CTF-Checklist - A composite list of various vulnerabilities and to

项目说明

CTF-Checklist

A composite list of and tools to look for and use while exploiting common CTF challenges

Forensics

| Tool | Description | Link |
| ----------- | ----------- | ---- |
| Wireshark | Capture packets sent by devices and analyze pcap files | Wireshark |
| pkcrack | Crack zip passwords or run known plaintext attacks | pkcrack |
| | Analyze memory dumps | |
| rockyou.txt | List of common passwords helpful in many categories | rockyou.txt |
| Aperi Solve | Image forensics tool that runs many stegonography tools | Aperi Solve |
| Audacity | Analyze, , and modify audio files | Audacity |
| SleuthKit | Analyze disk drives and dumps | SleuthKit |
| John The Ripper | General purpose password cracker | John The Ripper |
| dsniff | Sniff passwords from packet capture files | dsniff |
| foremost | Extract files from other files by header | `sudo apt install foremost |
| stegsnow | white space steganography | sudo apt install steganography |

Web


| Tool | Description | Link |
| ----------- | ----------- | ---- |
| RequestBin | Capture web requests | RequestBin |
| re | Generate reverse web shells for upload to a of different ser | re |
| BurpSuite | Intercept http requests, analyze them, and modify them before sending | BurpSuite |
| sqlmap | Automate sending sql injection payloads and detect sql injections on webpages | sqlmap |
| SQL Injection | SQL Injection authentication bypass cheatsheet | sql cheatsheet |
| SUID Find | Find SUID binaries on a linux system using find / -perm -u=s -type f 2>/dev/null |
| root binary find | Find binaries that run with root pri | sudo -l |
| Dirbuster | Find hidden directory and file paths on web servers | Dirbuster |
| Postman | General purpose HTTP request debugger and generator | Postman |

Binary Exploitation

| Tool | Description | Link |
| ----------- | ----------- | ---- |
| ir0nstone | PWN tutorials containing many resources/scripts for solving pwn challenges | ir0nstone |
| pwntools | Python library for prototyping and writing exploits | pwntools |
| ROPGadget | Tool for find ROP tools and crafting ROP chains | ROPGadget |
| shellstorm | Database of shellcode in both assembly and byte format | shellstorm |
| Wiremask Buffer O | Buffer o pattern generator that when combined with gdb can determine the offset to EIP/RIP when no canary is present | Wiremask |
| one_gadget | Find ROP gadgets specifically for spawning a shell i.e ROPing to execve('/bin/sh/, NULL, NULL) | one_gadget |
| checksec | check binary security properties of the executable re which attack will be possible | sudo apt-get install checksec` |
| Guide to Reading Assembly | The faker's guide to reading (x86) assembly language | Assembly Guide |

Reverse Engineering

| Tool | Description | Link |
| ----------- | ----------- | ---- |
| Ghidra | Reverse Engineering toolkit for decompiling binaries into C code for static analysis | Ghidra |
| Uncompyle | Decompile Python binaries | Uncompyle |
| angr | Binary analysis platform for Python with static/dynamic analysis support and symbolic execution | angr |
| jdgui | Ja for .class files | jdgui |
| IDA Freeware| Binary code analysis and reverse engineering | IDA Freeware |
| ImHex | Hex Editor for reverse engineering with patterns | ImHex |

Cryptography

| Tool | Description | Link |
| ----------- | ----------- | ---- |
| alpertron | Factor very large integers | alpertron |
| factordb | Database of many factored large integers | factordb |
| CyberChef | Generally useful for analyze encoded/encrypted strings and files | CyberChef |
| z3 | Theorem prover | z3 |
| OR-Tools | Similar to z3 but supposedly faster | OR-Tools |
| RsaCtfTool | Python script for automatically running known RSA attacks gi inputs | RsaCtfTool |
| sage | Fast math good. Fast math as python library good for quick scripting solutions | sage |
| xortool | Good for multi-byte xor analysis | xortool |
| randcrack | Predict generated by Python's random module | randcrack |
| RSA Algorithm | A nice explanation of the RSA algorithm by Lei Mao | RSA Tutorial |
| Elliptic Curves | Elliptic Cur by Ben Lynn | Elliptic Curves |
| cryptopals | Website with learning tools and challenges for learning about cryptography | cryptopals |

OSINT

| Tool | Description | Link |
| ----------- | ----------- | ---- |
| ARPSyndicate | List of helpful OSINT resources | ARPSyndicate |
| Epieos | OSINT Tool search engine that performs a of searches | Epieos |

Papers

| Category | Title | Link |
| ----------- | ----------- | ---- |
| crypto | Solving problems with the LLL algorithm | LLL |

项目信息

开发语言：未知

Star 数：64

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A composite list of various vulnerabilities and tools to look for and use while exploiting common CTF challenges展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。