Everything the team reaches for — CTF, red team, blue team, OSINT, forensics, wireless and living-off-the-land, plus the one-liners we retype every engagement. Search, filter by tag, and click any code block to copy it.
Preprint archive listing for the cryptography-and-security category, where much academic security research appears months before formal conference publication.
Recovers the internal keys of legacy ZipCrypto encryption via a known-plaintext attack — give it a few known bytes from any file in the archive and it derives the keys to decrypt the rest.
bkcrack -C secret.zip -c cipher.bin -p plain.bin
Complete number field sieve implementation for factoring very large RSA moduli — the tool of last resort once yafu/msieve are too slow for the key size involved.
Automated decoding tool that tries to work out what encoding or cipher was used on a blob of text (base64, ROT13, Vigenère, hashes, and combinations of them) without being told.
ciphey -t "encrypted text"
Cracks the BLE Legacy Pairing key exchange from a captured connection and decrypts the traffic — the classic demonstration of why "Just Works" BLE pairing is not actually secure.
crackle -i capture.pcap -o decrypted.pcap
Gamified platform for learning cryptography by breaking progressively harder CTF-style crypto challenges, from classical ciphers through RSA, ECC and modern primitives.
Visual, drag-and-drop workbench for building cryptanalysis pipelines — includes ready-made attacks on historical ciphers (Enigma, Vigenère, classical substitution) alongside modern crypto demos.
GCHQ's "Cyber Swiss Army Knife" — a browser-based drag-and-drop pipeline for encoding, decoding, encryption and data-format transforms, arguably the single most-used CTF crypto/forensics tool there is.
A more rigorous battery of statistical randomness tests than ent, used to characterise a suspiciously weak or predictable PRNG behind a CTF crypto challenge.
dieharder -a -g 201 -f random_output.bin
Small statistical test suite measuring the randomness quality (entropy, chi-square, serial correlation) of a byte stream — a quick sanity check for whether a CTF crypto challenge's 'random' keystream actually is.
ent ciphertext.bin
Public database of pre-computed integer factorizations — before spinning up a sieve, check whether someone already factored the exact RSA modulus a challenge gave you.
NCC Group's automated cryptanalysis tool — feeds ciphertext through a battery of checks for weak or misused crypto (ECB, small keyspace, XOR, RSA flaws) rather than guessing by hand.
python featherduster.py
IDA/Ghidra plugin that scans a binary for known cryptographic constants (AES S-boxes, SHA/MD5 initialisation vectors, CRC tables) and flags exactly where a crypto routine sits.
Decodes, brute-forces and re-signs Flask's itsdangerous-based session cookie, recovering the app's SECRET_KEY from a wordlist and letting you forge an arbitrary session.
flask-unsign --unsign --cookie "<session_cookie>" --wordlist rockyou.txt
Lattice reduction library (LLL and BKZ) that underlies most CTF lattice attacks — Coppersmith's method, knapsack/subset-sum crypto, and small-root RSA attacks all reduce to a lattice problem this solves.
Python bindings for fplll, letting CTF crypto scripts build and reduce lattices directly instead of shelling out or reimplementing LLL from scratch.
Python bindings to GMP/MPFR/MPC for fast arbitrary-precision integer and rational arithmetic — nearly every from-scratch CTF crypto script leans on it instead of native Python ints for speed.
Marc Stevens' toolkit for generating MD5 and SHA-1 chosen-prefix collisions — the codebase behind the SHAttered attack, used in CTF challenges that ask you to produce two files with the same weak hash.
Performs the hash length extension attack against MD5/SHA1/SHA256/SHA512-based MACs, forging a valid hash for attacker-appended data without knowing the secret key.
hashpump -s <hash> -d <data> -k <keylen> -a <append>
The cryptography community's own preprint repository — new attacks, protocols and proofs are posted here well before appearing at CRYPTO, EUROCRYPT or a journal.
A toolkit for testing, tampering with and cracking JSON Web Tokens — algorithm-confusion attacks, signature stripping, and a scan mode against a list of known JWT misconfigurations.
python3 jwt_tool.py <token> -T
Fast implementation of the quadratic sieve and number field sieve for integer factorization, one of the tools yafu calls out to for larger moduli.
./msieve -f n
openssl is on almost every box already; this is the fastest way to symmetrically encrypt/decrypt a file for exfiltration without pulling in gpg.
openssl enc -aes-256-cbc -salt -in loot.tar -out loot.tar.enc -k <passphrase> # decrypt: openssl enc -d -aes-256-cbc -in loot.tar.enc -out loot.tar -k <passphrase>
Automates padding oracle attacks against CBC-mode ciphertext (cookies, tokens) when an application leaks a distinguishable error for bad padding.
perl padbuster.pl http://target/ <encrypted> 8 -cookies "auth=<value>"
Fast CLI/library for exploiting CBC padding oracles, decrypting or forging ciphertext by repeatedly resubmitting modified blocks and reading the oracle's pad-valid/invalid signal.
padding-oracle-attacker decrypt -u https://target/decrypt --data "$CT" --error-string "invalid padding"
Offline WPS PIN recovery from a single handshake exchange (the "pixie dust" attack) against APs with weak random-number generation, instead of an online brute force.
pixiewps -e <PKE> -r <PKR> -s <E-Hash1> -z <E-Hash2> -a <Authkey> -n <E-Nonce>
Python library implementing several integer factorization algorithms (Pollard rho, Pollard p-1, ECM, multi-polynomial quadratic sieve) as an importable factor() function for solve scripts.
python3 -c "import primefac; print(list(primefac.primefac(N)))"
Self-contained Python cryptographic library (the maintained successor to the abandoned PyCrypto) providing AES/RSA/hashing primitives used in the overwhelming majority of CTF crypto solve scripts.
Checks FactorDB's public database for a known factorization of an RSA modulus before spending time on local factoring tools — a very common first move in CTF RSA challenges.
curl -s "http://factordb.com/api?query=$N" | python3 -m json.tool
Automates a long list of known RSA attacks (Wiener, Fermat, common factor, small e, Coppersmith and more) against a given public key, and decrypts the ciphertext if one lands.
python3 RsaCtfTool.py --publickey key.pub --uncipherfile flag.enc
Derives a complete RSA private key from any sufficient subset of known parameters (p, q, n, e, d, phi) — handy when a CTF challenge leaks partial key material instead of the full key.
rsatool.py -p <p> -q <q> -e 65537 -o key.pem
Full computer algebra system with deep number-theory and elliptic-curve support — the usual scripting environment for hand-rolled RSA/ECC/lattice attacks that go beyond canned tools.
sage -c "print(factor(n))"
Checks a server's TLS/SSL configuration from the command line — supported protocols and ciphers, certificate details, and known vulnerabilities like Heartbleed or POODLE — no browser or Qualys quota needed.
./testssl.sh https://target.tld
Recovers a repeating XOR key by XOR-ing ciphertext against a guessed plaintext fragment (a crib like "flag{"), a fast manual technique when the key is shorter than or equal to the crib.
python3 -c "
ct = bytes.fromhex('...')
crib = b'flag{'
print(bytes(c ^ k for c, k in zip(ct, crib)))
"
Guesses the key length of a repeating-key XOR ciphertext from character-frequency analysis, then recovers the most likely key.
xortool ciphertext.bin -l 4
"Yet Another Factoring Utility" — automatically picks and runs the best available factoring algorithm (ECM, SIQS, NFS) for a given integer, useful once a modulus is too big for trial division.
./yafu "factor(n)"
Microsoft's SMT solver, used constantly in CTF reversing and crypto to turn 'find x such that these constraints hold' into a script instead of manual algebra — a frequent shortcut past custom validation logic.
python3 -c "
from z3 import *
x = BitVec('x', 32)
s = Solver()
s.add(x * 3 + 7 == 100)
print(s.check(), s.model())
"
Microsoft Research's SMT solver, scripted from Python to encode a challenge's constraints (a keygen check, a crypto relation, a logic puzzle) and let the solver produce a satisfying input.
python3 -c "from z3 import *; s = Solver()"