ctf-tools - Some setup scripts for security research tools.

项目说明

ctf-tools

This is a Nix flake packaging security research tools.
Of course, this isn't a hard problem, but it's really nice to have them in one place that's easily deployable to new machines and so forth.
CI e the catalog and builds the repository-packaged x86_64 tools every day, so breakage should be caught quickly.

The following tools are included. The first table lists tools packaged in this repo (under nix/pkgs/); the second lists tools taken from nixpkgs.

NIX??????

Long-time ctf-tools users might be surprised by this de, but it is a good de.
Nix provides isolated packaging and can be deployed into a dev/hack en, locally into a user's home directory, or globally system/container-wide.
It also happily installs alongside your normal OS and package manager (e.g., ubuntu and apt) with zero interference.
Trust me, I was as skeptical as you are for years, but it is the way.

Packaged in this repo

| Category | Tool | Description |
|----------|------|-------------|
| binary | angr | Next-generation binary analysis 引擎 from Shellphish. | <!--tool-->
| binary | angr-management | A 界面 reverse engineering and decompilation 工具. | <!--tool-->
| binary | beef | !Last Build Browser exploitation 框架. | <!--tool-->
| binary | crosstool | !Last Build Cross-compilers and cross-architecture tools. | <!--tool-->
| binary | cross2 | A set of cross-compilation tools from a Japanese book on C. | <!--tool-->
| binary | decomp2dbg | !Last Build A plugin to introduce interacti into your debugger from your decompiler. | <!--tool-->
| binary | deepmage | Terminal hex editor for bit-level and non-octet-oriented data. | <!--tool-->
| binary | elfparser | !Last Build Multiplatform CLI and 界面 工具 to show information about ELF files. | <!--tool-->
| binary | e | !Last Build 工具 to create MD5 colliding binaries | <!--tool-->
| binary | forkever | Debugger with fork-based checkpoints for exploit de. | <!--tool-->
| binary | ida | Decompilation and re 工具 (proprietary: you download it yourself — drop the Hex-Rays tarball in ~/Downloads, or set IDA_HOME to an unpacked install). | <!--tool-->
| binary | ida-pro-mcp | MCP 服务端 that drives IDA Pro (headless , or attached to a running IDA; set up with ida --acti). | <!--tool-->
| binary | kuna | An agent-first decompiler in Rust, originally ported from Ghidra's decompiler. | <!--tool-->
| binary | manticore | !Last Build Manticore is a prototyping 工具 for dynamic binary analysis, with support for symbolic execution, taint analysis, and binary instrumentation. | <!--tool-->
| binary | patchkit | Python toolkit for patching ELF binaries. | <!--tool-->
| binary | preeny | !Last Build A collection of helpful preloads (compiled for 64- and 32-bit x86). | <!--tool-->
| binary | pwndbg | !Last Build Enhanced en for gdb. Especially for pwning. | <!--tool-->
| binary | pwnsh | !Last Build Useful shell scripts for assembly, exploitation, etc. | <!--tool-->
| binary | qiling | A dynamic binary instrumentation 框架. Entry point is qltool. | <!--tool-->
| binary | qira | !Last Build Parallel, timeless debugger. | <!--tool-->
| binary | reko | General-purpose machine-代码 decompiler. Entry point is reko. | <!--tool-->
| binary | shellnoob | !Last Build Shellcode writing helper. | <!--tool-->
| binary | taintgrind | !Last Build A taint analysis 工具. Builds and runs, but upstream's IR translator aborts on many binaries (tnt_translate: expr2). | <!--tool-->
| binary | | !Last Build of heap operations. | <!--tool-->
| binary | xrop | !Last Build Gadget finder. | <!--tool-->
| mobile | frick | Interacti built on Frida. | <!--tool-->
| forensics | firmware-mod-kit | !Last Build Tools for firmware packing/unpacking. | <!--tool-->
| forensics | origami-pdf | Ruby 框架 and command-line tools for parsing and manipulating PDF files. | <!--tool-->
| forensics | peepdf | !Last Build Powerful Python 工具 to analyze PDF documents. | <!--tool-->
| forensics | scrdec18 | !Last Build A decoder for encoded Windows Scripts. | <!--tool-->
| forensics | | !Last Build Analyzer for system memory dumps (classic Python 2 with its runtime included). | <!--tool-->
| crypto | codext | !Last Build Python codecs extension featuring CLI tools for encoding/decoding anything including AI-based guessing mode. | <!--tool-->
| crypto | cribdrag | !Last Build Interactive crib dragging 工具 (for crypto). | <!--tool-->
| crypto | fastcoll | !Last Build An md5sum collision generator. | <!--tool-->
| crypto | foresight | !Last Build A 工具 for predicting the output of random number generators. To run, launch "foresee". | <!--tool-->
| crypto | featherduster | !Last Build An automated, modular cryptanalysis 工具. Its Python 2 runtime is included in the package. | <!--tool-->
| crypto | galois | !Last Build A fast galois field arithmetic library/toolkit. | <!--tool-->
| crypto | hashpump-partialhash | Hashpump, supporting partially-unknown hashes. | <!--tool-->
| crypto | libc-database | !Last Build Build a 数据库 of libc offsets to simplify exploitation. Ships the scripts only: run libc-database-get all once to populate the database. | <!--tool-->
| crypto | nonce-disrespect | !Last Build Nonce-Disrespecting Ad: Practical Forgery Attacks on GCM in TLS. | <!--tool-->
| crypto | pemcrack | !Last Build SSL PEM file cracker. | <!--tool-->
| crypto | reveng | !Last Build CRC finder. | <!--tool-->
| crypto | rsactftool | !Last Build RSA attack tool. | <!--tool-->
| crypto | ssh_decoder | !Last Build A 工具 for decoding SSH traffic from hosts affected by the Debian OpenSSL PRNG bug. Its Ruby runtime is included. | <!--tool-->
| crypto | yafu | !Last Build Automated integer factorization. | <!--tool-->
| web | burpsuite | Web proxy to do naughty web stuff. | <!--tool-->
| web | subbrute | !Last Build A DNS meta-query spider that enumerates DNS records, and subdomains. | <!--tool-->
| web | webgrep | !Last Build grep for Web pages, with JS deobfuscation, CSS unminifying and OCR on images. | <!--tool-->
| stego | steganabara | !Last Build Another image stenography solver. | <!--tool-->
| stego | stegano-tools | !Last Build A collection of text and image steganography tools (incl LSB, PVD, PIT). | <!--tool-->
| stego | stegdetect | !Last Build Stenography detection/breaking 工具. | <!--tool-->
| stego | stegosaurus | !Last Build A steganography 工具 for embedding arbitrary payloads in Python bytecode (pyc or pyo) files. | <!--tool-->
| misc | jdgui | !Last Build Ja. | <!--tool-->
| misc | python2 | !Last Build For when you really need it... | <!--tool-->
| misc | social-analyzer | !Last Build Social media reconnaissance 工具... | <!--tool-->
| misc | veles | !Last Build Binary data analysis and 工具. | <!--tool-->
| misc | xspy | !Last Build Tiny 工具 to spy on X sessions. | <!--tool-->
| game | df | !Last Build Dwarf Fortress! Something to help you relax after a CTF! | <!--tool-->

From nixpkgs

| Category | Tool | Description |
|----------|------|-------------|
| binary | aflplusplus | Modern co fuzzer. | <!--tool-->
| binary | checksec | Reports executable hardening features. | <!--tool-->
| binary | elfkickers | Utilities for manipulating ELF files. | <!--tool-->
| binary | gdb | GDB with Python 3 scripting and support for many targets. | <!--tool-->
| binary | gef | Enhanced en for GDB. | <!--tool-->
| binary | ghidra | Open-源码 reverse engineering and decompilation 工具. | <!--tool-->
| binary | grap | Defines and matches graph patterns in binaries. | <!--tool-->
| binary | honggfuzz | General-purpose security-oriented fuzzer. | <!--tool-->
| binary | imhex | Extensible graphical hex editor. | <!--tool-->
| binary | one_gadget | Finds one-shot 代码-execution gadgets in libc. | <!--tool-->
| binary | poke | Extensible editor for structured binary data. | <!--tool-->
| binary | pwninit | Automates preparing binary-exploitation challenges. | <!--tool-->
| binary | pwntools | Python 框架 and utilities for exploit de. | <!--tool-->
| binary | qemu | Full-system and user-mode machine emulator. | <!--tool-->
| binary | radare2 | Re framework and command-line toolkit. | <!--tool-->
| binary | rappel | Linux assembly REPL. | <!--tool-->
| binary | rizin | Re framework forked from radare2. | <!--tool-->
| binary | ropper | ROP gadget finder and binary analysis utility. | <!--tool-->
| binary | rp++ | Fast ROP gadget finder. | <!--tool-->
| binary | rr | Record-and-replay debugger. | <!--tool-->
| binary | seccomp-tools | Utilities for seccomp analysis. | <!--tool-->
| binary | upx | Executable packer and unpacker. | <!--tool-->
| binary | | Dynamic instrumentation 框架 and debugging tools. | <!--tool-->
| binary | wcc | Witchcraft Compiler Collection for binary analysis. | <!--tool-->
| mobile | apktool | Decodes and rebuilds Android APK resources. | <!--tool-->
| mobile | dex2jar | Tools for Android DEX and Ja files. | <!--tool-->
| mobile | frida-tools | Command-line tools for Frida dynamic instrumentation. | <!--tool-->
| mobile | jadx | Dex-to-Ja with CLI and GUI frontends. | <!--tool-->
| forensics | autopsy | Graphical digital-forensics platform. | <!--tool-->
| forensics | binwalk | Firmware and embedded-file analysis 工具. | <!--tool-->
| forensics | dislocker | Reads BitLocker-encrypted . | <!--tool-->
| forensics | exiftool | Reads and writes file metadata. | <!--tool-->
| forensics | foremost | File car on headers and footers. | <!--tool-->
| forensics | pdf-parser | Inspects objects and streams in PDF files. | <!--tool-->
| forensics | sleuthkit | Filesystem and disk-image analysis toolkit. | <!--tool-->
| forensics | testdisk | Partition recovery and file undelete tools. | <!--tool-->
| forensics | | Current memory-forensics framework. | <!--tool-->
| forensics | yara | Pattern-matching 引擎 for malware and forensic artifacts. | <!--tool-->
| crypto | hash-identifier | Identifies likely hash algorithms. | <!--tool-->
| crypto | hashcat | GPU-accelerated password recovery 工具. | <!--tool-->
| crypto | hydra | Parallel network-login cracker. | <!--tool-->
| crypto | john | John the Ripper password cracker. | <!--tool-->
| crypto | msieve | Integer factorization library and application. | <!--tool-->
| crypto | pkcrack | Classic PKZIP known-plaintext attack. | <!--tool-->
| crypto | sage | Mathematics system useful for cryptanalysis and algebra. | <!--tool-->
| crypto | xortool | Repeating-key XOR analysis tool. | <!--tool-->
| crypto | z3 | SMT theorem prover and constraint solver. | <!--tool-->
| networking | bettercap | 网络 reconnaissance and attack 框架. | <!--tool-->
| networking | dsniff | 网络 auditing and traffic-analysis tools. | <!--tool-->
| networking | nmap | Network discovery and port scanner. | <!--tool-->
| networking | socat | Bidirectional relay for sockets and many other streams. | <!--tool-->
| networking | sslsplit | SSL/TLS interception proxy. | <!--tool-->
| networking | tshark | Command-line packet analyzer from Wireshark. | <!--tool-->
| web | commix | Command-injection discovery and exploitation 工具. | <!--tool-->
| web | dirb | Web content scanner. | <!--tool-->
| web | dirsearch | Web path scanner. | <!--tool-->
| web | feroxbuster | Fast recursi tool. | <!--tool-->
| web | ffuf | Fast web fuzzer. | <!--tool-->
| web | mitmproxy | Interactive HTTP interception proxy and Python library. | <!--tool-->
| web | nikto | Web-ser. | <!--tool-->
| web | sqlmap | SQL-injection detection and exploitation 引擎. | <!--tool-->
| web | tor-browser | Tor-enabled browser bundle. | <!--tool-->
| web | wfuzz | Web application fuzzer. | <!--tool-->
| web | xsstrike | Cross-site scripting detection and exploitation suite. | <!--tool-->
| stego | pngtools | Utilities for inspecting PNG files. | <!--tool-->
| stego | sonic- | Audio and analysis application. | <!--tool-->
| stego | stegsolve | Image steganography solver. | <!--tool-->
| stego | zsteg | Detects data hidden in PNG and BMP images. | <!--tool-->
| osint | sherlock | Finds accounts by username across social networks. | <!--tool-->

Usage

Every 工具 is a flake output. To use, do:

A bin/manage-tools wrapper around nix profile is also provided, for the familiar CLI:

Tools install into your Nix profile, and uninstalling removes them cleanly.
The three aggregate names install as single profile entries, so Nix shares
common dependencies and does not activate a partial set if a build fails.
manage-tools prints Nix's download/build plan before installing an aggregate.
On ARM, all contains every supported catalog 工具; the generated toolchain
aggregates are x86_64-only.

Downloads outside Nix

Package inputs are downloaded by Nix and pinned by SHA-256, including the two
legacy plain-HTTP sources (steganabara and pkcrack's fallback mirror). A
服务端 or 网络 attacker can make those fetches una, but cannot make
Nix accept different bytes under the recorded hash.

The exceptions are:

libc-database-get all downloads the multi-gigabyte libc corpus into the

user's data directory after installation.

IDA itself is downloaded by the user from Hex-Rays. The ida wrapper can

unpack that local archive and activate the 's bundled idapro wheel;
acti tries an offline install first, with PyPI only as a fallback if
that wheel declares an una dependency.

Running the crosstool package's ct-ng dri downloads the

sources selected by the user's configuration. The prebuilt
crosstool-ng-* flake outputs instead fetch a hash-pinned 源码 set during
the Nix build and compile offline.

网络 scanners and clients naturally contact targets when run; that is 工具
operation, not package installation.

Platform support

The ordinary package set is a on both x86_64-linux and
aarch64-linux. Packages that nixpkgs or their upstream binary releases mark
as unsupported are omitted from the ARM package set instead of making the
whole profile fail to e.

The generated cross2-* and crosstool-ng-* toolchain outputs are x86_64-only.
ARM packages are e by CI, but are not built or uploaded to the
size-limited ctftools Cachix cache; ARM users build repository-packaged tools
locally. Tools forwarded unchanged from nixpkgs can still substitute from
cache.nixos.org on either architecture.

Cross-compiler toolchains (cross2, crosstool)

On x86_64, two of the tools are toolchain *builders* rather than single programs, so they
expose one output per target instead of one output o. Install only the
target you need — each is an independent package.

crosstool is the crosstool-NG ct-ng
driver, and *only* the driver — unlike the old shell 工具, it puts no cross
compilers on your PATH. Installing crosstool gives you ct-ng itself, ready
to build your own toolchain from a config:

The compilers themselves are separate outputs: 77 of crosstool-NG's 146 samples
are prebuilt as crosstool-ng-<sample>, so you can install a ready-made
toolchain (say, arm-none-eabi-gcc) instead of spending an hour building one:

The sample name is the crosstool-NG sample id with any character outside
[a-zA-Z0-9_-] replaced by - (so x86_64-ubuntu16.04-linux-gnu becomes
crosstool-ng-x86_64-ubuntu16-04-linux-gnu).

The other 69 samples that ct-ng list-samples prints have no
crosstool-ng-* output — build them yourself with ct-ng <sample> && ct-ng
build, or pin one as a flake output by running
nix/pkgs/crosstool/pin-samples.sh and folding the hash it prints into
nix/pkgs/crosstool/hashes.nix (anything in there is surfaced automatically).

cross2 is the companion toolchain set for the
kozos.jp assembly book — binutils 2.21.1 +
gcc 3.4.6 + newlib 1.20.0 (+ gdb 7.3.1 where it still builds, or just its CPU
simulator, <target>-run, where it does not), for 34
mostly-retro bare-metal targets. Installing cross2 gives you the book's six
"major architecture" toolchains (arm, h8300, i386, mips, powerpc, sh); the other
targets are indi cross2-<target> outputs:

These are large, from-源码 gcc builds, so install them with the binary
cache configured — otherwise Nix will build the whole toolchain
locally (tens of minutes to hours each).

Help!

Something not working?
I didn't write (almost) any of these tools, but hit up the discord if you're desperate.
Maybe some kind soul will help!

Binary cache

CI builds the x86_64 tools packaged in this repo and pushes them to a public Cachix cache, so x86_64 installs download prebuilt binaries instead of compiling.
Trusted Nix users pick this up automatically from the flake's nixConfig; otherwise run cachix use ctftools once (or pass --accept-flake-config).

ARM outputs are deliberately not pushed to this cache. Unchanged tools in the
"From nixpkgs" table use the official cache.nixos.org binary cache and do not
consume space in the ctftools cache. dirsearch is the exception on x86_64:
our setuptools compatibility o produces a distinct output, so CI caches
it alongside the tools packaged in this repository.

Dockerized Tools

You can get the tools packaged in this repo in prebuilt x86_64 containers from dockerhub.
For example:

The images are generated by CI, which installs the 工具 into a nixos/nix base with nix profile install.

Adding Tools

To add a tool (say, named *toolname*):

1. If it is already in nixpkgs, add a line to nix/passthrough.nix.
2. Otherwise, create nix/pkgs/toolname/default.nix — a callPackage-style deri with its sources pinned by hash — and build it with nix build .#toolname.
3. Add it to the README.

The flake discovers nix/pkgs/* automatically; the output name is the directory name.

License

The indi tools are all licensed under their own licenses.
As for ctf-tools itself, it is licensed under BSD 2-Clause License.
If you find it useful, star it on GitHub ().

Good luck!

See Also

There's a curated list of CTF tools, but without installers, here:

There's a config with a lot of the bigger frameworks here:

The old apt-only 工具 list has been fully migrated to Nix outputs.

Useful CTF tools in docker images

Pre, this repository included some scripts that were wrappers around docker pull.
We trust that you can do that yourself :-)

| Category | Source | Tool | Description |
|----------|--------|------|-------------|
| binary | docker | panda | Platform for Architecture-Neutral Dynamic Analysis. |
| stego | Docker | stego-toolkit | A docker image with dozens of steg tools. |

Useful CTF Libraries

Pre, this repository included library installers.
Because of how bespoke library install preferences are (e.g., unlike a 工具, it's not clear if per-library venvs are a desired thing), we' shipping them, and link them here for posterity.

| Category | Source | Tool | Description |
|----------|--------|------|-------------|
| binary | Library | capstone | Multi-architecture disassembly 框架. |
| binary | Library | keystone | Lightweight multi-architecture assembler 框架. |
| binary | Library | lief | Library to Instrument Executable Formats. |
| binary | Library | miasm | Reverse engineering 框架 in Python. |
| binary | Library | unicorn | Multi-architecture CPU emulator 框架. |
| binary | Library | | A nice library to interact with binaries. |
| crypto | Library | cryptanalib3 | The sur core of featherduster cryptanalysis 工具, updated for python3. |
| crypto | Library | python-paddingoracle | Padding oracle attack automation. |

项目信息

开发语言：Nix

Star 数：9535

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Some setup scripts for security research tools.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。