Skip to content

Latest commit

 

History

History
407 lines (322 loc) · 23.3 KB

CTF_Resources_List.md

File metadata and controls

407 lines (322 loc) · 23.3 KB
Raw

CTF Resources List

List of lists

Lists which have inspired this one

Tools for Creation

Frameworks

Frameworks for hosting CTFs

  • collabCTF - CTF framework written in Django; not maintained
  • Mellivora - CTF engine written in PHP
  • CTFd - Easy to use framework in Flask
  • Wrath CTF Framework - CTF Framework based on Redis
  • CTF - CTF Flask framework
  • OWASP CTF - Web based hacking challenge application
  • Attack Defense CTF Framework - Minimal attack and defense CTF setup based on the LAMPP stack
  • mkctf - A CTF framework to create, build, deploy and test challenges
  • LibCTF - CTF exploit development and other tools of pwnage
  • NightShade - A simple capture the flag framework based on Django
  • Puzzle Hero - SCS Concordia's CTF platform based on sqlalchemy and vue.js frontend
  • PACTF - CTF framework and website based on Django
  • HackTheArch - CTF scoring server with Ruby on Rails
  • AppJailLauncher - CTF Framework for Windows
  • Scorebot - Ruby scoring framework; not maintained
  • OpenCTF - CTF framework written in Go
  • CTF Framework - CTF framework written in Ruby
  • PicoCTF Old Platform - Not maintained
  • PicoCTF Platform 2 - Infrastructure on which picoCTF 2014 ran
  • PicoCTF Platform - The platform used to run picoCTF
  • iCTF Framework - framework that the UC Santa Barbara Seclab uses to host the iCTF
  • Root the Box - real-time capture the flag (CTF) scoring engine IN Python
  • FBCTF - Easy to use platform to host Capture the Flag competitions
  • SecGen - Creates VMs which have random vulnerabilities

Web

Reverse Engineering

Cryptography

Exploitation

Forensics

Networking

Misc

Solving Tools

General

Toolpacks

OS

Web

Tools used for solving Web challenges

  • BurpSuite - A graphical tool to testing website security.
  • Commix - Automated All-in-One OS Command Injection and Exploitation Tool.
  • Hackbar - Firefox addon for easy web exploitation
  • OWASP ZAP - Intercepting proxy to replay, debug, and fuzz HTTP requests and responses
  • Postman - Add on for chrome for debugging network requests
  • SQLMap - Automatic SQL injection and database takeover tooli
  • W3af - Web Application Attack and Audit Framework.
  • XSSer - Automated XSS testor

Reverse Engineering

Tools used for solving Reversing challenges

  • Androguard - Reverse engineer Android applications
  • Angr - platform-agnostic binary analysis framework
  • Apk2Gold - Yet another Android decompiler
  • ApkTool - Android Decompiler
  • Barf - Binary Analysis and Reverse engineering Framework
  • Binary Ninja - Binary analysis framework
  • BinUtils - Collection of binary tools
  • BinWalk - Analyze, reverse engineer, and extract firmware images.
  • Boomerang - Decompile x86 binaries to C
  • ctf_import – run basic functions from stripped binaries cross platform
  • GDB - The GNU project debugger
  • GEF - GDB plugin
  • Hopper - Reverse engineering tool (disassembler) for OSX and Linux
  • IDA Pro - Most used Reversing software
  • Jadx - Decompile Android files
  • Java Decompilers - An online decompiler for Java and Android APKs
  • Krakatau - Java decompiler and disassembler
  • PEDA - GDB plugin (only python2.7)
  • Pin A dynamic binary instrumentaion tool by Intel
  • Plasma - An interactive disassembler for x86/ARM/MIPS which can generate indented pseudo-code with colored syntax.
  • Pwndbg - A GDB plugin that provides a suite of utilities to hack around GDB easily.
  • radare2 - A portable reversing framework
  • Uncompyle - Decompile Python 2.7 binaries (.pyc)
  • WinDbg - Windows debugger distributed by Microsoft
  • Xocopy - Program that can copy executables with execute, but no read permission
  • Z3 - A theorem prover from Microsoft Research
  • OllyDBG - x86 Debugger
  • IDA Pro - Interactive Disassembler
  • strace - Debuuging utility for Linux

JavaScript Deobfustcators

  • Detox - A Javascript malware analysis tool
  • Revelo - Analyze obfuscated Javascript code

SWF Analyzers

  • RABCDAsm - Collection of utilities including an ActionScript 3 assembler/disassembler.
  • Swftools - Collection of utilities to work with SWF files
  • Xxxswf - A Python script for analyzing Flash files.

Cryptography

  • FeatherDuster - An automated, modular cryptanalysis tool
  • Hash Extender - A utility tool for performing hash length extension attacks
  • PkCrack - A tool for Breaking PkZip-encryption
  • RSACTFTool - A tool for recovering RSA private key with various attack
  • RSATool - Generate private key with knowledge of p and q
  • XORTool - A tool to analyze multi-byte xor cipher
  • HashID - Software to identify the different types of hashes

Exploitation

  • DLLInjector - Inject dlls in processes
  • libformatstr - Simplify format string exploitation.
  • Metasploit - Penetration testing software
  • one_gadget - A tool to find the one gadget execve('/bin/sh', NULL, NULL) call
    • gem install one_gadget
  • Pwntools - CTF Framework for writing exploits
  • Qira - QEMU Interactive Runtime Analyser
  • ROP Gadget - Framework for ROP exploitation
  • V0lt - Security CTF Toolkit

Forensics

Bruteforcers

Networking

Tools used for solving Networking challenges

  • Bro - An open-source network security monitor
  • Masscan - Mass IP port scanner, TCP port scanner
  • Monit - A linux tool to check a host on the network (and other non-network activities)
  • Nipe - Nipe is a script to make Tor Network your default gateway
  • Nmap - An open source utility for network discovery and security auditing
  • Wireshark - Analyze the network dumps
    • apt-get install wireshark
  • Zmap - An open-source network scanner

Attack Vectors

  • Bettercap - Framework to perform MITM (Man in the Middle) attacks
  • Layer 2 attacks - Attack various protocols on layer 2

Misc

Learning Resources

Getting Started

General

OS

Web

Cross-site scripting (XSS)

Cross-Site Request Forgery (CSRF)

Local File Inclusion (LFI)

Remote File Inclusion (RFI)

SQL-Injection (SQLi)

LDAP Injection

Path Traversal

Cookies

Command Injection

Languages / Databases

Reverse Engineering

Obfuscation

Cryptography

Exploitation

Forensics

Languages

Tutorials

Tutorials to learn how to play CTFs

Wargames

Always online CTFs

Self-hosted CTFs

Websites

Various general websites about and on ctf

CTFs

Lists of CTFs
wechall (excellent list of challenge sites)
forgottensec (good CTF wiki, though focused on CCDC)
shell-storm (great archive of CTFs)
captf

CTF Literature

Wikis

Various Wikis available for learning about CTFs

Writeups Collections

Collections of CTF write-ups

Misc

Stackexchange
Stackoverflow
Quora
Wikipedia
Wolfram
Reddit