CTF-Candy - Here, have some candy. Useful tools and cheat shee

项目说明

CTF Candy

My goal of this repository is to create a good and up to date cheat sheet for Capture the flag events and computer security.

The one thing I hate the most is when I try a lot of different things and forgot about a simple one. This is what I aim to change!

I will also try to update this repository frequently. Pull requests are welcome

Web

*Useful tools to begin with*

* ZAP
* Burpsuite
* Python with requests lib

#### Injection in GET parameter
Here you have to manually try to enter some stuff to understand more about the application.

* ?id='
Test for SQL injection

* ?page[]=
Send an array, this might crash or reveal debug information about the error. Sometimes you might even get the source code of the application.

* ?id=-1
Try negati

* ?id=9999 or ?id=-99
Try both positive and negati

* ?page=....//....//....//....//etc/passwd
This might sometimes work if the application removes ../ from the url.

* ?page=../../../../etc/passwd
Local file inclusion (LFI)

* ?page=../html/index
Test for limited local file inclusion.
The code could look like this in php:

* ?page=
Remote file inclusion

* ?page=%252e%252e%252fetc%252fpasswd
Double encoding + LFI

* $ curl -d "<?=system('ls .')" -X POST
Send a arbitrary payload through a post request

* Big payload size
This will often lead to a 500 internal error message, and might sometimes reveal information about the application and/or webserver.

* ?exec=5*5

If it returns *25* we have command injection.
Backend is probably running: eval($_GET['exec'])

#### Form data

* Hidden form field - If you find something like this, throw e you got at the debug parameter, this is often a simple command injection.

#### Python sandbox escape

(This section is incomplete)

* locals()
* dir()
* input() - In python 2, this is basically eval()

* __import__("os").system("ls .")

* Single quote and double quotes blocked? Use only numbers and parentheses.

#### Page source
The source of the page often includes hints where to look. Use de tools!

* Commented out links

* Keywords in comments - Try adding ?debug=1 or ?debug=true to the url.

#### File upload

*
* What kind of extensions does the website allow?
* Can you find the url of the uploaded file?
* Double extension .png.php?
* command injecton in filename?
* Try append PHP code at the end of an image
* Spoof mime type of image?

Automatic archi:

* Can you upload a symbolic link inside a ZIP?

* Directory tra by uploading a relative file?

#### Money transfer
These are often a timing attack/side channel attack

#### Other

* Clues in the name/title of the challenges

* Clues in the description of the challenge

* /robots.txt

* Append ?debug=1 or ?is_debug=1 to the url

This will sometimes give you the source code of the page.
You should test the code locally. Or some parts of the code that you do not understand. Your goal is to understand how to circumvent each layer of the challenge.

* Interesting headers sent by the application

* Cookies

* PHP ?

* Apache/nginx ?

* Nullbyte
PHP < 5.3.4

* LFI / RFI (PHP Wrappers)
I recommend this page from rawsec

#### Well.. I' nothing

If you have not found something by now. You may want to run a fuzzer.

1. Grab yourself a good fuzz.txt

Use your fa fuzzer. Here are some good ones:

* dirb

* dirbuster

Esoteric Languages (ESO Lang)

Esoteric programming languages wiki! Great resource

* Interpreter:

"Tio is a online interpreters for an e list of practical and recreational programming languages."

* Hello world:

This is a good resource to find examples of a lot of esoteric languages. Take a lot here and see if one looks like the cipher text you got.

#### of esolangs
* [Ook]()

Ook. Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook.
Ook. Ook. Ook. Ook. Ook! Ook? Ook? Ook. Ook.

Could also be written without the Ook
. ? . . . . . ! .

Steganography

* strings - Look for clues in strings.

* exiftool - Check metadata

* file - What file(s) are we working with? Sometimes the extension is not the correct one. Always worth checking

* stegsolve.jar - Awesome stegnography tool, ja.

* stegdetect - Detect stegnography

* zsteg - LSB stegnography

* Increase height and width of image

Other tools

* Steghide

* StegoMagic

* StegCracker

* openstego

* stego

* stegbreak

* jsteg

* jstego

* gimp

* Outguess

* steganabara

* stegspy

* photoshop
Make sure you zoom and check every pixel. Sometimes it's hidden in plain sight.
* zbarimg (QR Code)
Usage: zbarimg image.png

* cloackedpixel

* LSBSteg

* f5

Audio Steganography

* DTFM Tones

* SONIC

* SSTV

* mp3stego

* spectrology

Other techniques

* Reverse image search for original images
* XOR original image
* compare original.png challenge.png diff.png

What to look out for

* Anomalies
* Repetiti
* Positive and negati could be binary (0, 1).
* Binary code could be morse code
* Morse code
- Also check for nonstandard delimiter

JPEG forensics

* identify chall.jpg

* jhead chall.jpg

* jpeginfo chall.jpg

* rdjpgcom - chall.jpg

PNG Forensics

* pngcheck

pngcheck -vt7f image.png

* pngcsum

If you have a corrupt png (CRC32 checksum for example) this tool can fix it without having to open a hexeditor.

pngcsum broken.png new.png

* pngcrush

* pngchunks

Usage: pngchunks chall.png

* pngfix

Usage: pngfix chall.png

* pnginfo

Usage: pnginfo chall.png

* pngsplit

Usage: pngsplit chall.png

#### The Animated Portable Network Graphics (APNG) file format

* APNG Disassembler 2.9

Usage: apngdis anim.png [name]

* TweakPNG

!alt text

Usage: wine tweakpng.exe

Cryptography

* Old phone keypad

!alt text

* Keyboard shift decoder

gwkki -> hello (shift one key to the right)

* Bit shifted characters

ord("A") = 65
65 << 1 = 130 (encode)
130 >> 1 = 65 (decode)

* Reverse text

$ echo "dlrow olleh" | rev
hello world
* 254caesar

echo -n "String to shift" | ./caesar

* QuipQuip

Sometimes you can get lucky with Quip and reco or even the complete flag.
Tips:
- Use CLUES
- Try all modes

Forensics

* strings

Running strings on a binary can often reaval the flag. Use in conjunction with grep
$ strings binary | grep "CTF_CHALL"
$ strings binary | grep echo -n "CTF_CHALL" | base64

* exiftool

Magic bytes

| Type | Recognize | Signature |
| ------------- |:-------------:| ----------:|
| EXE | MZ | 4D 5A |
| GIF | GIF87a | 47 49 46 38 37 61|
| GIF | GIF89a | 47 49 46 38 39 61 |
| JPG | ÿØÿà..JFIF.. | FF D8 FF E0 00 10 4A 46 49 46 00 01 |
| PNG | .PNG.... | 89 50 4E 47 0D 0A 1A 0A |
| PDF | %PDF- | 25 50 44 46 2d |
| 7z | 7z¼¯' | 37 7A BC AF 27 1C |

Other (Unsorted, todo)

* Samba tool pdbedit

* impacket

* any.run

*

* oletools

* /de - Might sometimes return nullbyte(\00)

* Shell in another challenge? Use it for recon

*

* MQTT

*

*

*

*

* pwn template

*

Sources of inspiration:
*
*
*
*
*

项目信息

开发语言：未知

Star 数：69

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Here, have some candy. Useful tools and cheat sheet for Captures The Flag (CTF) contests. And also for Computer Security in general.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。