression and data analysis operations
-
envs.sh
https://envs.sh/File hosting and URL shortening service for sharing files and links during CTF competitions
-
ngrok
https://ngrok.com/Secure tunneling service for exposing local servers to the internet for testing and development
-
nmap
https://nmap.org/Network exploration tool and security scanner for discovering hosts and services on computer networks
-
proxychains
https://github.com/haad/proxychainsTool for forcing any TCP connection made by any application to go through proxy chains for network proxying
-
SecLists
https://github.com/danielmiessler/SecListsCollection of multiple types of lists used during security assessments including wordlists and payloads
-
Tunnelmole
https://tunnelmole.com/Expose local servers to the internet with a simple command-line tool for testing and development
osint
-
amass
https://github.com/owasp-amass/amassIn-depth Attack Surface Mapping and Asset Discovery tool for comprehensive network reconnaissance
-
Sherlock
https://sherlockproject.xyz/Hunt down social media accounts by username across social networks to find user profiles and information
-
Shodan
https://www.shodan.io/Search engine for Internet-connected devices and services to discover and analyze network infrastructure
-
SubFinder
https://github.com/projectdiscovery/subfinderSubdomain discovery tool that discovers valid subdomains for websites using passive sources
-
theHarvester
https://github.com/laramies/theHarvesterOSINT tool for gathering emails, subdomains, hosts, employee names, open ports and banners
pwn
-
Metasploit
https://www.metasploit.com/Penetration testing framework for finding, exploiting, and validating vulnerabilities with exploit modules and payloads
-
pwntools
https://github.com/Gallopsled/pwntoolsCTF framework and exploit development library for Python that simplifies binary exploitation and exploit writing
-
ROPgadget
https://github.com/JonathanSalwan/ROPgadgetTool to search for ROP gadgets in binaries to facilitate ROP exploitation and build ROP chains
reversing
-
angr
https://angr.io/Platform-agnostic binary analysis framework for performing symbolic execution and binary analysis
-
Apktool
https://apktool.org/Tool for reverse engineering Android APK files to extract resources, decode sources, and rebuild APKs
-
Binary Ninja
https://binary.ninja/Binary analysis platform for reverse engineering with interactive disassembler and decompiler
-
DogBolt
https://dogbolt.org/Online decompiler - upload a binary and get decompiled code from multiple decompilers for comparison
-
GDB
https://www.sourceware.org/gdb/GNU Debugger for debugging programs written in various languages with powerful debugging features
-
Ghidra
https://ghidra-sre.org/Software reverse engineering framework developed by NSA for analyzing binary executables and libraries
-
radare2
https://github.com/radareorg/radare2Free and open source reverse engineering framework with disassembler, debugger, and analysis tools
stego
-
Aperi'Solve
https://www.aperisolve.com/Online steganography analysis platform for analyzing images and extracting hidden data from various file formats
-
Audacity
https://www.audacityteam.org/Free, open source, cross-platform audio software for audio analysis, editing, and steganography detection
-
DeepSound
https://github.com/Jpinsoft/DeepSoundAudio steganography tool for hiding secret data in audio files using advanced hiding techniques
-
ExifTool
https://exiftool.org/Platform-independent Perl library and command-line application for reading and editing image metadata
-
FotoForensics
https://fotoforensics.com/Image forensics tool for analyzing digital images to detect tampering and hidden information
-
Friture
https://friture.org/Real-time audio analyzer for visualizing audio signals and detecting hidden data in audio files
-
ImageMagick
https://imagemagick.org/script/index.phpSoftware suite to create, edit, compose, or convert bitmap images with command-line and API support
-
Snow
https://darkside.com.au/snow/Steganography program for concealing messages in ASCII text by appending whitespace to the end of lines
-
Sonic Visualiser
https://sonicvisualiser.org/Application for viewing and analysing the contents of music audio files with spectral analysis features
-
Steghide
https://steghide.sourceforge.net/Steganography program that hides data in various kinds of image and audio files using encryption
-
StegOnline
https://georgeom.net/StegOnlineWeb-based steganography tool for analyzing and manipulating images to hide or extract hidden data
-
Stegosaurus
https://github.com/AngelKitty/stegosaurusPython steganography tool for hiding data in images using least significant bit (LSB) steganography
-
StegoVeritas
https://github.com/bannsec/stegoVeritasPython tool for steganography analysis that extracts metadata and hidden data from image files
-
Stegseek
https://github.com/RickdeJager/stegseekFast steghide cracker that can be used to extract hidden data from steghide images using wordlists
-
StegSolve
https://github.com/Giotino/stegsolveAdvanced steganography tool for analyzing image files with various color filters and transformations
-
zsteg
https://github.com/zed-0xff/zsteg/Detect stegano-hidden data in PNG and BMP files using various steganography detection techniques
web
-
Arachni
https://github.com/Arachni/arachniWeb Application Security Scanner Framework for identifying vulnerabilities in web applications
-
BeEF
https://beefproject.com/Browser Exploitation Framework for launching client-side attacks against web browsers and hooking browsers
-
Brutelist
https://github.com/calebgcc/brutelistTool for generating wordlists for brute force attacks with customizable patterns and rules
-
Burp Suite
https://portswigger.net/burpWeb vulnerability scanner and security testing tool for finding and exploiting web application vulnerabilities
-
CUPP
https://github.com/Mebus/cuppCommon User Passwords Profiler - generates custom wordlists based on user information and patterns
-
DirBuster
https://dirbuster.com/Multi threaded java application designed to brute force directories and files names on web servers
-
Dirhunt
https://github.com/Nekmo/dirhuntWeb crawler optimized for searching and analyzing web directories to find hidden files and directories
-
ffuf
https://github.com/ffuf/ffufFast web fuzzer written in Go for directory and file discovery with high performance and flexibility
-
Gobuster
https://github.com/OJ/gobusterDirectory/file brute forcer and DNS subdomain brute-forcer written in Go for web enumeration
-
Hydra
https://github.com/vanhauser-thc/thc-hydraNetwork logon cracker which supports many different protocols for brute force attacks
-
John the Ripper
https://www.openwall.com/john/Fast password cracker available for many flavors of Unix, Windows, DOS, BeOS, and OpenVMS
-
JWT Debugger
https://www.jwt.io/Online tool to decode, verify and generate JWT tokens for testing and debugging JWT implementations
-
Nikto
https://cirt.net/nikto/Web server scanner which performs comprehensive tests against web servers to find vulnerabilities
-
Patator
https://github.com/lanjelot/patatorMulti-purpose brute-forcer with modular design supporting various protocols and attack methods
-
SAML Decoder & Parser
https://www.scottbrady.io/tools/saml-parserOnline tool to decode and parse SAML messages for analyzing SAML authentication and authorization
-
sqlmap
https://sqlmap.org/Automatic SQL injection and database takeover tool that detects and exploits SQL injection vulnerabilities
-
Turbo Intruder
https://portswigger.net/bappstore/9abaa233088242e8be252cd4ff534988Burp Suite extension for sending large numbers of HTTP requests quickly for fuzzing and brute forcing
-
WPScan
https://wpscan.com/Black box WordPress vulnerability scanner for finding security issues in WordPress installations
-
XSSer
https://github.com/epsylon/xsserCross Site Scripter - automated XSS testing tool for detecting and exploiting XSS vulnerabilities
-
ZAP
https://www.zaproxy.org/Free and open source web application security scanner for finding vulnerabilities in web applications