Android

• abhi-r3v0/EVABS - an open source Android application that is intentionally vulnerable so as to act as a learning platform for Android application security beginners
• t0thkr1s/frida-demo - an intentionally vulnerable Android application for Frida Demonstration

Attacks

• Bettercap - Framework to perform MITM (Man in the Middle) attacks.
• Yersinia - Attack various protocols on layer 2.

Bruteforcers

• Hashcat - Password Cracker
• Turbo Intruder - Burp Suite extension for sending large numbers of HTTP requests
• Nozzlr - Nozzlr is a bruteforce framework, trully modular and script-friendly.
• Patator - Patator is a multi-purpose brute-forcer, with a modular design.
• Ophcrack - Windows password cracker based on rainbow tables.
• Hydra - A parallelized login cracker which supports numerous protocols to attack
• John The Ripper - Password Cracker.

Crypto

• PkCrack - A tool for Breaking PkZip-encryption.
• FeatherDuster - An automated, modular cryptanalysis tool.
• Hash Extender - A utility tool for performing hash length extension attacks.
• padding-oracle-attacker - A CLI tool to execute padding oracle attacks.
• RSACTFTool - A tool for recovering RSA private key with various attack.
• RSATool - Generate private key with knowledge of p and q.
• XORTool - A tool to analyze multi-byte xor cipher.
• QuipQuip - An online tool for breaking substitution ciphers or vigenere ciphers (without key).

Exploits

• Cheatsheet
• DLLInjector - Inject dlls in processes.
• libformatstr - Simplify format string exploitation.
• one_gadget - A tool to find the one gadget execve('/bin/sh', NULL, NULL) call.
• Pwntools - CTF Framework for writing exploits.
• ROP Gadget - Framework for ROP exploitation.
• V0lt - Security CTF Toolkit.

Forensics

• Aircrack-Ng - Crack 802.11 WEP and WPA-PSK keys.
• Fsck.ext4 - Used to fix corrupt filesystems.
• ResourcesExtract - Extract various filetypes from exes.
• Snow - A Whitespace Steganography Tool.
• OfflineRegistryView - Simple tool for Windows that allows you to read offline Registry files from external drive and view the desired Registry key in .reg file format.
• Dnscat2 - Hosts communication through DNS.
• Creddump - Dump windows credentials.
• DVCS Ripper - Rips web accessible (distributed) version control systems.
• Fibratus - Tool for exploration and tracing of the Windows kernel.
• Registry Dumper - Dump your registry.
• Pngcheck - Verifies the integrity of PNG and dump all of the chunk-level information in human-readable form.
• Shellbags - Investigate NT_USER.dat files.
• USBRip - Simple CLI forensics tool for tracking USB device artifacts (history of USB events) on GNU/Linux.
• Volatility - To investigate memory dumps.
• Bkhive and Samdump2 - Dump SYSTEM and SAM files.
• Foremost - Extract particular kind of files using headers.
• PDF Streams Inflater - Find and extract zlib files compressed in PDF files.
• Malzilla - Malware hunting tool.
• Audacity - Analyze sound files (mp3, m4a, whatever).
• Extundelete - Used for recovering lost data from mountable images.
• CFF Explorer - PE Editor.
• Wireshark - Used to analyze pcap or pcapng files

Java

• CSPF-Founder/JavaVulnerableLab - this app is intended for the Java Programmers and other people who wish to learn about Web application vulnerabilities and write secure code
• find-sec-bugs/juliet-test-suite - a collection of test cases in the Java language. It contains examples for 112 different CWEs.
• Web Goat - a deliberately insecure web application maintained by OWASP designed to teach web application security lessons

Networking

• Monit - A linux tool to check a host on the network (and other non-network activities).
• Nmap - An open source utility for network discovery and security auditing.
• Wireshark - Analyze the network dumps.
• Zmap - An open-source network scanner.
• Masscan - Mass IP port scanner, TCP port scanner.
• Nipe - Nipe is a script to make Tor Network your default gateway.

NodeJS

• DVNA - a Damn Vulnerable NodeJS Application which is powered by commonly used libraries such as express, passport, sequelize, etc.
• OWASP/NodeGoat - The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them

Operating Systems

• Android Tamer - Based on Debian.
• BlackArch Linux - Based on Arch Linux.
• Kali Linux - Based on Debian.
• Parrot Security OS - Based on Debian.
• REMnux - Based on Debian.
• BackBox - Based on Ubuntu.
• URIX OS - Based on openSUSE.
• Pentoo - Based on Gentoo.

PHP

• ajinabraham/Vulnerable_Tornado_App
• Damn Vulnerable Web Application - PHP/MySQL web application that is damn vulnerable
• mddanish/Vulnerable-OTP-Application - Vulnerable OTP Application created using PHP & Google OTP

Platforms

• echoCTF.RED - Develop, deploy and maintain your own CTF infrastructure.
• FBCTF - Platform to host Capture the Flag competitions from Facebook.
• Haaukins - A Highly Accessible and Automated Virtualization Platform for Security Education.
• HackTheArch - CTF scoring platform.
• Mellivora - A CTF engine written in PHP.
• MotherFucking-CTF - Badass lightweight plaform to host CTFs. No JS involved.
• PicoCTF - The platform used to run picoCTF. A great framework to host any CTF.
• RootTheBox - A Game of Hackers (CTF Scoreboard & Game Manager).
• Scorebot - Platform for CTFs by Legitbs (Defcon).
• SecGen - Security Scenario Generator. Creates randomly vulnerable virtual machines.
• NightShade - A simple security CTF framework.
• CTFd - Platform to host jeopardy style CTFs from ISISLab, NYU Tandon.

Python

• portantier/vulpy - a web application developed in Python / Flask / SQLite that has two faces

Real World DVA

• Medicean/VulApps - yet another vulhub like project (in Chinese)
• nixawk/labs - a collection of some CVE vulnerable apps / samples / PoCs
• vulhub - Pre-Built Vulnerable Environments Based on Docker-Compose https://vulhub.org

Reversing

• Binary Ninja - Binary analysis framework.
• BinUtils - Collection of binary tools.
• GDB - The GNU project debugger.
• Xxxswf - A Python script for analyzing Flash files.
• Androguard - Reverse engineer Android applications.
• Angr - platform-agnostic binary analysis framework.
• Apk2Gold - Yet another Android decompiler.
• Barf - Binary Analysis and Reverse engineering Framework.
• Boomerang - Decompile x86/SPARC/PowerPC/ST-20 binaries to C.
• cwe_checker - cwe_checker finds vulnerable patterns in binary executables.
• GEF - GDB plugin.
• Ghidra - Open Source suite of reverse engineering tools. Similar to IDA Pro.
• Jadx - Decompile Android files.
• Java Decompilers - An online decompiler for Java and Android APKs.
• Krakatau - Java decompiler and disassembler.
• Objection - Runtime Mobile Exploration.
• PEDA - GDB plugin (only python2.7).
• PINCE - GDB front-end/reverse engineering tool, focused on game-hacking and automation.
• PinCTF - A tool which uses intel pin for Side Channel Analysis.
• Pwndbg - A GDB plugin that provides a suite of utilities to hack around GDB easily.
• Uncompyle - Decompile Python 2.7 binaries (.pyc).
• WinDbg - Windows debugger distributed by Microsoft.
• Xocopy - Program that can copy executables with execute, but no read permission.
• Z3 - A theorem prover from Microsoft Research.
• Revelo - Analyze obfuscated Javascript code.
• RABCDAsm - Collection of utilities including an ActionScript 3 assembler/disassembler.
• radare2 - A portable reversing framework.
• BinWalk - Analyze, reverse engineer, and extract firmware images.
• Plasma - An interactive disassembler for x86/ARM/MIPS which can generate indented pseudo-code with colored syntax.
• Pin - A dynamic binary instrumentaion tool by Intel.
• Frida - Dynamic Code Injection.

Services

• CSWSH - Cross-Site WebSocket Hijacking Tester.

Starter Packs

• CTF Tools - Collection of setup scripts to install various security research tools.
• LazyKali - A 2016 refresh of LazyKali which simplifies install of tools and configuration.

Steganography

• AperiSolve - Aperi'Solve is a platform which performs layer analysis on image (open-source).
• Exiftool - Read and write meta information in files.
• Image Steganography - Embeds text and files in images with optional encryption. Easy-to-use UI.
• ImageMagick - Tool for manipulating images.
• Pngtools - For various analysis related to PNGs.
• Stegbreak - Launches brute-force dictionary attacks on JPG image.
• StegOnline - Conduct a wide range of image steganography operations, such as concealing/revealing files hidden within bits (open-source).
• Convert - Convert images b/w formats and apply filters.
• SmartDeblur - Used to deblur and fix defocused images.
• SteganographyOnline - Online steganography encoder and decoder.
• StegCracker - Steganography brute-force utility to uncover hidden data inside files.
• stegextract - Detect hidden files and text in images.
• Stegsolve - Apply various steganography techniques to images.
• Exif - Shows EXIF information in JPEG files.
• Outguess - Universal steganographic tool.
• Steganabara - Tool for stegano analysis written in Java.
• Zsteg - PNG/BMP analysis.

Tutorials

• CTF related notes - Personal CTFs and beyond notes (in Chinese)
• CTF Tricks by Phithon - CTF tricks about Web (in Chinese)
• Intro. to CTF Course - A free course that teaches beginners the basics of forensics, crypto, and web-ex.
• RITSEC - RITSEC is a student run club at Rochester Institute of Technology. There are some CTF writeups and shares in this team repository.
• CTF Field Guide - Field Guide by Trails of Bits
• CTF Resources - Start Guide maintained by community
• CTF-pwn-tips - Some tips about pwn
• firmianay/CTF-All-In-One - all CTF related tutorials complied in one book (in Chinese)
• MIPT CTF - A small course for beginners in CTFs (in Russian)
• OWASP Mutillidae 2 Project - a free, open source, deliberately vulnerable web-application providing a target for web-security enthusiest
• LiveOverFlow - Video tutorials on Exploitation.

Uncategorized

Uncategorized

• Kali Linux CTF Blueprints - Online book on building, testing, and customizing your own Capture the Flag challenges.

Wargames

• 247ctf - A learning oriented real CTF platform with challenges covering across web, cryptography, networking, reversing and exploitation.
• Backdoor - Security Platform by SDSLabs.
• buuoj - A CTF training platform with challenges collected from the past real CTF contests around the world. (in Chinese)
• Crackmes - Reverse Engineering Challenges.
• CryptoHack - Fun cryptography challenges.
• echoCTF.RED - Online CTF with a variety of targets to attack.
• Hack This Site - Training ground for hackers.
• Hacker101 - CTF from HackerOne
• Hacking-Lab - Ethical hacking, computer network and security challenge platform.
• Hone Your Ninja Skills - Web challenges starting from basic ones.
• IO - Wargame for binary challenges.
• jarvisoj - A CTF training platform developed by Jarvis from USSLab in ZJU.
• PentesterLab - Variety of VM and online challenges (paid).
• PicoCTF - All year round ctf game. Questions from the yearly picoCTF competition.
• PWN Challenge - Binary Exploitation Wargame.
• Pwnable.tw - Binary wargame.
• Pwnable.xyz - Binary Exploitation Wargame.
• Root-Me - Hacking and Information Security learning platform.
• SANS HHC - Challenges with a holiday theme
• VulnHub - VM-based for practical in digital security, computer application & network administration.
• Exploit Exercises - Variety of VMs to learn variety of computer security issues.
• Gracker - Binary challenges having a slow learning curve, and write-ups for each level.
• Reversin.kr - Reversing challenge.
• ROP Wargames - ROP Wargames.
• SmashTheStack - A variety of wargames maintained by the SmashTheStack Community.
• CTFTraining - CTF challenge's source code, writeup collected from the past real CTF contests around the world. (in Chinese)
• My CTF Web Challenges - CTF challenge's source code, writeup and some idea explanation. All about Web.
• Pikachu - PHP web application with some common delibrated vulnerabilities. (in Chinese)
• Pwnable.kr - Pwn Game.
• Ringzer0Team - Ringzer0 Team Online CTF.
• Microcorruption - Embedded security CTF.
• Exploit.Education - Variety of VMs to learn variety of computer security issues.
• W3Challs - A penetration testing training platform, which offers various computer challenges, in various categories.

Web

• Metasploit JavaScript Obfuscator
• BurpSuite - A graphical tool to testing website security.
• Hackbar - Firefox addon for easy web exploitation.
• OWASP ZAP - Intercepting proxy to replay, debug, and fuzz HTTP requests and responses
• Uglify
• Commix - Automated All-in-One OS Command Injection and Exploitation Tool.
• Raccoon - A high performance offensive security tool for reconnaissance and vulnerability scanning.
• SQLMap - Automatic SQL injection and database takeover tool.
• W3af - Web Application Attack and Audit Framework.
• CHYbeta/Code-Audit-Challenges - vulnerable code snippets can be used for source code audit challenges (in Chinese)
• XSSer - Automated XSS testor.

Websites

• CTF Time - General information on CTF occuring around the worlds.
• Reddit Security CTF - Reddit CTF category.
• Awesome CTF Cheatsheet - CTF Cheatsheet.

Wikis

• Bamboofox - Chinese resources to learn CTF
• bi0s Wiki - Wiki from team bi0s.
• CTF Cheatsheet - CTF tips and tricks.
• OpenToAll - Open To All Knowledge Base