awesome-ctf-cheatsheet - CTF备忘单

项目说明

Awesome Capture the Flag Cheatsheet ![Awesome]()<img src="media/icons8-hacking.svg" align="right" width="150">

> A currated list of all capture the flag tips and strategies to sol CTF challenges and Hackthebox Machines.

---

Contents

<!-- TOC start (generated with ) -->

System Hacking

Web Hacking

File Hacking

Cryptography

Forensics

Password Cracking

Pri Escalation

<!-- TOC end -->

System Hacking

Nmap Scanning

To disco, services, and efficiently in CTF en, Nmap is a critical tool. Below are curated commands and strategies:

---

#### 🔍 Discover Li in a Subnet:

Use this to quickly find which machines are up.

#### 🔧 Service and Detection:

Identify open ports and the of services running.

#### 🚨 Scanning:

Uses default detection scripts against known services.

#### 🔍 Aggressive Full Port + OS Detection + Script Scanning:

Scans all 65535 TCP ports with OS, detection, script scanning and traceroute.

#### 🔐 SSL/TLS Enumeration:

Displays supported SSL/TLS ciphers for HTTPS services.

---

🎯 Pro Tips for CTFs:

Scan Specific Ports Quickly:

Focus on commonly used service ports.

Use Top Ports Only (Fast Scan):

Scans the 100 most common ports.

UDP Scanning:

Useful for services like DNS (53), SNMP (161).

Brute Force Login Scripts (use responsibly):

Try brute force login on exposed FTP.

Find HTTP Hidden Paths or Directories:

List web directories.

Detect SMB Shares:

Helpful for lateral mo or sensitive info.

Aggressi Scan for All Services:

Runs a set of default scripts for information gathering.

Scan Output to File (For Notes):

Useful for documentation or later review.

---

Le Nmap's script database (ls /usr/share/nmap/scripts/) to explore more targeted scripts based on your CTF scenario.

Stay stealthy when required, and always adapt your scanning strategy to the time constraints and rules of the challenge.

Netdisco

To passively disco on the network, use Netdiscover. It listens for ARP requests to identify li without sending packets, making it ideal for stealth reconnaissance in CTFs or red team exercises.

If unsure of your interface, identify it using:

Sample Output:

---

🎯 Pro Tips for CTFs Using Netdiscover:

Use with -r flag to scan specific subnet range:

Faster than default mode for known ranges (e.g., in HackTheBox or TryHackMe labs).

Combine with Wireshark or tcpdump:

Use netdiscover to find acti and then monitor them with packet sniffers.

Scan for MAC anomalies:

Identify devices with spoofed MACs (e.g., "Private" or "Unknown") which might be attacker-controlled.

Run in background during a CTF session:

Keep netdiscover running in a separate terminal to monitor new devices that join the network.

Use in stealth mode:

Unlike Nmap, this does not actively probe. Good for a detection in blue team CTF scenarios.

---

Important: Netdisco only on local networks. It cannot disco outside of your subnet.

For maximum effecti, always complement passi with acti (like Nmap) once initial targets are discovered.

---

Nikto Scanning

To scan for web using Nikto, a powerful web ser that tests for thousands of known issues.

This tool is effective for identifying outdated software, insecure configurations, and common CVEs.

---

🎯 Pro Tips for CTFs Using Nikto:

Scan HTTPS hosts with SSL support:

Detects SSL-specific .

Sa to a file for review or reporting:

Useful for documentation or post-exploitation analysis.

Scan specific ports (e.g., 8080, 8443):

Often CTFs run web servers on non-standard ports.

Use with web proxies (e.g., Burp Suite):

Intercept and analyze requests manually.

Combine with other tools:

Use Nikto findings to feed into further attacks with tools like gobuster, wpscan, or custom scripts.

---

Note: Nikto is noisy and easily detectable. Avoid using in stealth/red team scenarios unless allowed.

Web Ser

When ports 80 (HTTP) or 443 (HTTPS) are open, it likely indicates a web service. This presents an opportunity to enumerate for flags, directories, and .

---

🔍 Basic Web Checks

Check for hidden paths (robots.txt):

Common in CTFs for holding easter eggs or clues.

Identify the Web Server and :

Sample Output:

Look at the Server: header to find out if it’s Apache, Nginx, or a specific .

---

🛡️ If Port 80 is Closed But Expected to Be Open

This may indicate:

Presence of Intrusion Detection System (IDS)

Port knocking mechanism in place

#### Workarounds:

Rescan with a delay:

Sometimes port a changes after time or after other ports are probed.

Use TCP connect scan to bypass SYN scan restrictions:

Example output:

SYN scans (-sS) may be blocked or filtered by the firewall, while -sT (full TCP handshake) can bypass it in some setups.

---

🎯 Pro Tips for CTFs:

Use tools like whatweb or wappalyzer to detect CMS or frameworks.

Combine with gobuster or dirsearch for brute-forcing directories:

Always check for default creds if CMS is identified (e.g., admin:admin, guest:guest).

Use Burp Suite or ZAP for deeper inspection when a login portal or forms are found.

Try alternati like 8080, 8000, or 8443 if no web app is found on 80/443.

---

Web services often hold CTF flags in directories, source code comments, or misconfigurations. Always inspect thoroughly!

---

📂 Directory Bursting

To enumerate hidden directories and files on a web server, directory brute-forcing is essential in CTFs.

#### Using wfuzz:

#### Using gobuster (faster alternative):

#### Using dirsearch (Python-based tool):

---

🎯 Pro Tips for CTFs:

Try multiple extensions: CTF flags are often hidden as .php, .txt, .bak, etc.

Use recursive mode in tools like dirsearch to go deep into discovered folders.

Filter out 403/404 responses to reduce noise and focus on valid paths.

Look for backup files or config leaks like .git/, config.php, .env.

Scan for hidden parameters using wfuzz:

Check robots.txt and sitemap.xml for hints to hidden pages.

---

🧠 Generating Wordlist from the Website

Use cewl to crawl a target website and generate a custom wordlist based on its content—useful for password attacks, username discovery, or directory bruteforcing.

#### Basic Usage:

#### Word Count:

---

🎯 Pro Tips for CTFs:

Increase depth (-d) to extract words from deeper pages (e.g., /about, /team, /login).

Use -e to include email addresses in output:

Use in combo with Hydra or Burp for login brute-force attacks.

Run with a custom user-agent (-a) to bypass basic WAFs:

Use --with-numbers if the site includes numbers in words (e.g., admin123).

---

📁 SMB is Open

When ports 139/445 are open, the target may be running SMB (Ser Block)—commonly misconfigured in CTFs, making it a goldmine for enumeration and exploitation.

---

#### 🔍 Anonymous Share Enumeration

Lists a shares. If successful without credentials, the ser anonymous login.

---

#### 📂 Mounting SMB Share (Anonymous or Authenticated)

Or use credentials:

---

#### 🔐 With Credentials – Using smbmap

Enumerates shares, permissions, and access level.

---

#### 🚀 Gaining Shell – Using psexec.py

If credentials are valid and ADMIN$ is accessible, this will drop you into a SYSTEM shell.

---

🎯 Pro Tips for CTFs:

Use enum4linux for a quick, detailed SMB sweep:

Look for backup files or password.txt in shares like Backups, Users, or C$.

Use smbclient interactively to explore shares:

Try null sessions (-N):

If psexec.py fails, try wmiexec.py, smbexec.py, or atexec.py (from Impacket).

Automate with tools like crackmapexec for wide-scale credential spraying:

---

💾 To Extract and Mount Files

Hard Disk (VHD) files are often found in forensic or Windows-based CTF challenges. These can contain hidden flags, user profiles, or sensiti.

---

#### 📦 List Contents of the VHD

Quickly inspects the archive to confirm structure before mounting.

---

#### 🔗 Mount VHD with Guestmount

--inspector: Auto-detects and mounts the correct partition.

-ro: Mounts as read-only (safe for analysis).

-v: Enables output.

Make sure libguestfs-tools is installed.

---

🎯 Pro Tips for CTFs:

Always check for .flag, .txt, or .zip inside Desktop, Downloads, Documents.

Search for browser histories or credentials in:

- AppData/Roaming
- Users/<name>/Recent

If guestmount fails, try manual partition detection:

Then mount using loop device:

Use strings or binwalk to extract clues from within the VHD file:

---

🔍 To Search for Exploits on Metasploit by Name

Use searchsploit to quickly find known exploits or from the Exploit-DB repository.

#### Basic Usage:

Searches for Apache exploits in the local database.

---

🎯 Pro Tips for CTFs:

Use -x to open the exploit directly:

Mirror the database to ensure it’s up to date:

Use quotes for precise matching:

Search inside PoCs for keywords (e.g., RCE, LFI):

Search using CVE-ID if known:

For Metasploit directly:

---

📰 WordPress Open

If /wp-login.php is discovered during web enumeration, the target is likely running WordPress—a common and often CMS in CTFs.

---

#### 🔑 Brute Force Login with Hydra

Adjust F= string based on response for failed login.

Capture login POST parameters using Burp Suite.

---

#### 🔎 Scan for Plugins, Themes, and with WPScan

Use with credentials:

---

#### 🐚 Reverse Shell Upload (Metasploit)

---

🎯 Pro Tips for CTFs:

Check /readme.html or wp-includes/.php for WordPress leakage.

Always enumerate users first to reduce brute force attempts:

Scan for outdated plugins/themes—they’re frequent attack .

Look for writable upload directories or eval() usage in plugin files.

Try LFI/SQLi on lesser-known plugins if source code or is known.

---

🛰️ RPC Open

If port 135 (or 445 with RPC over SMB) is open, it indicates a Windows host with Remote Procedure Call (RPC) capabilities. Misconfigured RPC access can expose usernames, shares, and domain info.

---

#### 🔐 Anonymous RPC Login

Press Enter when prompted for a password to attempt a null session.

---

🎯 Pro Tips for CTFs:

Enumerate users:

Get detailed user info:

Enumerate groups:

Find policies or domain info:

Chain with smbclient to access user directories based on enum results.

Use RID cycling to brute-force usernames:

If credentials are found, use them with rpcclient -U user%pass <HOST> for full access.

---

💻 PowerShell

PowerShell is a powerful post-exploitation and enumeration tool on Windows machines.

---

#### 🚫 Bypass Execution Policy

Allows execution of unsigned scripts without modifying system-wide policy.

---

🎯 Pro Tips for CTFs:

Download and execute payloads:

Run encoded commands to evade detection:

Use PowerView or Nishang for enumeration, pri escalation, and persistence.

Use -w hidden to suppress PowerShell window (post-exploit):

Enumerate system info, users, and network:

---

🧬 NoSQL Injection – Full CTF Exploitation Guide

---

#### 🔓 Login Bypass Payloads

These exploit MongoDB’s flexible querying:

These payloads allow login by returning true on any non-null or regex match.

---

🛠️ Common Injection Entry Points

| Injection | Description |
|-------------------------|-------------------------------------|
| URL parameters | ?username[$ne]=1&password[$ne]=1 |
| Form fields (POST) | login inputs |
| JSON body (APIs) | {"username": {"$ne": null}} |
| HTTP headers | X-User: {"$gt": ""} |

---

🧪 Blind NoSQL Injection (User Enumeration)

Try brute-forcing usernames one letter at a time:

Check for response differences to confirm partial matches.

---

#### 🔍 Extract Usernames

This helps disco users:

---

🧠 Extract Password Length (with $where)

If $where is supported (JS injection):

Enumerate the length first, then extract char-by-char.

---

🔁 Time-Based Injection (Timing Attacks)

If errors don’t help, exploit time:

Or for some frameworks:

If delay occurs, injection is successful.

---

🧰 Automated Tools

#### 🛠️ NoSQLMap

Use for:

Dumping DBs

Enumerating users

Authentication bypass

JS injection exploitation

#### 🐍 Burp Suite + Intruder

1. Intercept login POST request.
2. Send to Intruder.
3. Fuzz with:
- [$ne]=1
- [$regex]=^a
- [$where]=...

Monitor responses for .

---

🔐 Pri Escalation / Admin Hijack

If user exists:

If login succeeds, you’ user admin exists.

To bypass:

If admin panel access is via role:

---

🧨 Escaping Filters

Bypass weak sanitization:

Use array parameters: username[$in][]

Encode special characters: %24ne, %24regex

JSON nested injection:

---

🎯 Final CTF Tips:

Check login, search, filter, and API endpoints—anywhere user input reaches MongoDB.

Explore headers (X-User, X-Auth) for NoSQL injection in hidden APIs.

Always enumerate usernames before attempting bruteforce.

Look for Ja backends to exploit $where.

Chain NoSQLi with LFI, RCE, or misconfigured MongoDB access.

---

Web Hacking

Fi of Web Hacking

---

🛰️ Enumeration and Reconnaissance Tools

Recon is critical in CTFs. Use these tools to gather intelligence before exploiting.

---

#### 🔎 Passi

Whois, Nslookup, Dig, Dnsrecon – Basic DNS and domain info.

Google Dorking (Google Fu) – Disco files or directories:

- site:<target.com> ext:log
- intitle:index.of "backup"

---

#### 🌐 Subdomain & Certificate Enumeration

Sublist3r – Fast subdomain discovery:

crt.sh – Public SSL certificate transparency logs.

Amass – Extensi and DNS enumeration.

---

#### 📧 Email & Breach Lookup

Hunter.io – Disco emails.

Ha – Check email breach exposure.

Clear Text Password Dataset – Build realistic password lists.

---

#### 🧠 Fingerprinting and Tech Stack

Wappalyzer, WhatWeb, BuiltWith – Identify backend tech, CMS, or frameworks.

Nmap – detection and port scanning.

Netcat – Basic banner grabbing or listener setup.

---

#### 🔐 Headers, Files, and Hidden Paths

SecurityHeaders – Scan HTTP headers for misconfigurations.

OWASP ZAP Proxy – Crawl and extract hidden files or admin paths.

Burp Suite – Spider, Repeater, Intruder for thorough recon.

---

#### 🕵️‍♀️ Information Har from Search Engines

Use -b all for multiengine scraping.

Target emails, domains, subdomains, hosts, employee names.

---

🎯 Pro Tips for CTFs:

Always run recon in parallel threads (subdomains, certs, emails, etc.).

Use findings to create a custom wordlist for bruteforce (e.g., via cewl, crunch).

Pi into acti — open ports, login panels, emails, and misconfigs often lead to the first foothold.

Scanning

Ping Sweep a network.

SYN Scan with Speed of 4 and port of common 1000 TCP.

All Port scan with All Scanning including OS, , Script and Traceroute.

To scan for UDP Ports (Dont scan all scans, as it takes lot of time).

---

💣 Payloads

Payloads are code executed on the target after exploitation. In Metasploit, they’re categorized as Staged and Non-Staged.

---

#### 🧱 Non-Staged Payload (Single Payload)

Sends the entire payload at once.

Easier to detect but simpler to use.

More reliable in unstable networks.

---

#### 🧩 Staged Payload (Modular/Two-Step)

Sends a small stager first, then downloads the full payload.

Smaller footprint during delivery, useful for e filters.

More stealthy, but may break in flaky connections.

---

🎯 Pro Tips for CTFs:

Use msfvenom to generate standalone payloads:

For web shell upload:

Use multi/handler in Metasploit to catch the shell:

Encode payloads to evade AV:

---

🐚 Shells

Shells are essential for post-exploitation access. They can be Bind Shells or Reverse Shells, depending on which side initiates the connection.

---

#### 🔗 Bind Shell

Target listens, and attacker connects in.

1️⃣ On Target (create shell):

2️⃣ On Attacker (connect to shell):

---

#### 🔁 Reverse Shell

Attacker listens, and target connects back.

1️⃣ On Attacker (listen):

2️⃣ On Target (trigger shell):

---

#### 🧪 Perl Reverse Shell (Common in CTFs)

Use it when you gain command execution via web.

Swap in your IP and port.

Stable but easily detectable—upgrade shell after.

---

🧼 Shell Upgrade Tips

If you get a basic shell, upgrade it:

And make it interactive:

---

🎯 Pro Tips for CTFs:

Always try multiple shell methods: Bash, Python, Perl, PHP, Socat.

Use rlwrap or script to wrap Netcat for history/na.

Some machines block Netcat—use socat or mkfifo shell:

Check cron jobs or file uploads for persistence using reverse shells.

---

💥 Buffer O

Buffer o exploits can be used to execute arbitrary code, often giving shell access. One key step is injecting shellcode into the program's memory.

---

#### 🛠️ Generate Shellcode with pwntools (Python)

Quick shellcode to spawn /bin/sh:

---

#### 🔁 Pipe Shellcode into Binary

Combines shellcode and standard input to exploit buffer in real time.

cat keeps the session ali payload injection.

---

🎯 Pro Tips for CTFs:

Set architecture for shellcode:

Debug with GDB:

Use pattern generation to find offset:

Attach pwntools debugger:

Use ROPgadget to find useful instructions for ret2libc or ROP chaining.

---

🚪 Gobuster – Directory & File Enumeration

Gobuster is a fast, flexible tool used to brute-force directories, files, and hosts on web servers—critical for disco hidden content during CTFs.

---

#### 🔍 Basic Directory Enumeration

Use default extensions or combine with -x php,txt,bak for better results.

---

#### 🍪 With Cookies (Authenticated Enumeration)

Useful when login is required or access is session-based.

---

🎯 Pro Tips for CTFs:

Target file extensions:

Change status code filters to include redirects, forbidden, etc.:

Recursi (manually explore found directories).

Use smaller wordlists for initial scan, then refine:

- /usr/share/wordlists/dirb/common.txt
- /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt

Add user-agent to evade simple WAFs:

Scan HTTPS URLs with -k to ignore SSL (CTFs often use self-signed certs):

Don't miss hidden admin or upload portals like:

- /admin, /upload, /debug, /backup

---

🧬 SQLMap – SQL Injection Automation

SQLMap automates the detection and exploitation of SQL injection flaws. In CTFs, it’s a fast way to extract databases, users, tables, and even get shells.

---

#### 🔁 Capturing HTTP Request via Burp Suite

1. Intercept a POST request:

2. Right-click → Save to File (e.g., search.req)

---

#### 🚀 Running SQLMap on the Captured Request

-r: Use raw HTTP request file.

--batch: Run without interacti.

--force-ssl: Useful for HTTPS endpoints.

---

🎯 Pro Tips for CTFs:

Extract full DB structure:

Enumerate current DB, user, and :

OS Shell or File Write:

Test specific parameter (if request has multiple):

Bypass WAFs:

Use cookies (if session required):

Avoid IDS detection:

---

File Hacking

---

📄 Extract Hidden Text from PDF Files

PDFs in CTFs often hide flags using layers, compression, white text, or embedded objects.

---

#### 🖱️ Manual Extraction (Quick Try)

1. Open PDF → Ctrl + A → Ctrl + C
2. Paste into Notepad or any plain text editor.

> ✅ Works if text is layered or colored white.

---

#### 🎨 Use Inkscape (For Embedded/Layered Flags)

1. Open PDF in Inkscape
2. Repeatedly click "Ungroup" (Shift + Ctrl + G)
3. Look for:
- White-on-white text
- Hidden objects or o
- Off-canvas data

> Great for or image-embedded flags.

---

#### 🔧 Decompress PDF with qpdf

Converts PDF streams into readable text.

Open with a text editor and search for flag, HTB, CTF{, etc.

---

🎯 Pro Tips for CTFs:

Search hex editors for embedded strings:

Use pdf-parser.py (by Didier Stevens) to inspect PDF objects:

Try binwalk if the PDF is embedded with other files:

Look for in/hidden layers in GIMP or Photoshop if it's image-heavy.

Use OCR (tesseract) if text is embedded inside images:

---

📦 Compressed File Extraction

In CTFs, compressed files may hide flags deeply nested or disguised using alternate extensions or embedded formats.

---

#### 🔍 Identify File Type (Magic Bytes)

Check the file header:

If it starts with 50 4B (PK), it’s likely a ZIP file, even if the extension is misleading.

---

#### 🧨 Extract Recursively with binwalk

-M: Enables recursi of embedded files.

-e: Automatically extracts known file types.

Sa in _FILE_NAME.extracted/.

---

🎯 Pro Tips for CTFs:

Use file command to confirm type:

Manually unzip if standard ZIP:

Use 7z for unknown or nested formats:

Inspect for password-protected archi:

- Use fcrackzip or john to brute-force:

Sometimes .jpg, .png, or .docx hide zips internally. Use binwalk or steghide to detect.

Loop unzipper for nested zips:

---

🧵 Extract Hidden Strings

CTF files often hide flags in binary, encoded, or obfuscated forms. Use basic Linux tools for deep inspection.

---

#### 🔍 View Embedded or Encoded Text

Use strings to extract ASCII-readable data:

Use hexeditor to manually inspect binary layout:

Look for readable data, base64 patterns, and unexpected headers.

Look for clues like flag{...}, HTB{...}, or even Unicode-encoded text.

---

#### 🔐 Detect Base64 (Common in CTFs)

If you see patterns like:

The == ending suggests base64 encoding:

---

📡 Runtime Tracing (Dynamic Analysis)

#### 🧩 Monitor Syscalls with strace:

-f: Follow child processes.

-s: Increase string capture size (default is 32).

Watch for runtime flag output or hidden read events.

#### 🧬 Track Function Calls with ltrace:

Reveals dynamic library calls, useful for unco:

- Password checks
- String comparisons
- File reads

---

🎯 Pro Tips for CTFs:

Try XOR decoding if text looks binary but consistent:

Use Ghidra or GDB to trace logic if strings are encrypted or manipulated in memory.

Combine strace with tee or grep to li extracted data.

Check for Unicode, ROT13, or hex-encoded flags if base64 doesn’t reveal useful output.

Cryptography

---

🔐 Caesar Cipher

A Caesar cipher is a simple substitution cipher where each letter is shifted by a fixed number in the alphabet.

---

#### 🧭 Classic Caesar Decryption

If the challenge mentions "caesar", it’s likely using a basic shift cipher.

Try all 25 shifts manually:

Or use dCode Caesar Solver.

---

#### 🧱 Caesar Box Cipher

If ciphertext contains characters like ! or appears block-like:

Likely a Caesar Box (Columnar Transposition) cipher.

Use:
👉 Caesar Box Solver

Paste text and bruteforce dimensions or square sizes.

---

🎯 Pro Tips for CTFs:

Look for clue words: "shift", "rotate", "move", "Julius", or "Rome".

If numeric hints (like 3 or 13) are given, use them as shift .

Try reverse shift (ROT13 or ROT-N) using:

Combine Caesar decoding with base64 or hex if multiple layers are used.

---

🧩 Vigenère Cipher

The Vigenère cipher is a polyalphabetic substitution cipher that uses a repeating key to shift letters.

---

#### 🔓 Crack Without Knowing the Key

Use this online bruteforce solver:
👉 Guballa Vigenère Solver

Paste the ciphertext and let it auto-detect the key length and content.

It uses frequency analysis and Kasiski examination behind the scenes.

---

🎯 Pro Tips for CTFs:

Clues like "key", "password", "repeating", or "polyalphabetic" often indicate Vigenère.

Try common keys like:

- flag, ctf, security, secret, pass

If a partial plaintext or known word is , use a known-plaintext attack.

If ciphertext is all caps with no spaces, suspect Vigenère or Playfair.

Layered encoding (e.g., base64 → Vigenère → Caesar) is common—decode in reverse.

---

🗝️ One-Time Pad (OTP) Cipher

The One-Time Pad is an unbreakable cipher when used properly (random key, used once, same length as plaintext). In CTFs, it's often improperly implemented—making it crackable.

---

#### 🔓 Solve OTP Easily

Use this online tool:
👉 OTP Decryption Tool

Input the ciphertext and key (or guess/bruteforce if reused or predictable).

Decryption is done via XOR of ciphertext and key.

---

🧠 CTF Use Case: SSH Private Key Cracking

If OTP is a red herring and you find an id_rsa file, use john to crack it:

> ✅ Often used to escalate after retrieving a user's private key in challenges.

---

🎯 Pro Tips for CTFs:

OTP ciphertext and key must be same length — before decoding.

If a reused key is suspected, treat it like a Vigenère with XOR.

Use hex editors or xxd to identify XOR patterns in binary OTP files.

Check if the key is:

- Hardcoded in source
- Found in another file
- Same as part of the flag

Forensics

---

🖼️ Image File Analysis

Images often hide flags using steganography, metadata, or embedded file structures.

---

#### 📄 Identify Image File Type

Confirms true file type regardless of extension (e.g., PNG renamed to JPG).

---

#### 🧬 Metadata Analysis

Reveals hidden fields like Author, Comment, or GPS coordinates.

Look for unusual tags like Software, UserComment, or DocumentName.

---

#### 🔍 Steganography – Extract Hidden Data

Use zsteg for LSB & color-channel payloads (PNG only):

Use steghide for password-protected embedded content:

Prompts for password—use rockyou.txt for brute-force attempts.

Brute-force steghide with steghide_brute (optional tool):

---

#### 🔡 Extract Embedded Text

Flags often embedded as plaintext or ASCII in CTFs.

---

🎯 Pro Tips for CTFs:

Check alpha/transparency channels for hidden o.

Use binwalk to detect embedded ZIPs, images, or files:

Open image in hex editor (e.g., hexeditor) to inspect tail-end anomalies.

Try OCR (for CAPTCHA-like flags or graphical encodings):

Check pixel data manipulation using stegsolve.jar or StegSpy for deeper analysis.

---

🧪 Binwalk – Embedded Data Extraction

binwalk is used to analyze binary files (like images or firmware) for embedded files, compressed archives, or hidden content.

---

#### 🔍 Basic Scan

Scans for magic bytes indicating ZIPs, PNGs, PDFs, compressed data, etc.

---

#### 🧠 If ZIP/Archive Is Detected

You can extract it manually:

---

#### 🔓 Auto Extract All Embedded Files

Extracts all identified files into _<IMAGE_NAME>.extracted/

---

#### 🔁 Recursi (Handles nested archives)

Ideal for multi-layered CTF stego challenges.

---

🎯 Pro Tips for CTFs:

Use --dd to extract specific types manually:

Combine with steghide, exiftool, and zsteg after extraction.

Inspect footer of embedded files — flags may be appended after legitimate content.

Good for challenges in firmware, DOCX/XLSX, or disguised file formats.

---

💽 Extract NTFS Filesystem

NTFS files may contain hidden data, alternate streams, or partitioned content—commonly le in CTFs.

---

#### 🪟 On Windows (Alternate Data Streams)

1️⃣ List Hidden Streams:

2️⃣ Extract Hidden Stream Content:

or

3️⃣ Use 7-Zip to extract .ntfs containers directly:

Right-click → "Extract Here"

---

#### 🐧 On Linux

Mount the NTFS image:

Explore mnt/ for flags in $MFT, $Recycle.Bin, or System Information.

---

🎯 Pro Tips for CTFs:

Search for ADS (Alternate Data Streams) manually on Linux:

Use ntfs-3g for full read/write NTFS access on Linux.

Use sleuthkit or autopsy for forensic-level NTFS inspection.

Check for base64 or zip files stored in ADS or hidden folders.

---

🧷 Reco from Deleted File Systems (Remote Forensics)

Use this method to image and extract deleted file systems remotely—commonly required in forensic or IR-based CTFs.

---

#### 📡 Step 1: Create Disk Image Remotely (via SSH)

dcfldd: Forensic-friendly dd with progress and hashing.

gzip: Compress data during transfer.

---

#### 📦 Step 2: Decompress Image Locally

---

#### 🔍 Step 3: Extract and Analyze

Recursively unpacks embedded files, file systems, and archived data.

---

🎯 Pro Tips for CTFs:

If dcfldd not a, use:

Use photorec or foremost for file carving:

Mount partition for manual inspection:

Find offset using fdisk -l extract.dd

Use fls and icat from SleuthKit for targeted recovery:

---

📡 Packet Capture – USB Keystroke Recovery

In CTFs, .pcap or .pcapng files may contain USB keyboard traffic, especially when analyzing hardware-le.

---

#### 🔍 Extract USB Keystrokes from PCAP

Use tshark to extract USB data:

usb.transfer_type == 1: Captures interrupt transfers (used for keyboard).

usb.capdata: Extracts raw keystroke data.

Pipe this output into a script to decode keystrokes into readable text.

---

#### 🧠 Full Guide for Decoding USB Input

Follow this detailed article:
👉 Reverse USB Keystrokes from PCAP (Kaizen CTF)

---

🎯 Pro Tips for CTFs:

Use Wireshark filters to explore:

- usb.de
- usb.transfer_type
- usb.capdata
- frame contains flag

Look for HTTP, FTP, DNS, IRC traffic in normal .pcap files:

Use NetworkMiner or tcpflow to reconstruct files or extract credentials.

Use strings on PCAP for quick wins:

---

📜 Ja Deobfuscator

Obfuscated Ja is often used in web-based CTFs to hide logic, flags, or backdoor payloads.

---

#### 🧼 Deobfuscate Quickly

Use this online tool:
👉 JSNice

Automatically formats and renames using probabilistic models.

Helps understand logic flow and roles in obfuscated scripts.

---

🎯 Pro Tips for CTFs:

Look for base64, hex, or eval() patterns—common obfuscation tricks.

Replace eval() with console.log() to inspect decoded payload.

Use browser De:

- Paste obfuscated JS into the Console.
- Step through with breakpoints.

For hea:

- Try Beautifier.io
- Use prettier or js-beautify locally:

Password Cracking

---

🔑 JOHN the Ripper – Password Cracking

If the challenge references "JOHN", it's likely hinting at using John the Ripper to crack hashes or protected archives.

---

#### 🧨 Basic Usage

Supports formats like MD5, SHA1, bcrypt, NTLM, etc.

Automatically detects hash type in many cases.

---

#### 🔍 Identify Hash Type (if needed)

Or use [hash-identifier] or [NameThatHash].

---

#### 🌐 Online Cracking (Known Hashes)

Use:
👉 CrackStation

Paste hash to check against massi tables.

---

🎯 Pro Tips for CTFs:

Convert formats using tools:

- zip2john, rar2john, pdf2john, ssh2john, etc.

View cracked passwords:

Pause/resume cracking:

Crack SSH private key passwords:

---

🧬 SAM Hashes – Windows User Password Dump

SAM (Security Account Manager) stores hashed passwords for Windows accounts. In CTFs, it’s often extracted from mounted .vhd or .img disk files.

---

#### 🔓 Extract and Dump Hashes

1️⃣ Copy the SAM and SYSTEM files:

2️⃣ Organize files:

3️⃣ Dump hashes using impacket-secretsdump:

✅ You’ll get outputs like:

---

🎯 Pro Tips for CTFs:

Crack NT hashes with john:

If disk image is encrypted (e.g., BitLocker), unlock first using passphrase or key.

Use mmls + fls + icat (SleuthKit) for forensic-style SAM/SYSTEM extraction from raw disk images.

Look for clues in registry hives and user profiles once hash is cracked.

---

🐧 Linux User Hashes – /etc/passwd + /etc/shadow

In Linux systems, user credentials are stored across two files:

/etc/passwd – stores usernames and UID info

/etc/shadow – stores password hashes (restricted access)

---

#### 🔐 Combine with unshadow

Merges the two files into a format compatible with John the Ripper

---

#### 🔓 Crack with John the Ripper

---

🎯 Pro Tips for CTFs:

You can extract these from VMs, Docker containers, or mounted file systems.

Look for password hashes starting with:

- $6$ – SHA-512
- $1$ – MD5
- $y$ – yescrypt (more secure)

Use john --show to reveal cracked results:

If you only have one hash:

---

🔓 Hashcat – GPU-Accelerated Password Cracking

Hashcat is a powerful tool to crack hashes using GPU acceleration—ideal for large datasets or tougher hashes.

---

#### 🚀 Basic Syntax

-m 500: Hash type (500 = MD5 crypt, i.e., $1$)

-a 0: Attack mode (0 = dictionary attack)

-o: Output file for cracked results

--force: Ignore warnings (used in VMs or non-GPU systems)

---

🔢 Common Hash Modes (Use correct -m):

| Hash Type | Example Prefix | Mode |
|------------------|----------------|------|
| MD5 | — | 0 |
| SHA1 | — | 100 |
| SHA256 | — | 1400 |
| bcrypt | $2y$, $2b$ | 3200 |
| NTLM | — | 1000 |
| SHA512-crypt | $6$ | 1800 |
| MD5-crypt | $1$ | 500 |

> 🔍 Use hashid or hashid <hash> to detect the hash type.

---

🎯 Pro Tips for CTFs:

Use --show to display cracked results:

Crack hashes from unshadow, zip2john, or ssh2john by identifying their format and using the right mode.

Enable optimized GPU use (if supported):

Benchmark all algorithms:

---

📦 7z Password Cracking

To extract and crack a password-protected .7z archive, use 7z2john.py from the John the Ripper suite.

#### 🔧 Convert to Hash Format:

#### 🔓 Crack with John:

---

🔐 SSH Private Key Cracking

If given an encrypted SSH private key (id_rsa), you can recover its password using ssh2john.py.

#### 🔧 Convert Key to Hash Format:

#### 🔓 Crack with John:

---

🎯 Pro Tips for CTFs:

If john fails, try hashcat with proper hash mode (e.g., -m 14600 for 7z).

SSH private key cracks often lead to user shells or pri escalation.

Always check metadata or filenames (like backup.7z, id_rsa.bak)—they often contain credentials.

Pri Escalation

---

🧰 Standard Scripts for Enumeration (CTF Cheatsheet)

Use these tools to automate pri escalation, system enumeration, and data decoding—critical for post-exploitation in CTFs.

---

#### 🐧 Linux Enumeration

🔍 LinEnum

- Automates full Linux system enumeration—users, crons, SUIDs, kernels.

🧠 LinuxPri

- Python-based pri escalation checker (great for local root).

🧾 Unix-Pri

- Shell script that checks common pri escalation .

📋 PEASS-ng (Linux)

- linpeas.sh – Most comprehensi enumeration script.

---

#### 🪟 Windows Enumeration

🔎 JAWS

- PowerShell script to scan Windows for escalation paths.

📋 PEASS-ng (Windows)

- winPEAS.exe – Deep enumeration of Windows services, tasks, misconfigs.

---

#### 🕵️ Runtime Process/Job Monitoring

⏱️ pspy

- Observe cronjobs, timed scripts, or root-executed processes without root.

---

#### ⚙️ Exploit Execution Help

🔓 GTFOBins

- Helps exploit sudo, setuid, and capability binaries for pri escalation.

📑 LOLBAS

- Windows equi to GTFOBins—enumerate and abuse trusted binaries.

---

#### 🧬 Data Analysis & Decoding

🧪 CyberChef

- "The Cyber Swiss Army Knife" for base64, hex, XOR, encodings, regex, and more.
- Web : CyberChef Online

---

🎯 Pro Tips for CTFs:

Always upload and run LinEnum or linpeas immediately after initial shell.

Combine pspy + GTFOBins for powerful cron-based pri escalation.

Use CyberChef to reverse obfuscation or decode multi-layered strings fast.

---

🐮 DirtyCow (Linux Pri Escalation)

Exploit older Linux kernels with DirtyCow:
👉 PoC Code: dirty.c

---

🔐 Sudo Exploitation

Check sudo pri:

Common exploit patterns:

---

🪟 Windows Pri Escalation

In Meterpreter:

🔍 Other Tools:

Sherlock (Pri Suggestor)

FuzzySec PrivEsc Guide

🧬 Migrate Process:

Shell Delivery:

---

🛢️ MySQL & Escalation

MySQL Shell:

:

---

⏱️ Cron Job Exploitation

Monitor system jobs:

O input:

---

📜 Exploiting More / Less or Journalctl

If executed via a pri script:

Example within :

---

🧬 Impro Shell

---

📂 Transfer Files (Host → )

Linux:

Windows:

---

📁 FTP Access

If login successful:

---

🕵️ Reconnoitre – Enumeration Automation

Multi-threaded recon and service enumeration:
👉 Reconnoitre Tool

---

项目信息

开发语言：未知

Star 数：147

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕CTF Cheatsheet展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。