tool reference

ctf tools with one-liner usage.

pwntools · ghidra · john · volatility · wireshark · binwalk · sqlmap · and more

binary exploitation

pwntools

Python library for exploit scripting. connect to local processes or remote services, craft payloads, and handle binary encoding.

connect remotefrom pwn import *; r = remote("host", port)

connect localr = process("./binary")

send + recvr.sendline(b"input"); r.recvuntil(b"prompt:")

pack 64-bit addressp64(0xdeadbeef) # little-endian

cyclic patterncyclic(200) # generate; cyclic_find(0x6161616b) # find offset

GDB + pwndbg

Dynamic debugger for Linux binaries. pwndbg plugin adds heap visualization, pattern generation, and better register display.

run with argsgdb ./binary; run $(python3 -c "print('A'*100)")

set breakpointb *main; b *0x401234

inspect stackstack 20 # pwndbg; x/20gx $rsp # vanilla

find offset to crashpattern create 200; pattern search $rip

dump instructionsdisassemble main; x/20i $rip

ROPgadget

Find ROP gadgets (instruction sequences ending in ret) within a binary or library.

all gadgetsROPgadget --binary ./binary

find specificROPgadget --binary ./binary --string "pop rdi; ret"

gadgets in libcROPgadget --binary /lib/x86_64-linux-gnu/libc.so.6 --string "pop rdi"

checksec

Audit binary security protections: NX, PIE, stack canary, RELRO, FORTIFY.

check binarychecksec --file=./binary

via pwntoolsfrom pwn import *; print(ELF("./binary").checksec())

one_gadget

Find single gadgets in libc that execute execve("/bin/sh"). Faster than a full ROP chain when register constraints match.

find gadgetsone_gadget /lib/x86_64-linux-gnu/libc-2.31.so

with constraintsone_gadget libc.so.6 --level 1

reverse engineering

Ghidra

Free NSA decompiler. Turns assembly into C-like pseudocode. Supports x86, ARM, MIPS, and more.

launch GUIghidra # then File > Import > Analyze

headless analysisanalyzeHeadless /project proj -import binary -postScript PrintTree.java

ltrace / strace

ltrace traces library calls (strcmp, memcmp, malloc). strace traces syscalls (read, write, open). Both reveal program behavior without a debugger.

trace library callsltrace ./binary

trace syscallsstrace ./binary

filter by callstrace -e trace=read,write ./binary

strings

Extract printable strings from any binary. Fast first step on any unknown file.

basicstrings ./binary

grep flag patternstrings ./binary | grep -i flag

minimum length 8strings -n 8 ./binary

angr

Python binary analysis framework with symbolic execution. Finds inputs that reach a target state.

find path to address

import angr; p = angr.Project("./binary"); sm = p.factory.simulation_manager(); sm.explore(find=0x401234); sm.found[0].posix.dumps(0)

forensics

Wireshark / tshark

PCAP analysis. Follow TCP/UDP streams, filter by protocol, export transferred objects.

open pcapwireshark capture.pcap

filter HTTPtshark -r capture.pcap -Y http

follow streamtshark -r capture.pcap -q -z follow,tcp,ascii,0

export HTTP objectstshark -r capture.pcap --export-objects http,./output_dir

Volatility

Memory forensics framework. Analyze Windows/Linux memory dumps to list processes, find network connections, recover files.

identify profile (v2)volatility -f mem.dmp imageinfo

list processes (v3)python3 vol.py -f mem.dmp windows.pslist

network connectionspython3 vol.py -f mem.dmp windows.netscan

find injected codepython3 vol.py -f mem.dmp windows.malfind

dump file from memorypython3 vol.py -f mem.dmp windows.dumpfiles --pid 1234

binwalk

Scan for embedded files and compression signatures. Extract everything found automatically.

scan filebinwalk file.bin

extract allbinwalk -e file.bin

recursive extractbinwalk -Me file.bin

exiftool

Extract metadata from images, documents, audio, and video. GPS, author, timestamps, comments.

all metadataexiftool image.jpg

GPS onlyexiftool -GPS* image.jpg

all files in direxiftool /dir/

zsteg

Detect and extract LSB steganography in PNG and BMP files.

scan all channelszsteg image.png

specific channelzsteg -c rgb image.png

extract payloadzsteg -e "b1,rgb,lsb,xy" image.png

steghide

Embed or extract hidden data from JPEG, BMP, WAV, and AU files.

extract (try empty pass)steghide extract -sf image.jpg

extract with passphrasesteghide extract -sf image.jpg -p "password"

embed datasteghide embed -cf image.jpg -sf secret.txt

foremost

Recover files from disk images or raw streams by file signature (file carving).

carve all typesforemost -i disk.img -o ./recovered

specific typeforemost -t jpg,png -i disk.img -o ./recovered

web exploitation

sqlmap

Automated SQL injection detection and exploitation. Run after manually confirming the injection point.

test GET paramsqlmap -u "http://target/page?id=1" --dbs

test POST paramsqlmap -u "http://target/login" --data "user=a&pass=b" -p user

dump tablesqlmap -u "..." -D dbname -T tablename --dump

with cookie/sessionsqlmap -u "..." --cookie "session=abc123"

ffuf

Fast web fuzzer. Directory brute-forcing, parameter discovery, virtual host enumeration.

directory fuzzffuf -u http://target/FUZZ -w /usr/share/wordlists/dirb/common.txt

fuzz parameterffuf -u "http://target/page?param=FUZZ" -w wordlist.txt

filter by sizeffuf -u http://target/FUZZ -w wordlist.txt -fs 1234

curl

Manual HTTP request crafting from the command line.

GET with headerscurl -H "Authorization: Bearer token" http://target/api

POST JSONcurl -X POST -H "Content-Type: application/json" -d '{"key":"val"}' http://target

follow redirectscurl -L http://target

show response headerscurl -i http://target

cryptography

John the Ripper

Password cracker. Supports hundreds of hash types and archive formats.

crack hash filejohn hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt

crack zip passwordzip2john file.zip > zip.hash; john zip.hash --wordlist=rockyou.txt

show crackedjohn hashes.txt --show

auto-detect formatjohn --list=formats | grep sha256

hashcat

GPU-accelerated password cracker. Faster than John for large wordlists on supported hardware.

crack MD5hashcat -m 0 hashes.txt rockyou.txt

crack SHA256hashcat -m 1400 hashes.txt rockyou.txt

with ruleshashcat -m 0 hashes.txt rockyou.txt -r rules/best64.rule

CyberChef

In-browser encoding/decoding/transformation tool. Magic mode auto-detects encoding. Chain operations for multi-layer puzzles.

URLhttps://gchq.github.io/CyberChef/

magic decodeInput encoded text → Operations > Magic > Bake

SageMath

Mathematical software for crypto CTF challenges. RSA, elliptic curves, lattice attacks.

factor small nfactor(n)

RSA decryptpow(c, d, n)

run scriptsage script.sage

osint

Sherlock

Search for a username across 300+ social media platforms.

search usernamesherlock username

multiple usernamessherlock user1 user2 user3

CSV outputsherlock username --csv

exiftool (OSINT)

Extract GPS and metadata from images to find location or author info.

get GPSexiftool -GPS* image.jpg

all metadata verboseexiftool -v3 image.jpg

glossary get hints →