CTF-CheatSheet - All About CTFs

项目说明

CTF-CheatSheet

CTF

CTFTime<br>
O<br>
PicoCTF<br>
ImaginaryCTF<br>
247CTF<br>
CTF Challenge<br>
CTF Learn<br>
CryptoHack<br>
HackThisSite<br>
SmashTheStack<br>
W3Challs<br>
Ringzer0CTF<br>
Enigma Group<br>
Root Me

Pentesting

HackTheBox<br>
TryHackMe<br>
OffSec Proving Grounds<br>
Web Security Academy<br>
Damn Web Application<br>
OWASP Juice Shop<br>
Hacker 101<br>
PentesterLab<br>
<br>
<br>
HackingLab<br>
CyberSecLabs<br>
HackXOR<br>
Hacktoria

Pwn / RE

Pwn.College<br>
ROP Emporium<br>
Exploit Education<br>
How2Heap<br>
Pwnables<br>
Deusx64<br>
Roppers Academy<br>
Azeria Labs<br>
Re Challenges<br>
Begin RE<br>
CrackMes

Blue Team

LetsDefend<br>
Blue Team Labs Online<br>
Cyber Defenders<br>
Attack Defense<br>
Immersive Labs

Li<br>
John Hammond<br>
IppSec<br>
XCT<br>
Gynvael<br>
ZetaTwo<br>
PwnFunction<br>
0xdf<br>
247CTF<br>
MalFind<br>
DayZeroSec<br>
Rana Khalil<br>
PinkDraconian<br>
Superhero1<br>
S1lk<br>
Alh4zr3d<br>
Paweł Łukasik<br>
Ephemeral<br>
Hak5<br>
Conda<br>
HackerSploit<br>
Condingo<br>
InsiderPhd<br>
HackSplained<br>
TheCyberMentor<br>
StackSmashing<br>
Cybersecurity Meg<br>
Tib3rius<br>
SecAura<br>
DarkSec<br>
Hexorcist<br>
PwnCollege<br>
NahamSec<br>
Optional<br>
TheHackerish<br>
Ryan Gordon<br>
AlmondForce<br>
<br>
Others

Tools

Ghidra<br>
<br>
PwnTools<br>
CyberChef<br>
DCode<br>
Decompile Code<br>
Run Code<br>
GTFOBins<br>
ExploitDB<br>
Re

More Resources

Bug Bounty Platforms<br>
HackTricks<br>
CTF Resources<br>
Security Resources<br>
Bug Bounty Resources<br>
Seal9055 Resources<br>
Forensics<br>
Learn RE<br>
Learn BinExp<br>
HTB Writeups

!CTF

Welcome to the world of CTFs 🏴‍☠️

--------------------------

This is an introduction to some of the basics of each category. It was designed to help beginners and old comrades, enjoy the ride and "Pwn Every CTF".

Esoteric Languages
-----------------------

*

An online tool that has a ton of Esoteric language interpreters.

* Brainfuck

This language is easily detectable by its huge use of plus signs, braces, and arrows. There are plenty of online interpreters, like this one: Some example code:

* [Malboge]

An esoteric language that looks a lot like Base85... but isn't. Often has references to "Inferno" or "Hell" or "Dante." Online interpreters like so: Example code:

* [Piet]

A graphical programming language... looks like large 8-bit pixels in a of colors. Can be interpreted with the tool [npiet][npiet]

!

* Ook!

A joke language. Recognizable by . and ?, and !.

* Hexahue Cipher

![]()

Steganography
---------------------

* [StegCracker][StegCracker]

Don't e about [steghide][steghide]! This tool can use a password list like rockyou.txt with steghide. SOME IMAGES CAN HA FILED ENCODED WITH MULTIPLE PASSWORDS.

* steg_brute.py

This is similar to stegcracker above.

* [openstego][OpenStego]

A [Java][Java] [.JAR][JAR] tool, that can extract data from an image. A good tool to use on guessing challenges, when you don't have any other leads. We found this tool after the Misc50 challenge from HackIM 2018

* [Stegsolve.jar][Stegsolve.jar]

A [Java][Java] [.JAR][JAR] tool, that will open an image and let you as the user arrow through different renditions of the image ( color channels, in colors, and more). The tool is surprisingly useful.

* [steghide][steghide]

A command-line tool typically used alongside a password or key, that could be uncovered some other way when solving a challenge.

* [zsteg][zsteg]

Command-line tool for use against Least Significant Bit steganography... unfortunately only works against PNG and BMP images.

* [jsteg][jsteg]

Another command-line tool to use against JPEG images. Handy for Hackerrank Codefest CTF 2018.

* [Jstego][Jstego]

A GUI tool for JPG steganography. It is a [Java][Java] [JAR] file similar to stegsolve.jar

* Morse Code

Always test for this if you are seeing two distinct ... _it may not always be binary!_ Online decoders like so:

* Whitespace

Tabs and spaces could be representing 1's and 0's and treating them as a binary message... or, they could be whitespace done with [snow][snow] or an esoteric programming language interpreter:

* DNA Codes

When given a sequence with only A, C, G, T , there is an online mapping for these. Try this:

!img/dna_codes.png
!img/genome_coding.jpg

* [snow][snow]

A command-line tool for whitespace steganography (see above).

* SONIC (audio spectrum)

Some classic challenges use an audio file to hide a flag or other sensiti. SONIC easily shows you spectrogram. __If it sounds like there is random bleeps and bloops in the sound, try this tactic!__

* [Detect DTMF Tones]

Audio frequencies common to a phone button, DTMF:

* Phone-Keypad

Some messages may be hidden with a string of numbers, but really be encoded with old cell-phone keypads, like text messaging with numbers repeated:

!

* [hipshot][hipshot]

A [Python] module to compress a video into a single standalone image, simulating a long-exposure photograph. Was used to steal a [QR code] in a video, displayed through "Star Wars" style text motion.

* [QR code]

A small square "barcode" image that holds data.

* [zbarimg][zbarimg]

A command-line tool to quickly scan multiple forms of barcodes, [QR codes] included. Installed like so on a typical [Ubuntu] image:

* Punctuation marks !, . and ?

I have seen some challenges use just the end of . or ? or ! to represent the Ook esoteric programming language. Don't forget that is a thing!

Cryptography
-----------------

* Keyboard Shift

If you see any thing that has the shape of a sentence but it looks like nonsense letters, and notes some shift left or right, it may be a keyboard shift...

* Bit Shift

Sometimes the letters may be shifted by a stated hint, like a binary bit shift ( x >> 1 ) or ( x << 1 ).

* Re Text

Sometimes a "ciphertext" is just as easy as re text. Don't forgot to check under this rock! You can reverse a string in [Python] like so:

* XOR

ANY text could be XOR'd. Techniques for this are Trey's code, and XORing the data against the known flag format. Typically it is given in just hex, but once it is decoded into raw binary data, it gives it keeps it's hex form (as in \xde\xad\xbe\xef etc..) Note that you can do easy XOR locally with Python like so (you need pwntools installed):

* Caesar Cipher

The most classic shift cipher. Tons of online tools like this: or use caesar as a command-line tool (sudo apt install bsdgames) and you can supply a key for it. Here's a one liner to try all letter positions:

__Be aware!__ Some challenges include punctuation in their shift! If this is the case, try to a shift within all 255 ASCII characters, not just 26 alphabetical letters!

* caesar

A command-line caesar cipher tool (noted abo in the bsdgames package.

* [Atbash Cipher]

If you have some text that you have no idea what it is, try the [Atbash cipher]! It's a letter mapping, but the alphabet is re: like A maps to Z, B maps to Y and so on. There are tons of online tools to do this (), and you can build it with [Python].

* [ Cipher]

and personal Python code here:

* Beaufourt Cipher

* Python random module cracker/predictor

helps attack the Mersenne Twister used in Python's random module.

* Transposition Cipher

* RSA: Classic RSA

typically given: n, c, e. _ALWAYS_ try and give to If p and q are able to be determined, use some RSA decryptor; handmade code a here:

* RSA: Multi-prime RSA

* RSA: e is 3 (or small)

If e is 3, you can try the cubed-root attack. If you the cubed root of c, and if that is smaller than the cubed root of n, then your plaintext message m is just the cubed root of c! Here is [Python] code to take the cubed root:

* RSA: Weiner's Little D Attack

The telltale sign for this kind of challenge is an enormously large e value. Typically e is either 65537 (0x10001) or 3 (like for a Chinese Remainder Theorem challenge). Some stolen code a here:

* RSA: Chinese Remainder Attack

These challenges can be spotted when given mutiple c cipher texts and multiple n moduli. e must be the same number of given c and n pairs. Some handmade code here:

* [LC4]

This is an adaptation of RC4... just not. There is an implementation a in Python.

* Elgamal

* Affine Cipher

* Substitution Cipher (use quip quip!)

* Railfence Cipher

* [Playfair Cipher]

racker:

* Polybius Square

* The Engima

* AES ECB

The "blind SQL" of cryptography... leak the flag out by testing for characters just one byte away from the block length.

* Two-Time Pad

Networking
---------------

* [Wireshark]

The go-to tool for examining [.pcap][PCAP] files.

* [Network Miner]

Seriously cool tool that will try and scrape out images, files, credentials and other goods from [PCAP] and [PCAPNG] files.

* [PCAPNG]

Not all tools like the [PCAPNG] file format... so you can convert them with an online tool or from the command-line with the editcap command that comes with installing [Wireshark]:

* [tcpflow][tcpflow]

A command-line tool for reorganizing packets in a PCAP file and getting files out of them. __Typically it gives no output, but it creates the files in your current directory!__

* [PcapXray]

A GUI tool to network traffic.

PHP
------------

* Magic Hashes

A common in [PHP] that fakes hash "collisions..." where the == operator falls short in [PHP] type comparison, thinking e that follows 0e is considered scientific notation (and therefore 0). More info can be found here: but below are the most common breaks.

| Plaintext | MD5 Hash |
| --------- | -------- |
|240610708|0e88736854|
|QLTHNDT|0e39051580|
|QNKCDZO|0e19903391|
|PJNPDWY|0e31701704|
|NWWKITQ|0e60817689|
|NOOPCJF|0e45791911|
|MMHUWU6|
|MAUXXQC|0e01845361|
|IHKFRNS|0e37988570|
|GZECLQZ|0e28225676|
|GGHM3|
|GEGHBXL|0e84713578|
|EEIZDOI|0e38479162|
|DYAXWCA|0e74063001|
|DQWRASX|0e99582643|
|BRTKUJZ|00e7276704|
|ABJIH6|
|aaaXXAYW|0e08832284|
|aabg7XSs|0e00965295|
|aabC9RqS|0e09536299|

| Plaintext | SHA1 Hash |
| --------- | --------- |
|aaroZmOk|0e66735|
|aaK1STfY|0e11393|
|aaO8zKZF|0e65668|
|aa3OFF9m|0e04729|

* preg_replace

A bug in older of [PHP] where the user could get remote code execution

* [phpdc.phpr][phpdc.phpr]

A command-line tool to decode [bcompiler][bcompiler] compiled [PHP] code.

* php://filter for Local File Inclusion

A bug in [PHP] where if GET HTTP in the URL are controlling the na of the web page, perhaps the source code is include-ing other files to be served to the user. This can be manipulated by using PHP filters to potentially retrie code. Example like so:

* data://text/plain;base64

A [PHP] stream that can be taken ad of if used and e as an include resource or e. Can be used for RCE: check out this writeup: ... TL;DR:

PDF Files
-------------

* pdfinfo

A command-line tool to get a basic synopsis of what the [PDF] file is.

* pdfcrack

A comand-line tool to __recover a password from a PDF file.__ Supports dictionary wordlists and bruteforce.

* pdfimages

A command-line tool, the first thing to reach for when given a PDF file. It extracts the images stored in a PDF file, but it needs the name of an output directory (that it will create for) to place the found images.

* [pdfdetach][pdfdetach]

A command-line tool to extract files out of a [PDF].

Forensics
-----------

* [Magic Numbers]

The starting that identify a file format. These are often crucial for programs to properly read a certain file type, so they must be correct. If some files are acting strangely, try their [magic number] with a trusted list of file signatures.

* [hexed.it][hexed.it]

An online tool that allows you to modify the hexadecimal and binary of an uploaded file. This is a good tool for correcting files with a corrupt [magic number]

* [dumpzilla][dumpzilla]

A [Python] script to examine a .mozilla configuration file, to examine downloads, bookmarks, history or bookmarks and registered passwords. Usage may be as such:

* Repair image online tool

Good low-hanging fruit to throw any image at:

* foremost

A command-line tool to car out of another file. Usage is foremost [filename] and it will create an output directory.

* binwalk

A command-line tool to car out of another file. Usage to extract is binwalk -e [filename] and it will create a _[filename]_extracted directory.

* [hachoir-subfile][hachoir-subfile]

A command-line tool to carve out files of another file. Very similar to the other tools like binwalk and foremost, but always try e!

* [TestDisk]

A command-line tool, used to reco files from a file system image. Handy to use if given a .dd and .img file etc.

PNG File Forensics
--------------------

* pngcheck

A command-line tool for "checking" a [PNG] image file. Especially good for checksums.

APK Forensics
---------------

* [apktool][apktool]

A command-line tool to extract all the resources from an APK file. Usage:

* [dex2jar][dex2jar]

A command-line tool to convert a J.dex file to .class file and zip them as JAR files.

* [jd-gui][jd-gui]

A GUI tool to decompile Java code, and JAR files.

Web
----------------

* robots.txt

This file tries to hide webpages from web crawlers, like Google or Bing or Yahoo. A lot of sites try and use this mask sensiti or folders, so it should always be some where you check during a CTF.

* [Edit This Cookie]

A web browser plug-in that offers an easy interface to modifying [cookies]. ___THIS IS OFTEN O, WITHOUT CHANGING THE VALUE OF THE COOKIES... BE SURE TO FUZZ E, INCLUDING COOKIE !___

* Backup pages ( ~ and .bak and .swp )

Some times you may be able to dig up an old of a webpage (or some PHP source code!) by adding the usual backup suffixes. A good thing to check!

* /admin/

This directory is often found by directory scanning bruteforce tools, so I recommend just checking the directory on your own, as part of your own "low-hanging fruits" check.

* /.git/

A classic CTF challenge is to leave a git repository live and a on a website. You can see this with nmap -A (or whate script catches it) and just by trying to view that specific folder, /.git/. A good command-line tool for this is GitDumper.sh, or just simply using [wget][wget].

* [GitDumper.sh][GitDumper.sh]

A command-line tool that will automatically scrape and download a [git] repository hosted online with a given URL.

* [XSS]/[Cross-site scripting]

XSS Filter E Cheat Sheet. [Cross-site scripting], where the user can control rendered [HTML] and ideally inject [Ja] code that could drive a browser to any other website or make any malicious network calls. Example test payload is as follows:

Typically you use this to steal cookies or other information, and you can do this with an online requestbin.

* CloudFlare Bypass

If you need to script or automate against a page that uses the I'm Under Attack Mode from CloudFlare, or DDOS protection, you can do it like this with linked Python module.

* [XSStrike]

A command-line tool for automated [XSS] attacks. Seems to function like how [sqlmap] does.

* [wpscan][wpscan]

* A Ruby script to scan and do reconnaissance on a [Wordpress] application.

* Cookie Catcher

* requestb.in

A free tool and online end-point that can be used to catch HTTP requests. Typically these are controlled and set by finding a [XSS] .

* hookbin.com

A free tool and online end-point that can be used to catch HTTP requests. Typically these are controlled and set by finding a [XSS] .

* [sqlmap][sqlmap]

A command-line tool written in [Python] to automatically detect and exploit SQL injection points.

* Flask Template Injection

* SQL IF statements

These are handy for some injections and setting up some Blind SQL if you need to. Syntax is like SELECT ( IF ( 1=1, "Condition successful!", "Condition errored!" ) )

* Explicit SQL Injection

* Blind SQL Injection

* gobuster

* DirBuster

* nikto

* Burpsuite

Reverse Engineering
-------------------

* ltrace and strace

Easy command-line tools to see some of the code being executed as you follow through a binary. Usage: ltrace ./binary

* Hopper

* Binary Ninja

* gdb

* IDA

PowerShell
-------------

* [nishang]

A PowerShell suite of tools for pentesting. Has support for an ICMP reverse shell!

* [Empire]

HUGE PowerShell library and tool to do a lot of post-exploitation.

* Bypass AMSI Anti-Malware Scan Interface

Great tool and guide for anti-virus e with PowerShell.

Windows Executables
-------------

* [pefile][pefile]

A [Python] module that examines the headers in a Windows [PE (Portable Executable)][PE] file.

* [dnSpy]

A [Windows] GUI tool to decompile and reverse engineer [.NET] binaries

* [PEiD][PEiD]

A [Windows] tool to detect common packers, cryptors and compilers for [Windows][Windows] [PE][PE]

* jetBrains .NET decompiler

* AutoIT con

When debugging AutoIT programs, you may get a notification: "This is a compiled AutoIT script". Here is a good thing to use to decode them:

Python Re
------------

* [Easy Python Decompiler]

A small .exe GUI application that will "decompile" [Python] bytecode, often seen in .pyc extension. The tool runs reliably on [Linux] with [Wine].

Binary Exploitation/pwn
--------------

* Basic Stack O

Use readelf -s <binary> to get the location of a function to jump to -- o in Python, find offset with dmesg, and jump.

* printf

A C binary , where printf is used with user-supplied input without any arguments. Hand-made code to exploit and o functions: and a video walkthrough explaining:

* [formatStringExploiter][formatStringExploiter]

A good [Python] module to streamline exploiting a [format string ]. THIS IS NOT ALWAYS A GOOD TACTIC...

* 64-bit Buffer O

64-bit buffer o challenges are often difficult because the null bytes get in the way of memory addresses (for the function you want to jump to, that you can usually find with readelf -s). But, check if whether or not the function address you need starts with the same hex already on the stack (in rsp). Maybe you only have to write two or three bytes after the o, rather than the whole function address.

Re
---------------------------

Miscellaneous
----------

* [Base64], [Base32], [Base85]

* Base65535

Unicode characters encoding. Includes a lot of seemingly random spaces and chinese characters!

* Base41

* Wordsearches

Some CTFs have me sol as part of a challenge (TJCTF 2018). This code is super helpful:

* Password-protected Zip Files: [fcrackzip][fcrackzip] and zip2john.py

Use

* 15 Puzzle

A sliding puzzle that consists of a 4x4 grid with numbered square tiles, with one missing, set in a random order. It was in in SharifCTF to determine if a group of these puzzles was solvable:

* Chrome Password Dump

A [Windows] command-line tool to dump passwords saved with Google Chrome.

* img2txt

A command-line tool to convert an image into ASCII for the terminal. Can be installed like so:

* Strange Symbols/Characters

Some CTFs will try and hide a message on a picture with strange symbols. Try and Google Reverse Image searcht these. They may be Egyptian Characters:

!

[steghide]:
[snow]:
[cribdrag.py]:
[cribdrag]:
[pcap]:
[PCAP]:
[Wireshark]:
[Network Miner]:
[PCAPNG]:
[pcapng]:
[pdfcrack]:
[GitDumper.sh]:
[pefile]:
[Python]:
[PE]:
[Portable Executable]:
[hipshot]:
[QR code]:
[QR codes]:
[QR]:
[zbarimg]:
[Linux]:
[Ubuntu]: )
[Wine]: )
[Detect DTMF Tones]:
[dnSpy]:
[Windows]:
[.NET]:
[ Cipher]:
[PDF]:
[Playfair Cipher]:
[phpdc.phpr]:
[bcompiler]:
[PHP]:
[GET]:
[pdfdetach]:
[sqlmap]:
[hachoir-subfile]:
[wget]:
[git]:
[Cross-site scripting]:
[XSS]:
[HTML]:
[Ja]:
[PEiD]:
[wpscan]:
[Ruby]:
[Wordpress]:
[dumpzilla]:
[hexed.it]:
[Magic Numbers]: )#Magic_numbers_in_files
[Magic Number]: )#Magic_numbers_in_files
[Edit This Cookie]:
[cookie]:
[cookies]:
[formatStringExploiter]:
[format string ]:
[printf ]:
[Java]: )
[JAR]: )
[OpenStego]:
[Stegsolve.jar]:
[Stegsolve]:
[PcapXray]:
[Atbash Cipher]:
[TestDisk]:
[PNG]:
[jd-gui]:
[dex2jar]:
[apktool]:
[RCE]:
[remote code execution]:
[arbitrary code execution]:
[XSStrike]:
[nishang]:
[Malboge]:
[Piet]:
[npiet]:
[LC4]:
[Empire]:
[Base64]:
[Base32]:
[Base85]:
[fcrackzip]:
[zsteg]:
[jsteg]:
[jstego]:
[StegCracker]:
[Base41]:
[Base65535]:
[Easy Python Decompiler]:

---------------------------
Extra Readings and Tools
-----------------------

A list of interesting things I can use one day or ha used in the past.

* android-tools
* blockchain-tools
* blogs
* car-tools
* cloud-tools
* cobalt-strike-addons
* code-audit
* ctf-tools
* database-tools
* docker-tools
* exploit-de.md
* exploit-latest
* forensics-tools
* fuzzing-tools
* hail-mary-attack
* hardening
* hardware-tools
* honeypot
* ios-tools
* iot-tools
* machine-learning
* macos-tools
* malware-analysis
* malware-de
* masscan
* nmap
* office-tools
* password-tool
* payloads
* pentest-tools
* powershell-tools
* pwn-tips
* re-tools
* router-tools
* sdr-tools
* shellcode-tools
* software-de
* threat-detection
* wireless-tools

-------------------------

Happy Hacking !!

项目信息

开发语言：未知

Star 数：282

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕All About CTFs展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。