Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

awesome-ctf

A curated list of CTF frameworks, libraries, resources and softwares
https://github.com/apsdehal/awesome-ctf

Last synced: 32 minutes ago
JSON representation

  • Forensics

  • Platforms

    • HackTheArch - CTF scoring platform.
    • PicoCTF - The platform used to run picoCTF. A great framework to host any CTF.
    • PyChallFactory - Small framework to create/manage/package jeopardy CTF challenges.
    • RootTheBox - A Game of Hackers (CTF Scoreboard & Game Manager).
    • Scorebot - Platform for CTFs by Legitbs (Defcon).
    • SecGen - Security Scenario Generator. Creates randomly vulnerable virtual machines.
    • NightShade - A simple security CTF framework.
    • OpenCTF - CTF in a box. Minimal setup required.
    • PyChallFactory - Small framework to create/manage/package jeopardy CTF challenges.
    • echoCTF.RED - Develop, deploy and maintain your own CTF infrastructure.
    • FBCTF - Platform to host Capture the Flag competitions from Facebook.
    • Haaukins - A Highly Accessible and Automated Virtualization Platform for Security Education.
    • Mellivora - A CTF engine written in PHP.
    • MotherFucking-CTF - Badass lightweight plaform to host CTFs. No JS involved.

  • Steganography

    • Convert - Convert images b/w formats and apply filters.
    • SmartDeblur - Used to deblur and fix defocused images.
    • Exiftool - Read and write meta information in files.
    • Image Steganography - Embeds text and files in images with optional encryption. Easy-to-use UI.
    • Pngtools - For various analysis related to PNGs.
    • Convert - Convert images b/w formats and apply filters.
    • Exif - Shows EXIF information in JPEG files.
    • Exiv2 - Image metadata manipulation tool.
    • Image Steganography Online - This is a client-side Javascript tool to steganographically hide images inside the lower "bits" of other images
    • ImageMagick - Tool for manipulating images.
    • Outguess - Universal steganographic tool.
    • Steganabara - Tool for stegano analysis written in Java.
    • Stegsolve - Apply various steganography techniques to images.
    • Exiv2 - Image metadata manipulation tool.
    • Image Steganography Online - This is a client-side Javascript tool to steganographically hide images inside the lower "bits" of other images
    • Steganabara - Tool for stegano analysis written in Java.
    • Steghide - Hide data in various kind of images.
    • AperiSolve - Aperi'Solve is a platform which performs layer analysis on image (open-source).
    • SteganographyOnline - Online steganography encoder and decoder.
    • Stegbreak - Launches brute-force dictionary attacks on JPG image.
    • StegCracker - Steganography brute-force utility to uncover hidden data inside files.
    • stegextract - Detect hidden files and text in images.
    • StegOnline - Conduct a wide range of image steganography operations, such as concealing/revealing files hidden within bits (open-source).
    • Stegsolve - Apply various steganography techniques to images.

  • Web

    • Uglify
    • Commix - Automated All-in-One OS Command Injection and Exploitation Tool.
    • SQLMap - Automatic SQL injection and database takeover tool.
    • Postman - Add on for chrome for debugging network requests.
    • XSSer - Automated XSS testor.
    • XSSer - Automated XSS testor.
    • Metasploit JavaScript Obfuscator
    • BurpSuite - A graphical tool to testing website security.
    • Hackbar - Firefox addon for easy web exploitation.
    • OWASP ZAP - Intercepting proxy to replay, debug, and fuzz HTTP requests and responses
    • Raccoon - A high performance offensive security tool for reconnaissance and vulnerability scanning.
    • W3af - Web Application Attack and Audit Framework.

  • Crypto

    • XORTool - A tool to analyze multi-byte xor cipher.
    • QuipQuip - An online tool for breaking substitution ciphers or vigenere ciphers (without key).
    • CyberChef - Web app for analysing and decoding data.
    • QuipQuip - An online tool for breaking substitution ciphers or vigenere ciphers (without key).
    • FeatherDuster - An automated, modular cryptanalysis tool.
    • Hash Extender - A utility tool for performing hash length extension attacks.
    • padding-oracle-attacker - A CLI tool to execute padding oracle attacks.
    • PkCrack - A tool for Breaking PkZip-encryption.
    • RSACTFTool - A tool for recovering RSA private key with various attack.
    • RSATool - Generate private key with knowledge of p and q.

  • Bruteforcers

    • Patator - Patator is a multi-purpose brute-forcer, with a modular design.
    • Hydra - A parallelized login cracker which supports numerous protocols to attack
    • Ophcrack - Windows password cracker based on rainbow tables.
    • Hydra - A parallelized login cracker which supports numerous protocols to attack
    • John The Jumbo - Community enhanced version of John the Ripper.
    • Ophcrack - Windows password cracker based on rainbow tables.
    • Hashcat - Password Cracker
    • Nozzlr - Nozzlr is a bruteforce framework, trully modular and script-friendly.
    • Turbo Intruder - Burp Suite extension for sending large numbers of HTTP requests

  • Reversing

    • Androguard - Reverse engineer Android applications.
    • Angr - platform-agnostic binary analysis framework.
    • Apk2Gold - Yet another Android decompiler.
    • Barf - Binary Analysis and Reverse engineering Framework.
    • Boomerang - Decompile x86/SPARC/PowerPC/ST-20 binaries to C.
    • cwe_checker - cwe_checker finds vulnerable patterns in binary executables.
    • RABCDAsm - Collection of utilities including an ActionScript 3 assembler/disassembler.
    • Frida - Dynamic Code Injection.
    • Java Decompilers - An online decompiler for Java and Android APKs.
    • WinDbg - Windows debugger distributed by Microsoft.
    • Xocopy - Program that can copy executables with execute, but no read permission.
    • Detox - A Javascript malware analysis tool.
    • Revelo - Analyze obfuscated Javascript code.
    • Swftools - Collection of utilities to work with SWF files.
    • ApkTool - Android Decompiler.
    • BinWalk - Analyze, reverse engineer, and extract firmware images.
    • ctf_import
    • Triton - Dynamic Binary Analysis (DBA) framework.
    • Detox - A Javascript malware analysis tool.
    • Binary Ninja - Binary analysis framework.
    • BinUtils - Collection of binary tools.
    • GEF - GDB plugin.
    • Ghidra - Open Source suite of reverse engineering tools. Similar to IDA Pro.
    • Jadx - Decompile Android files.
    • Java Decompilers - An online decompiler for Java and Android APKs.
    • Krakatau - Java decompiler and disassembler.
    • Objection - Runtime Mobile Exploration.
    • PEDA - GDB plugin (only python2.7).
    • PinCTF - A tool which uses intel pin for Side Channel Analysis.
    • Pwndbg - A GDB plugin that provides a suite of utilities to hack around GDB easily.
    • Uncompyle - Decompile Python 2.7 binaries (.pyc).
    • WinDbg - Windows debugger distributed by Microsoft.
    • Xocopy - Program that can copy executables with execute, but no read permission.
    • Z3 - A theorem prover from Microsoft Research.
    • Revelo - Analyze obfuscated Javascript code.
    • Xxxswf - A Python script for analyzing Flash files.
    • GDB - The GNU project debugger.
    • PINCE - GDB front-end/reverse engineering tool, focused on game-hacking and automation.

  • Services

    • CSWSH - Cross-Site WebSocket Hijacking Tester.
    • CSWSH - Cross-Site WebSocket Hijacking Tester.
    • Request Bin - Lets you inspect http requests to a particular url.

  • Operating Systems

  • Tutorials

  • Wargames

    • Reversin.kr - Reversing challenge.
    • CryptoHack - Fun cryptography challenges.
    • Exploit Exercises - Variety of VMs to learn variety of computer security issues.
    • Exploit.Education - Variety of VMs to learn variety of computer security issues.
    • Reversin.kr - Reversing challenge.
    • Viblo CTF - Various amazing CTF challenges, in many different categories. Has both Practice mode and Contest mode.
    • Damn Vulnerable Web Application - PHP/MySQL web application that is damn vulnerable.
    • VulnHub - VM-based for practical in digital security, computer application & network administration.
    • Exploit.Education - Variety of VMs to learn variety of computer security issues.
    • Viblo CTF - Various amazing CTF challenges, in many different categories. Has both Practice mode and Contest mode.
    • W3Challs - A penetration testing training platform, which offers various computer challenges, in various categories.
    • WebHacking - Hacking challenges for web.
    • Juice Shop CTF - Scripts and tools for hosting a CTF on [OWASP Juice Shop](https://www.owasp.org/index.php/OWASP_Juice_Shop_Project) easily.
    • Backdoor - Security Platform by SDSLabs.
    • Crackmes - Reverse Engineering Challenges.
    • echoCTF.RED - Online CTF with a variety of targets to attack.
    • Exploit Exercises - Variety of VMs to learn variety of computer security issues.
    • Gracker - Binary challenges having a slow learning curve, and write-ups for each level.
    • Hack This Site - Training ground for hackers.
    • Hacker101 - CTF from HackerOne
    • Hacking-Lab - Ethical hacking, computer network and security challenge platform.
    • Hone Your Ninja Skills - Web challenges starting from basic ones.
    • IO - Wargame for binary challenges.
    • PentesterLab - Variety of VM and online challenges (paid).
    • PicoCTF - All year round ctf game. Questions from the yearly picoCTF competition.
    • PWN Challenge - Binary Exploitation Wargame.
    • Pwnable.tw - Binary wargame.
    • Pwnable.xyz - Binary Exploitation Wargame.
    • Root-Me - Hacking and Information Security learning platform.
    • ROP Wargames - ROP Wargames.
    • SANS HHC - Challenges with a holiday theme
    • SmashTheStack - A variety of wargames maintained by the SmashTheStack Community.
    • Damn Vulnerable Web Application - PHP/MySQL web application that is damn vulnerable.
    • Pwnable.kr - Pwn Game.

  • Websites

  • Wikis

  • Writeups Collections

    • Shell Storm - CTF challenge archive maintained by Jonathan Salwan.
    • CTF write-ups (community) - CTF challenges + write-ups archive maintained by the community.
    • Mzfr - CTF competition write-ups by mzfr
    • 0e85dc6eaf - Write-ups for CTF challenges by 0e85dc6eaf
    • Captf - Dumped CTF challenges and materials by psifertex.
    • CTFTime Scrapper - Scraps all writeup from CTF Time and organize which to read first.
    • HackThisSite - CTF write-ups repo maintained by HackThisSite team.
    • pwntools writeups - A collection of CTF write-ups all using pwntools.
    • SababaSec - A collection of CTF write-ups by the SababaSec team
    • Shell Storm - CTF challenge archive maintained by Jonathan Salwan.
    • Smoke Leet Everyday - CTF write-ups repo maintained by SmokeLeetEveryday team.

  • Networking

    • Monit - A linux tool to check a host on the network (and other non-network activities).
    • Masscan - Mass IP port scanner, TCP port scanner.
    • Nipe - Nipe is a script to make Tor Network your default gateway.
    • Nmap - An open source utility for network discovery and security auditing.
    • Wireshark - Analyze the network dumps.
    • Zmap - An open-source network scanner.

  • Uncategorized

  • Exploits

  • Attacks

    • Bettercap - Framework to perform MITM (Man in the Middle) attacks.
    • Yersinia - Attack various protocols on layer 2.

  • Starter Packs

    • CTF Tools - Collection of setup scripts to install various security research tools.
    • LazyKali - A 2016 refresh of LazyKali which simplifies install of tools and configuration.
Programming Languages
Python 32 C 4 PHP 3 Shell 3 Go 3 Ruby 2 Rust 2 C++ 2 CSS 1 Groovy 1
Categories
Operating Systems 63 Reversing 38 Wargames 34 Forensics 31 Steganography 24 Platforms 14 Web 12 Writeups Collections 11 Crypto 10 Bruteforcers 9 Exploits 9 Tutorials 7 Networking 6 Wikis 6 Websites 3 Services 3 Attacks 2 Uncategorized 2 Starter Packs 2
Sub Categories
Uncategorized 2
Keywords
ctf 10 python 10 security 9 reverse-engineering 8 pentesting 5 vulnerability-scanner 4 cryptography 4 linux 4 hacking 4 exploit 4 gdb 3 exploitation 3 capture-the-flag 3 pwnable 3 hacking-tool 3 android 3 detection 2 virtualization 2 cybersecurity 2 sql-injection 2 x86 2 binary-analysis 2 takeover 2 hackthebox 2 instrumentation 2 pentest 2 decompiler 2 dex 2 encryption 2 crypto 2 cryptanalysis 2 security-scanner 2 scanner 2 golang 2 windows 2 debugging 2 ctf-framework 2 binary-ninja 2 pwn 2 python3 2 exploit-development 2 rop 2 malware-analysis 2 ida-pro 2 pwntools 2 gef 2 sparc 2 disassembler 2 wifi-security 1 wpa2 1