2015-08-06 03:54:09 +00:00
# Awesome CTF [![Build Status](https://travis-ci.org/apsdehal/awesome-ctf.svg?branch=master)](https://travis-ci.org/apsdehal/awesome-ctf) [![Awesome](https://cdn.rawgit.com/sindresorhus/awesome/d7305f38d29fed78fa85652e3a63e154dd8e8829/media/badge.svg)](https://github.com/sindresorhus/awesome)
2015-02-28 05:48:21 +00:00
2015-04-27 22:07:10 +00:00
A curated list of [Capture The Flag ](https://en.wikipedia.org/wiki/Capture_the_flag#Computer_security ) (CTF) frameworks, libraries, resources and softwares.
2015-02-28 05:48:21 +00:00
2015-04-26 05:50:19 +00:00
### Contributing
2015-02-28 05:51:44 +00:00
2015-04-26 06:33:39 +00:00
Please take a quick look at the [contribution guidelines ](https://github.com/apsdehal/ctf-tools/blob/master/CONTRIBUTING.md ) first.
2015-04-26 05:50:19 +00:00
#### _If you know a tool that isn't present here, feel free to open a pull request._
2015-03-19 08:42:06 +00:00
2015-04-26 06:27:07 +00:00
### Why?
It takes time to build up collection of tools used in ctf and remember them all. This repo helps to keep all these scattered tools at one place.
2015-04-26 05:50:45 +00:00
### Contents
2015-04-26 20:02:50 +00:00
- [Awesome CTF ](#awesome-ctf )
2015-04-26 05:50:45 +00:00
- [Create ](#create )
2015-04-27 22:26:04 +00:00
- [Forensics ](#forensics )
- [Web ](#web )
2015-04-26 05:50:45 +00:00
- [Solve ](#solve )
2015-04-27 22:26:04 +00:00
- [Attacks ](#attacks )
- [Bruteforcers ](#bruteforcers )
- [Cryptography ](#crypto )
- [Exploits ](#exploits )
- [Forensics ](#forensics-1 )
- [Reversing ](#reversing )
- [Services ](#services )
- [Steganography ](#stegano )
- [Web ](#web-1 )
2015-04-26 05:51:01 +00:00
2015-04-26 05:57:15 +00:00
- [Resources ](#resources )
2015-09-08 18:26:17 +00:00
- [Starter Packs ](#starter-packs )
2015-04-27 22:26:04 +00:00
- [Tutorials ](#tutorials )
- [Wargames ](#wargames )
- [Websites ](#websites )
- [Wikis ](#wikis )
2015-09-08 18:26:17 +00:00
- [Writeups Collections ](#writeups-collections )
2015-04-26 05:57:15 +00:00
2015-04-26 05:52:43 +00:00
# Create
2015-04-26 05:51:01 +00:00
*Tools used for creating CTF challenges*
## Forensics
*Tools used for creating Forensics challenges*
2015-03-19 09:32:49 +00:00
- [Registry Dumper ](http://www.kahusecurity.com/tools/RegistryDumper_v0.1.zip ) - Dump your registry
2015-04-26 05:51:01 +00:00
## Web
*Tools used for creating Web challenges*
*JavaScript Obfustcators*
2015-04-26 06:47:33 +00:00
- [Metasploit JavaScript Obfustcator ](https://github.com/rapid7/metasploit-framework/wiki/How-to-obfuscate-JavaScript-in-Metasploit )
- [Uglify ](http://marijnhaverbeke.nl//uglifyjs )
2015-04-26 05:51:01 +00:00
2015-04-26 05:52:43 +00:00
# Solve
2015-04-26 05:51:19 +00:00
*Tools used for solving CTF challenges*
2015-04-26 06:11:06 +00:00
## Attacks
2015-04-26 05:51:19 +00:00
2015-04-26 06:11:06 +00:00
*Tools used for performing various kinds of attacks*
2015-04-26 05:51:19 +00:00
2015-04-26 06:11:06 +00:00
- [Layer 2 attacks ](https://github.com/tomac/yersinia ) - Attack various protocols on layer 2
2015-04-26 05:51:19 +00:00
## Crypto
*Tools used for solving Crypto challenges*
- [RSATool ](https://github.com/ius/rsatool ) - Generate private key with knowledge of p and q
2015-04-26 08:05:02 +00:00
- [XORTool ](https://github.com/hellman/xortool ) - A tool to analyze multi-byte xor cipher
2015-04-26 05:51:19 +00:00
2015-04-26 06:11:06 +00:00
## Bruteforcers
*Tools used for various kind of bruteforcing (passwords etc.)*
2015-04-26 06:47:33 +00:00
- [John The Jumbo ](https://github.com/magnumripper/JohnTheRipper ) - Community enhanced version of John the Ripper
2015-04-26 08:05:02 +00:00
- [John The Ripper ](http://www.openwall.com/john/ ) - Password Cracker
2015-04-26 06:47:33 +00:00
- [Ophcrack ](http://ophcrack.sourceforge.net/ ) - Windows password cracker based on rainbow tables.
2015-04-26 06:11:06 +00:00
## Exploits
*Tools used for solving Exploits challenges*
2015-04-28 21:09:32 +00:00
- [binjitsu ](https://github.com/binjitsu/binjitsu/ ) - CTF framework and exploit development library
2015-04-26 06:47:33 +00:00
- [Metasploit ](http://www.metasploit.com/ ) - Penetration testing software
2015-04-26 06:11:06 +00:00
- [pwntools ](https://github.com/Gallopsled/pwntools ) - CTF Framework for writing exploits
2015-10-28 04:58:48 +00:00
- [ROP Gadget ](https://github.com/JonathanSalwan/ROPgadget ) - Framework for ROP exploitation
2015-04-26 06:11:06 +00:00
2015-04-26 05:51:19 +00:00
## Forensics
*Tools used for solving Forensics challenges*
2015-04-30 12:58:43 +00:00
- [Aircrack-Ng ](http://www.aircrack-ng.org/ ) - Crack 802.11 WEP and WPA-PSK keys
- `apt-get install aircrack-ng`
2015-04-26 06:25:12 +00:00
- [Audacity ](http://sourceforge.net/projects/audacity/ ) - Analyze sound files (mp3, m4a, whatever)
2015-04-26 05:51:19 +00:00
- `apt-get install audacity`
2015-04-26 06:25:12 +00:00
- [bkhive and samdump2 ](http://sourceforge.net/projects/ophcrack/files/samdump2/ ) - Dump SYSTEM and SAM files
- `apt-get install samdump2 bkhive`
2015-04-26 05:51:19 +00:00
- [CFF Explorer ](http://www.ntcore.com/exsuite.php ) - PE Editor
2015-04-28 13:33:07 +00:00
- [creddump ](https://github.com/moyix/creddump ) - Dump windows credentials
2015-09-19 20:05:00 +00:00
- [DVCS Ripper ](https://github.com/kost/dvcs-ripper ) - Rips web accessible (distributed) version control systems
2015-07-18 09:52:30 +00:00
- [Exif Tool ](http://www.sno.phy.queensu.ca/~phil/exiftool/ ) - Read, write and edit file metadata
2015-04-26 06:25:12 +00:00
- [extundelete ](http://extundelete.sourceforge.net/ ) - Used for recovering lost data from mountable images
- [Foremost ](http://foremost.sourceforge.net/ ) - Extract particular kind of files using headers
2015-04-26 06:18:50 +00:00
- `apt-get install foremost`
2015-04-26 06:25:12 +00:00
- [fsck.ext4 ](http://linux.die.net/man/8/fsck.ext3 ) - Used to fix corrupt filesystems
2015-04-26 06:15:02 +00:00
- [Malzilla ](http://malzilla.sourceforge.net/ ) - Malware hunting tool
2015-07-18 10:02:00 +00:00
- [NetworkMiner ](http://www.netresec.com/?page=NetworkMiner ) - Network Forensic Analysis Tool
2015-04-26 06:15:02 +00:00
- [PDF Streams Inflater ](http://malzilla.sourceforge.net/downloads.html ) - Find and extract zlib files compressed in PDF files
2015-04-26 06:25:12 +00:00
- [ResourcesExtract ](http://www.nirsoft.net/utils/resources_extract.html ) - Extract various filetypes from exes
2015-04-26 06:18:50 +00:00
- [Shellbags ](https://github.com/williballenthin/shellbags ) - Investigate NT\_USER.dat files
- [UsbForensics ](http://www.forensicswiki.org/wiki/USB_History_Viewing ) - Contains many tools for usb forensics
- [Volatility ](https://github.com/volatilityfoundation/volatility ) - To investigate memory dumps
2015-04-26 06:25:12 +00:00
- [Wireshark ](https://www.wireshark.org/ ) - Analyze the network dumps
2015-04-26 06:18:50 +00:00
- `apt-get install wireshark`
*Registry Viewers*
- [RegistryViewer ](http://www.gaijin.at/en/getitpage.php?id=regview ) - Used to view windows registries
2015-04-26 08:05:02 +00:00
- [Windows Registry Viewers ](http://www.forensicswiki.org/wiki/Windows_Registry ) - More registry viewers
2015-04-26 05:51:19 +00:00
## Reversing
*Tools used for solving Reversing challenges*
2015-04-26 06:11:06 +00:00
- [Androguard ](https://github.com/androguard/androguard ) - Reverse engineer Android applications
- [Apk2Gold ](https://github.com/lxdvs/apk2gold ) - Yet another Android decompiler
- [ApkTool ](http://ibotpeaches.github.io/Apktool/ ) - Android Decompiler
2015-04-30 12:58:43 +00:00
- [BinUtils ](http://www.gnu.org/software/binutils/binutils.html ) - Collection of binary tools
2015-04-26 06:18:50 +00:00
- [BinWalk ](https://github.com/devttys0/binwalk ) - Analyze, reverse engineer, and extract firmware images.
- [Boomerang ](https://github.com/nemerle/boomerang ) - Decompile x86 binaries to C
2015-04-26 06:47:33 +00:00
- [IDA Pro ](https://www.hex-rays.com/products/ida/ ) - Most used Reversing software
2015-04-26 06:18:50 +00:00
- [Jadx ](https://github.com/skylot/jadx ) - Decompile Android files
2015-04-26 06:11:06 +00:00
- [Krakatau ](https://github.com/Storyyeller/Krakatau ) - Java decompiler and disassembler
2015-10-11 01:51:27 +00:00
- [radare2 ](https://github.com/radare/radare2 ) - A portable reversing framework
2015-04-26 07:38:16 +00:00
- [Uncompyle ](https://github.com/gstarnberger/uncompyle ) - Decompile Python 2.7 binaries (.pyc)
2015-10-28 04:53:34 +00:00
- [WinDbg ](http://www.windbg.org/ ) - Windows debugger distributed by Microsoft
2015-04-26 06:11:06 +00:00
*JavaScript Deobfustcators*
2015-04-26 06:47:33 +00:00
- [Detox ](http://relentless-coding.org/projects/jsdetox/install ) - A Javascript malware analysis tool
- [Revelo ](http://www.kahusecurity.com/tools/Revelo_v0.6.zip ) - Analyze obfuscated Javascript code
2015-04-26 05:51:19 +00:00
2015-07-18 10:02:00 +00:00
*SWF Analyzers*
2015-07-18 10:03:42 +00:00
- [RABCDAsm ](https://github.com/CyberShadow/RABCDAsm ) - Collection of utilities including an ActionScript 3 assembler/disassembler.
2015-07-18 10:02:00 +00:00
- [swftools ](http://www.swftools.org/ ) - Collection of utilities to work with SWF files
- [xxxswf ](https://bitbucket.org/Alexander_Hanel/xxxswf ) - A Python script for analyzing Flash files.
2015-04-26 06:11:06 +00:00
## Services
2015-04-26 05:51:19 +00:00
2015-04-26 06:11:06 +00:00
*Various kind of useful services available around the internet*
2015-04-26 05:51:19 +00:00
2015-04-26 06:11:06 +00:00
- [CSWSH ](http://ironwasp.org/cswsh.html ) - Cross-Site WebSocket Hijacking Tester
2015-04-26 06:18:50 +00:00
- [Request Bin ](http://requestb.in/ ) - Lets you inspect http requests to a particular url
2015-04-26 05:51:19 +00:00
2015-04-26 06:11:06 +00:00
## Stegano
2015-04-26 05:51:19 +00:00
2015-04-26 06:11:06 +00:00
*Tools used for solving Steganography challenges*
2015-04-26 05:51:19 +00:00
2015-04-26 06:47:33 +00:00
- [pngtools ](http://www.stillhq.com/pngtools/ ) - For various analysis related to PNGs
2015-04-26 06:11:06 +00:00
- `apt-get install pngtools`
2015-04-26 06:47:33 +00:00
- [SmartDeblur ](https://github.com/Y-Vladimir/SmartDeblur ) - Used to deblur and fix defocused images
- [Steganabara ](https://www.openhub.net/p/steganabara ) - Tool for stegano analysis written in Java
- [Steghide ](http://steghide.sourceforge.net/ ) - Hide data in various kind of images
- [Stegsolve ](http://www.caesum.com/handbook/Stegsolve.jar ) - Apply various steganography techniques to images
2015-04-26 05:51:19 +00:00
2015-04-26 06:11:06 +00:00
## Web
2015-04-26 05:51:19 +00:00
2015-04-26 06:11:06 +00:00
*Tools used for solving Web challenges*
2015-04-26 05:51:19 +00:00
2015-04-26 06:11:06 +00:00
- [SQLMap ](https://github.com/sqlmapproject/sqlmap ) - Automatic SQL injection and database takeover tooli
2015-07-13 21:01:40 +00:00
- [w3af ](https://github.com/andresriancho/w3af ) - Web Application Attack and Audit Framework.
2015-04-26 06:18:50 +00:00
- [XSSer ](http://xsser.sourceforge.net/ ) - Automated XSS testor
2015-04-26 05:57:15 +00:00
# Resources
2015-04-26 06:05:05 +00:00
*Where to discover about CTF*
2015-09-08 18:20:52 +00:00
## Starter Packs
*Collections of installer scripts, useful tools*
- [CTF Tools ](https://github.com/zardus/ctf-tools ) - Collection of setup scripts to install various security research tools.
2015-04-27 16:25:32 +00:00
## Tutorials
*Tutorials to learn how to play CTFs*
- [CTF Field Guide ](https://trailofbits.github.io/ctf/ ) - Field Guide by Trails of Bits
2015-04-28 22:49:40 +00:00
- [CTF Resources ](http://ctfs.github.io/resources/ ) - Start Guide maintained by community
2015-06-29 07:17:28 +00:00
- [How to Get Started in CTF ](https://www.endgame.com/blog/how-get-started-ctf ) - Short guideline for CTF beginners by Endgame
2015-09-02 13:28:35 +00:00
- [MIPT CTF ](https://github.com/xairy/mipt-ctf ) - A small course for beginners in CTFs (in Russian)
2015-04-27 16:25:32 +00:00
## Wargames
*Always online CTFs*
2015-10-27 00:28:44 +00:00
- [Backdoor ](https://backdoor.sdslabs.co/ ) - Security Platform by SDSLabs.
- [Exploit Exercises ](https://exploit-exercises.com/ ) - Variety of VMs to learn variety of computer security issues.
2015-04-27 16:25:32 +00:00
- [Hack This Site ](https://www.hackthissite.org/ ) - Training ground for hackers.
- [Over The Wire ](http://overthewire.org/wargames/ ) - Wargame maintained by OvertheWire Community
2015-10-27 05:50:35 +00:00
- [SmashTheStack ](http://smashthestack.org/ ) - A variety of wargames maintained by the SmashTheStack Community.
2015-07-18 09:52:30 +00:00
- [VulnHub ](https://www.vulnhub.com/ ) - VM-based for practical in digital security, computer application & network administration.
2015-10-27 00:28:44 +00:00
- [WeChall ](https://www.wechall.net/ ) - Always online challenge site.
2015-10-27 05:48:24 +00:00
2015-04-26 05:57:15 +00:00
## Websites
2015-04-26 06:05:05 +00:00
*Various general websites about and on ctf*
- [CTF Time ](https://ctftime.org/ ) - General information on CTF occuring around the worlds
2015-04-27 16:25:32 +00:00
- [Reddit Security CTF ](http://www.reddit.com/r/securityctf ) - Reddit CTF category
## Wikis
*Various Wikis available for learning about CTFs*
- [ISIS Lab ](https://github.com/isislab/Project-Ideas/wiki ) - CTF Wiki by Isis lab
2015-04-26 06:05:05 +00:00
## Writeups Collections
2015-04-28 05:07:58 +00:00
*Collections of CTF write-ups*
2015-04-26 06:05:05 +00:00
2015-06-29 07:17:28 +00:00
- [Captf ](http://captf.com/ ) - Dumped CTF challenges and materials by psifertex
2015-04-28 05:07:58 +00:00
- [CTF write-ups (community) ](https://github.com/ctfs/ ) - CTF challenges + write-ups archive maintained by the community
2015-04-28 21:09:32 +00:00
- [pwntools writeups ](https://github.com/Gallopsled/pwntools-write-ups ) - A collection of CTF write-ups all using pwntools
2015-04-28 05:07:58 +00:00
- [Shell Storm ](shell-storm.org/repo/CTF/ ) - CTF challenge archive maintained by Jonathan Salwan
- [Smoke Leet Everyday ](https://github.com/smokeleeteveryday/CTF_WRITEUPS ) - CTF write-ups repo maintained by SmokeLeetEveryday team.
2015-04-26 05:57:15 +00:00
2015-04-26 06:35:02 +00:00
### LICENSE
MIT :)