ctf-literature - Collection of free books, papers and articles rela

项目说明

CTF Literature
==============

Collection of free books, papers and articles related to CTF challenges.

How To Get Started In CTF
<br>
CTFtime
<br>
Hack.lu (2014) Writeups

Web

#### Cross-site scripting (XSS)
* OWASP - XSS)
* OWASP - XSS Filter E Cheat Sheet
* DOM Clobbering
* HTML Markup Injection
* Testing For Reflected XSS)
* Testing For Stored XSS)
* Testing For DOM-based XSS)

#### Cross-Site Request Forgery (CSRF)
* OWASP - CSRF)
* Testing For CSRF)

#### Local File Inclusion (LFI)
* Testing For LFI

#### Remote File Inclusion (RFI)
* Testing for RFI
* CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program

#### SQL-Injection (SQLi)
* OWASP - SQLi
* Testing For SQL Injections)
* SQL Backdoors
* Bypassing Modern SQL Injection Security Measures
* 9.6 Comment Syntax
* Cheat Sheets
* [[video] Ad SQL Injection]()
* [[video] Defcon 18 - You Spent All That Money And You Still Got Owned]()

#### LDAP Injection
* OWASP - LDAP Injection
* Testing For LDAP Injection)
* LDAP Injection & Blind LDAP Injection

#### Path Tra
* OWASP - Path Tra
* Testing For Path Tra)

#### Cookies
* OWASP - Session Hijacking
* Cookies

#### Command Injection
* The Unexpected Dangers Of preg_replace()
* Exploiting PHP PCRE Functions

#### Languages / Databases
* PHP
* ASP.NET
* Node.js
* jQuery
* Ja
* Ruby

---

* MySQL
* MSSQL
* PostgreSQL
* SQLite
* Berkeley DB

#### Tools
* w3af - Web Application Attack and Audit Framework (Windows/Linux)
* Firefox - Addon Pack (Web Pen Testing)

#### Practice
* HackMe
* Damn Web Application (DVWA)
* Mutillidae
* OWASP Broken Web Applications Project

Reverse Engineering

#### Introduction To Reverse Engineering
* Reverse Engineering for Beginners
* Debugging With EDB

#### Obfuscation
* ELF Obfuscation: Let Analysis Tools Show Wrong External Symbol Calls

#### Tools
* OllyDBG (x86 Debugger)
* IDA Pro (Interacti)
* strace (Linux)

#### Practice
* Crackmes.de

Crypto

#### Introduction To Crypto
* Learn Cryptography
* Cryptography World

#### Tools
* HashID (Identify Hashes)

Exploitation

#### Introduction To Exploitation
* The Linux man-pages Project
* Special File Permissions (setuid, setgid and Sticky Bit)
* Linux Users and Groups

#### Format String Attakcs
* Exploiting Format String

#### Off-By-One Attacks
* Off-by-One Exploitation Tutorial

#### Tools
* Metasploit

#### Practice
* Exploit Exercises

Forensics

#### Introduction To Forensics
* List Of File Signatures (Magic Numbers)

#### Tools
* Top 20 Free Forensics Tools

项目信息

开发语言：HTML

Star 数：388

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Collection of free books, papers and articles related to CTF challenges.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。