Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

awesome-ctf

forked from https://github.com/apsdehal/awesome-ctf.git
https://github.com/c4pr1c3/awesome-ctf

Last synced: about 16 hours ago
JSON representation

  • Networking

    • Wireshark - Analyze the network dumps.
    • Masscan - Mass IP port scanner, TCP port scanner.
    • Monit - A linux tool to check a host on the network (and other non-network activities).
    • Nipe - Nipe is a script to make Tor Network your default gateway.
    • Nmap - An open source utility for network discovery and security auditing.
    • Zmap - An open-source network scanner.
    • Zeek - An open-source network security monitor.

  • Reversing

    • WinDbg - Windows debugger distributed by Microsoft.
    • Androguard - Reverse engineer Android applications.
    • Angr - platform-agnostic binary analysis framework.
    • Apk2Gold - Yet another Android decompiler.
    • cwe_checker - cwe_checker finds vulnerable patterns in binary executables.
    • GEF - GDB plugin.
    • Ghidra - Open Source suite of reverse engineering tools. Similar to IDA Pro.
    • Krakatau - Java decompiler and disassembler.
    • Objection - Runtime Mobile Exploration.
    • PEDA - GDB plugin (only python2.7).
    • Z3 - A theorem prover from Microsoft Research.
    • Revelo - Analyze obfuscated Javascript code.
    • RABCDAsm - Collection of utilities including an ActionScript 3 assembler/disassembler.
    • Xxxswf - A Python script for analyzing Flash files.
    • Jadx - Decompile Android files.
    • Java Decompilers - An online decompiler for Java and Android APKs.
    • WinDbg - Windows debugger distributed by Microsoft.
    • Xocopy - Program that can copy executables with execute, but no read permission.
    • Detox - A Javascript malware analysis tool.
    • Swftools - Collection of utilities to work with SWF files.
    • ApkTool - Android Decompiler.
    • Hopper - Reverse engineering tool (disassembler) for OSX and Linux.
    • Pin - A dynamic binary instrumentaion tool by Intel.
    • Barf - Binary Analysis and Reverse engineering Framework.
    • Binary Ninja - Binary analysis framework.
    • BinUtils - Collection of binary tools.
    • Boomerang - Decompile x86/SPARC/PowerPC/ST-20 binaries to C.
    • GDB - The GNU project debugger.
    • PINCE - GDB front-end/reverse engineering tool, focused on game-hacking and automation.
    • PinCTF - A tool which uses intel pin for Side Channel Analysis.
    • Pwndbg - A GDB plugin that provides a suite of utilities to hack around GDB easily.
    • Uncompyle - Decompile Python 2.7 binaries (.pyc).
    • Xocopy - Program that can copy executables with execute, but no read permission.

  • Wargames

    • CryptoHack - Fun cryptography challenges.
    • 247ctf - A learning oriented real CTF platform with challenges covering across web, cryptography, networking, reversing and exploitation.
    • Crackmes - Reverse Engineering Challenges.
    • echoCTF.RED - Online CTF with a variety of targets to attack.
    • Exploit Exercises - Variety of VMs to learn variety of computer security issues.
    • Gracker - Binary challenges having a slow learning curve, and write-ups for each level.
    • Hack This Site - Training ground for hackers.
    • PicoCTF - All year round ctf game. Questions from the yearly picoCTF competition.
    • PWN Challenge - Binary Exploitation Wargame.
    • Pwnable.kr - Pwn Game.
    • Pwnable.tw - Binary wargame.
    • Root-Me - Hacking and Information Security learning platform.
    • ROP Wargames - ROP Wargames.
    • SANS HHC - Challenges with a holiday theme
    • SmashTheStack - A variety of wargames maintained by the SmashTheStack Community.
    • VulnHub - VM-based for practical in digital security, computer application & network administration.
    • CTFTraining - CTF challenge's source code, writeup collected from the past real CTF contests around the world. (in Chinese)
    • My CTF Web Challenges - CTF challenge's source code, writeup and some idea explanation. All about Web.
    • Pikachu - PHP web application with some common delibrated vulnerabilities. (in Chinese)
    • Reversin.kr - Reversing challenge.
    • Backdoor - Security Platform by SDSLabs.
    • buuoj - A CTF training platform with challenges collected from the past real CTF contests around the world. (in Chinese)
    • Pwnable.xyz - Binary Exploitation Wargame.
    • Exploit Exercises - Variety of VMs to learn variety of computer security issues.
    • Hacker101 - CTF from HackerOne
    • Hacking-Lab - Ethical hacking, computer network and security challenge platform.
    • Hone Your Ninja Skills - Web challenges starting from basic ones.
    • IO - Wargame for binary challenges.
    • jarvisoj - A CTF training platform developed by Jarvis from USSLab in ZJU.
    • PentesterLab - Variety of VM and online challenges (paid).
    • Reversin.kr - Reversing challenge.
    • Ringzer0Team - Ringzer0 Team Online CTF.

  • Writeups Collections

    • SababaSec - A collection of CTF write-ups by the SababaSec team
    • HackThisSite - CTF write-ups repo maintained by HackThisSite team.
    • pwntools writeups - A collection of CTF write-ups all using pwntools.
    • Shell Storm - CTF challenge archive maintained by Jonathan Salwan.
    • 0e85dc6eaf - Write-ups for CTF challenges by 0e85dc6eaf
    • Captf - Dumped CTF challenges and materials by psifertex.
    • CTFTime Scrapper - Scraps all writeup from CTF Time and organize which to read first.
    • Shell Storm - CTF challenge archive maintained by Jonathan Salwan.
    • Smoke Leet Everyday - CTF write-ups repo maintained by SmokeLeetEveryday team.

  • Python

    • portantier/vulpy - a web application developed in Python / Flask / SQLite that has two faces
    • nVisium/django.nV - a purposefully vulnerable Django application provided by [nVisium](https://www.nvisium.com/)

  • Forensics

    • Creddump - Dump windows credentials.
    • DVCS Ripper - Rips web accessible (distributed) version control systems.
    • Fibratus - Tool for exploration and tracing of the Windows kernel.
    • Fsck.ext4 - Used to fix corrupt filesystems.
    • Pngcheck - Verifies the integrity of PNG and dump all of the chunk-level information in human-readable form.
    • ResourcesExtract - Extract various filetypes from exes.
    • Snow - A Whitespace Steganography Tool.
    • OfflineRegistryView - Simple tool for Windows that allows you to read offline Registry files from external drive and view the desired Registry key in .reg file format.
    • Registry Dumper - Dump your registry.
    • Shellbags - Investigate NT\_USER.dat files.
    • USBRip - Simple CLI forensics tool for tracking USB device artifacts (history of USB events) on GNU/Linux.
    • Volatility - To investigate memory dumps.
    • Dnscat2 - Hosts communication through DNS.
    • Aircrack-Ng - Crack 802.11 WEP and WPA-PSK keys.
    • Pngcheck - Verifies the integrity of PNG and dump all of the chunk-level information in human-readable form.
    • CFF Explorer - PE Editor.
    • Extundelete - Used for recovering lost data from mountable images.

  • Platforms

    • echoCTF.RED - Develop, deploy and maintain your own CTF infrastructure.
    • FBCTF - Platform to host Capture the Flag competitions from Facebook.
    • Haaukins - A Highly Accessible and Automated Virtualization Platform for Security Education.
    • HackTheArch - CTF scoring platform.
    • Mellivora - A CTF engine written in PHP.
    • MotherFucking-CTF - Badass lightweight plaform to host CTFs. No JS involved.
    • PicoCTF - The platform used to run picoCTF. A great framework to host any CTF.
    • RootTheBox - A Game of Hackers (CTF Scoreboard & Game Manager).
    • Scorebot - Platform for CTFs by Legitbs (Defcon).
    • SecGen - Security Scenario Generator. Creates randomly vulnerable virtual machines.
    • CTFd - Platform to host jeopardy style CTFs from ISISLab, NYU Tandon.
    • NightShade - A simple security CTF framework.

  • Steganography

    • Convert - Convert images b/w formats and apply filters.
    • Exiftool - Read and write meta information in files.
    • Image Steganography - Embeds text and files in images with optional encryption. Easy-to-use UI.
    • ImageMagick - Tool for manipulating images.
    • Pngtools - For various analysis related to PNGs.
    • SmartDeblur - Used to deblur and fix defocused images.
    • SteganographyOnline - Online steganography encoder and decoder.
    • Stegbreak - Launches brute-force dictionary attacks on JPG image.
    • StegCracker - Steganography brute-force utility to uncover hidden data inside files.
    • stegextract - Detect hidden files and text in images.
    • Stegsolve - Apply various steganography techniques to images.
    • AperiSolve - Aperi'Solve is a platform which performs layer analysis on image (open-source).
    • Convert - Convert images b/w formats and apply filters.
    • Stegsolve - Apply various steganography techniques to images.
    • Steghide - Hide data in various kind of images.
    • StegOnline - Conduct a wide range of image steganography operations, such as concealing/revealing files hidden within bits (open-source).

  • Web

    • Hackbar - Firefox addon for easy web exploitation.
    • OWASP ZAP - Intercepting proxy to replay, debug, and fuzz HTTP requests and responses
    • Raccoon - A high performance offensive security tool for reconnaissance and vulnerability scanning.
    • W3af - Web Application Attack and Audit Framework.
    • CHYbeta/Code-Audit-Challenges - vulnerable code snippets can be used for source code audit challenges (in Chinese)
    • Uglify
    • SQLMap - Automatic SQL injection and database takeover tool.
    • Metasploit JavaScript Obfuscator
    • BurpSuite - A graphical tool to testing website security.
    • Commix - Automated All-in-One OS Command Injection and Exploitation Tool.

  • Attacks

    • Bettercap - Framework to perform MITM (Man in the Middle) attacks.
    • Yersinia - Attack various protocols on layer 2.

  • Crypto

    • FeatherDuster - An automated, modular cryptanalysis tool.
    • RSACTFTool - A tool for recovering RSA private key with various attack.
    • RSATool - Generate private key with knowledge of p and q.
    • XORTool - A tool to analyze multi-byte xor cipher.
    • PkCrack - A tool for Breaking PkZip-encryption.
    • Hash Extender - A utility tool for performing hash length extension attacks.
    • padding-oracle-attacker - A CLI tool to execute padding oracle attacks.

  • Bruteforcers

    • Hashcat - Password Cracker
    • Turbo Intruder - Burp Suite extension for sending large numbers of HTTP requests
    • Nozzlr - Nozzlr is a bruteforce framework, trully modular and script-friendly.
    • Patator - Patator is a multi-purpose brute-forcer, with a modular design.

  • Exploits

  • Operating Systems

  • Tutorials

  • Websites

  • Wikis

    • Bamboofox - Chinese resources to learn CTF
    • CTF-Wiki - Open Wiki for beginners in CTFs (in Chinese and English)
    • CTF-Wiki - Open Wiki for beginners in CTFs (in Chinese and English)
    • bi0s Wiki - Wiki from team bi0s.
    • CTF Cheatsheet - CTF tips and tricks.
    • OpenToAll - Open To All Knowledge Base

  • PHP

  • Uncategorized

  • Services

    • CSWSH - Cross-Site WebSocket Hijacking Tester.
    • CSWSH - Cross-Site WebSocket Hijacking Tester.

  • Starter Packs

    • CTF Tools - Collection of setup scripts to install various security research tools.
    • LazyKali - A 2016 refresh of LazyKali which simplifies install of tools and configuration.

  • Java

    • CSPF-Founder/JavaVulnerableLab - this app is intended for the Java Programmers and other people who wish to learn about Web application vulnerabilities and write secure code
    • find-sec-bugs/juliet-test-suite - a collection of test cases in the Java language. It contains examples for 112 different CWEs.
    • Web Goat - a deliberately insecure web application maintained by OWASP designed to teach web application security lessons

  • NodeJS

    • DVNA - a Damn Vulnerable NodeJS Application which is powered by commonly used libraries such as express, passport, sequelize, etc.
    • OWASP/NodeGoat - The OWASP NodeGoat project provides an environment to learn how OWASP Top 10 security risks apply to web applications developed using Node.js and how to effectively address them

  • Android

    • abhi-r3v0/EVABS - an open source Android application that is intentionally vulnerable so as to act as a learning platform for Android application security beginners

  • Real World DVA

    • Medicean/VulApps - yet another ***vulhub*** like project (in Chinese)
    • nixawk/labs - a collection of some CVE vulnerable apps / samples / PoCs
    • vulhub - Pre-Built Vulnerable Environments Based on Docker-Compose https://vulhub.org
Programming Languages
Python 34 PHP 6 C 5 Shell 4 Go 3 Java 3 HTML 2 Ruby 2 Rust 2 C++ 2
Categories
Reversing 33 Wargames 32 Forensics 17 Steganography 16 Platforms 12 Web 10 Operating Systems 10 Tutorials 10 Writeups Collections 9 Exploits 7 Networking 7 Crypto 7 Wikis 6 Bruteforcers 4 PHP 4 Real World DVA 3 Websites 3 Java 3 Python 2 Attacks 2 NodeJS 2 Uncategorized 2 Starter Packs 2 Services 2 Android 1
Sub Categories
Uncategorized 2
Keywords
security 14 ctf 14 python 12 reverse-engineering 9 pentesting 6 exploit 6 vulnerable 5 hacking 5 vulnerability-scanner 4 linux 4 cryptography 4 pwn 4 docker 4 pwnable 3 hacking-tool 3 exploitation 3 capture-the-flag 3 android 3 gdb 3 nodejs 3 web 3 crypto 3 python3 2 rop 2 binary-analysis 2 x86 2 hackthebox 2 detection 2 cryptanalysis 2 encryption 2 dex 2 cve 2 windows 2 sql-injection 2 takeover 2 cybersecurity 2 golang 2 decompiler 2 scanner 2 virtualization 2 instrumentation 2 ctf-challenges 2 security-scanner 2 pentest 2 ctf-platform 2 gef 2 vulnerabilities 2 ctf-framework 2 disassembler 2 ida-pro 2