├── .docker └── apt-get-install ├── .dockerignore ├── .gitignore ├── .travis.yml ├── .travis.yml.footer ├── .travis.yml.header ├── Dockerfile ├── Dockerfile.archlinux ├── Dockerfile.artful ├── Dockerfile.fedora ├── Dockerfile.xenial ├── LICENSE ├── README.md ├── TODO ├── Vagrantfile ├── _buildstatus ├── .gitignore ├── fail.png ├── index.md ├── success.png └── unknown.png ├── afl ├── install ├── install-root-archlinux └── install-root-debian ├── android-sdk ├── install ├── install-root-archlinux └── install-root-debian ├── angr ├── install └── install-root-debian ├── apktool ├── install ├── install-root-archlinux └── install-root-debian ├── barf ├── install ├── install-root-debian └── uninstall ├── beef ├── install ├── install-root-archlinux └── install-root-debian ├── bin ├── ctf-tools-pip ├── ctf-tools-pip3 ├── ctf-tools-test-action ├── ctf-tools-venv-activate ├── ctf-tools-venv-activate3 ├── manage-tools ├── travis-ci-status │ ├── Dockerfile │ ├── Makefile │ ├── fetch_latest_timingdata.inside-docker.sh │ ├── gen_travis_yml.sh │ ├── make_binpacked_travis_ci_conf.py │ └── make_build_status_md.py └── travis-ci.sh ├── bindead ├── install └── install-root-debian ├── binwalk ├── install └── uninstall ├── burpsuite ├── install ├── install-root-archlinux └── install-root-debian ├── capstone ├── install ├── test └── uninstall ├── checksec └── install ├── codereason ├── install └── install-root-debian ├── commix └── install ├── cribdrag └── install ├── cross2 └── install ├── crosstool ├── build-sample.sh ├── config ├── install ├── install-root-archlinux ├── install-root-debian └── uninstall ├── df ├── install └── install-root-debian ├── dirb ├── install ├── install-root-archlinux └── install-root-debian ├── dirsearch └── install ├── dislocker ├── install ├── install-root-archlinux └── install-root-debian ├── elfkickers └── install ├── elfparser ├── install └── install-root-debian ├── evilize └── install ├── exetractor └── install ├── fastcoll └── install ├── featherduster ├── install ├── install-root-debian └── uninstall ├── firmware-mod-kit ├── install ├── install-root-archlinux └── install-root-debian ├── foresight ├── install └── uninstall ├── galois └── install ├── gdb-heap ├── install ├── install-root-debian └── install-root-fedora ├── gdb ├── install ├── install-root-archlinux ├── install-root-debian └── install-root-fedora ├── gef └── install ├── ghidra ├── install └── install-root-debian ├── hash-identifier ├── install └── install-root-debian ├── hashkill ├── install ├── install-root-archlinux └── install-root-debian ├── hashpump-partialhash ├── install ├── install-root-archlinux └── install-root-debian ├── hashpump ├── install ├── install-root-archlinux ├── install-root-debian └── uninstall ├── honggfuzz ├── install ├── install-root-archlinux └── install-root-debian ├── jdgui ├── install ├── install-root-archlinux └── install-root-debian ├── keystone ├── install ├── test └── uninstall ├── libc-database └── install ├── libheap ├── install ├── install-root-debian └── install-root-fedora ├── lief ├── install ├── install-root-archlinux ├── install-root-debian ├── install-root-fedora └── uninstall ├── littleblackbox ├── install ├── install-root-archlinux └── install-root-debian ├── manticore ├── install ├── install-root-debian └── uninstall ├── miasm ├── install ├── install-root-archlinux ├── install-root-debian ├── install-root-fedora └── uninstall ├── mitmproxy ├── install ├── install-root-debian └── uninstall ├── msieve ├── install ├── install-root-archlinux └── install-root-debian ├── nonce-disrespect ├── build.patch ├── install └── install-root-debian ├── one_gadget └── install ├── panda ├── install ├── install-root-archlinux ├── install-root-debian ├── install-root-ubuntu └── uninstall ├── pathgrind ├── install ├── install-root-debian └── pathgrind.patch ├── pdf-parser └── install ├── peda └── install ├── peepdf └── install ├── pemcrack ├── install └── install-root-debian ├── pkcrack └── install ├── preeny └── install ├── pwndbg ├── install ├── install-root-archlinux ├── install-root-debian └── install-root-fedora ├── pwntools ├── install ├── install-root-archlinux ├── install-root-fedora ├── install-root-ubuntu └── uninstall ├── python-paddingoracle ├── install └── uninstall ├── python-pin └── install ├── pyvmmonitor └── install ├── qemu ├── install ├── install-root-archlinux └── install-root-debian ├── qira ├── install ├── install-root-archlinux ├── install-root-debian └── qira_fix.patch ├── radare2 ├── install └── uninstall ├── rappel ├── install └── install-root-debian ├── reveng └── install ├── ropper ├── install └── test ├── rp++ └── install ├── rr ├── configure-system ├── install ├── install-root-archlinux ├── install-root-debian └── install-root-fedora ├── scratchabit └── install ├── scratchablock ├── install ├── install-root-debian └── uninstall ├── scrdec18 └── install ├── seccomp-tools └── install ├── shellnoob └── install ├── shellsploit └── install ├── snowman ├── install ├── install-root-archlinux ├── install-root-debian └── install-root-fedora ├── sonic-visualizer ├── install ├── install-root-archlinux └── install-root-debian ├── sqlmap ├── install ├── install-root-archlinux └── install-root-debian ├── ssh_decoder └── install ├── sslsplit ├── install ├── install-root-archlinux └── install-root-debian ├── steganabara └── install ├── stegdetect ├── install ├── install-root-archlinux └── install-root-debian ├── stego-toolkit ├── install └── install-root-debian ├── stegosaurus └── install ├── stegsolve └── install ├── subbrute └── install ├── taintgrind └── install ├── testdisk └── install ├── tor-browser └── install ├── unicorn ├── install ├── install-root-debian ├── test └── uninstall ├── valgrind └── install ├── veles ├── install ├── install-root-archlinux └── install-root-debian ├── villoc └── install ├── virtualsocket └── install ├── wcc ├── install ├── install-root-archlinux ├── install-root-debian └── install-root-fedora ├── xortool ├── install └── uninstall ├── xrop ├── install └── install-root-debian ├── xspy ├── install └── install-root-debian ├── yafu ├── install └── test ├── youtube-dl └── install ├── z3 ├── install ├── test └── uninstall └── zsteg ├── install ├── install-root-archlinux ├── install-root-debian └── uninstall /.docker/apt-get-install: -------------------------------------------------------------------------------- 1 | #!/bin/sh -e 2 | export DEBIAN_FRONTEND="noninteractive" 3 | # update the package lists etc. 4 | apt-get -q update 5 | # this is actually against docker recommendations... But we'll do it anyway in 6 | # case our base image was not yet updated. 7 | apt-get dist-upgrade -y --no-install-recommends --auto-remove 8 | # finally install the package 9 | apt-get install -y --no-install-recommends --auto-remove "$@" 10 | # remove the package lists and apt-get metadata, such that the docker image 11 | # layer stays small 12 | apt-get -q clean 13 | rm -rf /var/lib/apt/lists/* 14 | -------------------------------------------------------------------------------- /.dockerignore: -------------------------------------------------------------------------------- 1 | * 2 | !.git 3 | !.docker 4 | !bin/ 5 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | */* 2 | bin/* 3 | !*/install 4 | !*/uninstall 5 | !*/install-root-* 6 | !*/upgrade 7 | !*/test 8 | -------------------------------------------------------------------------------- /.travis.yml: -------------------------------------------------------------------------------- 1 | language: bash 2 | sudo: required 3 | services: 4 | - docker 5 | before_install: 6 | - if [ "$DISTRO" = "archlinux" ]; then docker build -t ctftools -f Dockerfile.archlinux .; fi 7 | - if [ "$DISTRO" = "fedora" ]; then docker build -t ctftools -f Dockerfile.fedora .; fi 8 | - if [ "$DISTRO" = "xenial" ]; then docker build -t ctftools -f Dockerfile.xenial .; fi 9 | - if [ "$DISTRO" = "trusty" ]; then docker build -t ctftools -f Dockerfile .; fi 10 | 11 | env: 12 | 13 | - DISTRO='archlinux' TOOL='afl android-sdk apktool binwalk burpsuite checksec df dirb elfkickers evilize featherduster firmware-mod-kit gdb hashpump hashpump-partialhash honggfuzz jdgui keystone libheap msieve pkcrack pwndbg pwntools python-paddingoracle pyvmmonitor radare2 sqlmap sslsplit testdisk tor-browser unicorn veles virtualsocket xortool xrop yafu zsteg' # estimated 2000 seconds 14 | - DISTRO='archlinux' TOOL='commix cribdrag dirsearch exetractor foresight gef pdf-parser peda peepdf pemcrack rp++ scrdec18 shellnoob ssh_decoder steganabara stegsolve subbrute' # estimated 16 seconds 15 | - DISTRO='archlinux' EXPECTFAIL=1 TOOL='qira taintgrind z3' # estimated 1831 seconds 16 | - DISTRO='archlinux' EXPECTFAIL=1 TOOL='angr barf beef bindead capstone codereason dislocker elfparser gdb-heap hash-identifier hashkill littleblackbox mitmproxy panda pathgrind preeny python-pin reveng ropper shellsploit snowman sonic-visualizer stegdetect villoc wcc xspy' # estimated 764 seconds 17 | # - DISTRO='archlinux' TOOL='qemu' # unknown duration... 18 | - DISTRO='fedora' TOOL='apktool binwalk burpsuite capstone checksec commix cribdrag dirsearch elfkickers evilize exetractor foresight gdb gef jdgui libheap pdf-parser peda peepdf pkcrack python-paddingoracle pyvmmonitor radare2 ropper rp++ scrdec18 shellnoob shellsploit ssh_decoder steganabara stegsolve subbrute unicorn virtualsocket xortool yafu z3' # estimated 1779 seconds 19 | - DISTRO='fedora' EXPECTFAIL=1 TOOL='afl android-sdk angr barf beef bindead codereason df dirb dislocker elfparser featherduster firmware-mod-kit gdb-heap hash-identifier hashkill hashpump hashpump-partialhash honggfuzz keystone littleblackbox mitmproxy msieve panda pathgrind pemcrack preeny pwndbg pwntools python-pin qemu qira reveng snowman sonic-visualizer sqlmap sslsplit stegdetect taintgrind testdisk tor-browser veles villoc wcc xrop xspy zsteg' # estimated 549 seconds 20 | - DISTRO='trusty' TOOL='barf capstone jdgui stegdetect yafu z3' # estimated 1995 seconds 21 | - DISTRO='trusty' TOOL='qemu' # estimated 2160 seconds 22 | - DISTRO='trusty' TOOL='apktool bindead featherduster gdb qira snowman' # estimated 1976 seconds 23 | - DISTRO='trusty' TOOL='afl android-sdk burpsuite codereason df firmware-mod-kit hashkill keystone mitmproxy pwndbg pwntools radare2 unicorn' # estimated 1976 seconds 24 | - DISTRO='trusty' TOOL='binwalk checksec commix cribdrag dirb dirsearch dislocker elfkickers elfparser evilize exetractor foresight gef hash-identifier hashpump hashpump-partialhash honggfuzz libheap littleblackbox msieve pdf-parser peda peepdf pemcrack pkcrack preeny python-paddingoracle python-pin pyvmmonitor ropper rp++ scrdec18 shellnoob shellsploit sqlmap ssh_decoder sslsplit steganabara stegsolve subbrute testdisk tor-browser villoc virtualsocket xortool xspy zsteg' # estimated 374 seconds 25 | - DISTRO='trusty' EXPECTFAIL=1 TOOL='angr panda sonic-visualizer' # estimated 1877 seconds 26 | - DISTRO='trusty' EXPECTFAIL=1 TOOL='beef gdb-heap pathgrind reveng taintgrind veles wcc xrop' # estimated 303 seconds 27 | - DISTRO='xenial' TOOL='qemu' # estimated 1928 seconds 28 | - DISTRO='xenial' TOOL='barf keystone mitmproxy z3' # estimated 1920 seconds 29 | - DISTRO='xenial' TOOL='afl android-sdk angr firmware-mod-kit gdb snowman' # estimated 1985 seconds 30 | - DISTRO='xenial' TOOL='apktool binwalk burpsuite capstone checksec codereason commix cribdrag df dirb dirsearch dislocker elfkickers elfparser evilize exetractor featherduster foresight gef hash-identifier hashpump hashpump-partialhash honggfuzz jdgui libheap littleblackbox msieve pdf-parser peda peepdf pemcrack pkcrack preeny pwndbg python-paddingoracle pyvmmonitor radare2 ropper rp++ scrdec18 shellnoob shellsploit sqlmap ssh_decoder sslsplit steganabara stegsolve subbrute testdisk tor-browser unicorn veles virtualsocket xortool xspy yafu' # estimated 1230 seconds 31 | - DISTRO='xenial' EXPECTFAIL=1 TOOL='beef bindead gdb-heap hashkill panda pathgrind pwntools python-pin qira reveng sonic-visualizer stegdetect taintgrind villoc wcc xrop zsteg' # estimated 457 seconds 32 | script: 33 | - travis_wait 50 ./bin/travis-ci.sh 34 | 35 | -------------------------------------------------------------------------------- /.travis.yml.footer: -------------------------------------------------------------------------------- 1 | script: 2 | - travis_wait 50 ./bin/travis-ci.sh 3 | 4 | -------------------------------------------------------------------------------- /.travis.yml.header: -------------------------------------------------------------------------------- 1 | language: bash 2 | sudo: required 3 | services: 4 | - docker 5 | before_install: 6 | - if [ "$DISTRO" = "archlinux" ]; then docker build -t ctftools -f Dockerfile.archlinux .; fi 7 | - if [ "$DISTRO" = "fedora" ]; then docker build -t ctftools -f Dockerfile.fedora .; fi 8 | - if [ "$DISTRO" = "xenial" ]; then docker build -t ctftools -f Dockerfile.xenial .; fi 9 | - if [ "$DISTRO" = "trusty" ]; then docker build -t ctftools -f Dockerfile .; fi 10 | 11 | env: 12 | 13 | -------------------------------------------------------------------------------- /Dockerfile: -------------------------------------------------------------------------------- 1 | FROM ubuntu:trusty 2 | 3 | # wrapper script for apt-get 4 | COPY .docker/apt-get-install /usr/local/bin/apt-get-install 5 | RUN chmod +x /usr/local/bin/apt-get-install 6 | 7 | RUN apt-get-install build-essential libtool g++ gcc \ 8 | texinfo curl wget automake autoconf python python-dev git subversion \ 9 | unzip virtualenvwrapper sudo git virtualenvwrapper ca-certificates 10 | 11 | RUN useradd -m ctf 12 | RUN echo "ctf ALL=NOPASSWD: ALL" > /etc/sudoers.d/ctf 13 | 14 | COPY .git /home/ctf/tools/.git 15 | RUN chown -R ctf.ctf /home/ctf/tools 16 | 17 | # git checkout of the files 18 | USER ctf 19 | WORKDIR /home/ctf/tools 20 | RUN git checkout . 21 | 22 | # add non-commited scripts 23 | USER root 24 | COPY bin/manage-tools /home/ctf/tools/bin/ 25 | COPY bin/ctf-tools-pip /home/ctf/tools/bin/ 26 | COPY bin/ctf-tools-venv-activate /home/ctf/tools/bin/ 27 | COPY bin/ctf-tools-venv-activate3 /home/ctf/tools/bin/ 28 | RUN chown -R ctf.ctf /home/ctf/tools 29 | 30 | # finally run ctf-tools setup 31 | USER ctf 32 | RUN bin/manage-tools -s setup 33 | RUN bin/ctf-tools-pip install appdirs 34 | #RUN echo "workon ctftools" >> /home/ctf/.bashrc 35 | RUN echo 'source $(which ctf-tools-venv-activate)' >> /home/ctf/.bashrc 36 | 37 | WORKDIR /home/ctf 38 | CMD bash -i 39 | -------------------------------------------------------------------------------- /Dockerfile.archlinux: -------------------------------------------------------------------------------- 1 | from base/archlinux 2 | 3 | RUN cat /etc/pacman.d/mirrorlist \ 4 | | sed 's/^#Server/Server/' \ 5 | > /etc/pacman.d/mirrorlist.backup \ 6 | && rankmirrors -n 10 /etc/pacman.d/mirrorlist.backup \ 7 | > /etc/pacman.d/mirrorlist 8 | 9 | RUN echo "[multilib]" >> /etc/pacman.conf 10 | RUN echo "Include = /etc/pacman.d/mirrorlist" >> /etc/pacman.conf 11 | 12 | RUN pacman -Syy \ 13 | && pacman -S --noconfirm archlinux-keyring \ 14 | && pacman -Scc --noconfirm 15 | RUN pacman-key --refresh-keys 16 | RUN pacman -Syu --noconfirm \ 17 | && pacman-db-upgrade \ 18 | && pacman -Scc --noconfirm \ 19 | && pacman -Syu --noconfirm \ 20 | && pacman -Scc --noconfirm 21 | RUN trust extract-compat 22 | RUN pacman -Syu --noconfirm --needed \ 23 | curl wget python2 python3 git subversion \ 24 | python2-pip python-pip \ 25 | unzip python-virtualenvwrapper \ 26 | zsh grml-zsh-config \ 27 | sudo which \ 28 | && pacman -Scc --noconfirm 29 | 30 | RUN useradd -m ctf 31 | RUN echo "ctf ALL=NOPASSWD: ALL" > /etc/sudoers.d/ctf 32 | RUN chsh -s /usr/bin/zsh ctf 33 | 34 | COPY .git /home/ctf/tools/.git 35 | RUN chown -R ctf.ctf /home/ctf/tools 36 | 37 | USER ctf 38 | 39 | WORKDIR /home/ctf/tools 40 | RUN git checkout . 41 | 42 | # add non-commited scripts 43 | USER root 44 | COPY bin/manage-tools /home/ctf/tools/bin/ 45 | COPY bin/ctf-tools-pip /home/ctf/tools/bin/ 46 | COPY bin/ctf-tools-venv-activate /home/ctf/tools/bin/ 47 | COPY bin/ctf-tools-venv-activate3 /home/ctf/tools/bin/ 48 | RUN chown -R ctf.ctf /home/ctf/tools 49 | 50 | USER ctf 51 | RUN bin/manage-tools -s setup 52 | RUN echo 'source $(which virtualenvwrapper.sh)' >> ~/.zshrc 53 | RUN echo 'workon ctftools' >> ~/.zshrc 54 | 55 | WORKDIR /home/ctf 56 | CMD ["zsh", "-i"] 57 | -------------------------------------------------------------------------------- /Dockerfile.artful: -------------------------------------------------------------------------------- 1 | FROM ubuntu:artful 2 | 3 | # wrapper script for apt-get 4 | COPY .docker/apt-get-install /usr/local/bin/apt-get-install 5 | RUN chmod +x /usr/local/bin/apt-get-install 6 | 7 | RUN apt-get-install build-essential libtool g++ gcc \ 8 | texinfo curl wget automake autoconf python python-dev git subversion \ 9 | unzip virtualenvwrapper sudo git virtualenvwrapper 10 | 11 | RUN useradd -m ctf 12 | RUN echo "ctf ALL=NOPASSWD: ALL" > /etc/sudoers.d/ctf 13 | 14 | COPY .git /home/ctf/tools/.git 15 | RUN chown -R ctf.ctf /home/ctf/tools 16 | 17 | # git checkout of the files 18 | USER ctf 19 | WORKDIR /home/ctf/tools 20 | RUN git checkout . 21 | 22 | # add non-commited scripts 23 | USER root 24 | COPY bin/manage-tools /home/ctf/tools/bin/ 25 | COPY bin/ctf-tools-pip /home/ctf/tools/bin/ 26 | COPY bin/ctf-tools-venv-activate /home/ctf/tools/bin/ 27 | COPY bin/ctf-tools-venv-activate3 /home/ctf/tools/bin/ 28 | RUN chown -R ctf.ctf /home/ctf/tools 29 | 30 | # finally run ctf-tools setup 31 | USER ctf 32 | RUN bin/manage-tools -s setup 33 | RUN bin/ctf-tools-pip install appdirs 34 | #RUN echo "workon ctftools" >> /home/ctf/.bashrc 35 | RUN echo 'source $(which ctf-tools-venv-activate)' >> /home/ctf/.bashrc 36 | 37 | WORKDIR /home/ctf 38 | #CMD bash -i 39 | -------------------------------------------------------------------------------- /Dockerfile.fedora: -------------------------------------------------------------------------------- 1 | FROM fedora 2 | 3 | RUN dnf -y install which sudo git redhat-lsb 4 | 5 | RUN useradd -m ctf 6 | COPY .git /home/ctf/tools/.git 7 | RUN chown -R ctf.ctf /home/ctf/tools 8 | 9 | RUN echo "ctf ALL=NOPASSWD: ALL" > /etc/sudoers.d/ctf 10 | USER ctf 11 | 12 | WORKDIR /home/ctf/tools 13 | RUN git checkout . 14 | 15 | # add non-commited scripts 16 | USER root 17 | COPY bin/manage-tools /home/ctf/tools/bin/ 18 | COPY bin/ctf-tools-pip /home/ctf/tools/bin/ 19 | COPY bin/ctf-tools-venv-activate /home/ctf/tools/bin/ 20 | COPY bin/ctf-tools-venv-activate3 /home/ctf/tools/bin/ 21 | RUN chown -R ctf.ctf /home/ctf/tools 22 | 23 | USER ctf 24 | RUN bin/manage-tools -s setup 25 | RUN bin/ctf-tools-pip install appdirs 26 | RUN echo 'source $(which ctf-tools-venv-activate)' >> /home/ctf/.bashrc 27 | 28 | WORKDIR /home/ctf 29 | CMD bash -i 30 | -------------------------------------------------------------------------------- /Dockerfile.xenial: -------------------------------------------------------------------------------- 1 | from ubuntu:xenial 2 | 3 | # wrapper script for apt-get 4 | COPY .docker/apt-get-install /usr/local/bin/apt-get-install 5 | RUN chmod +x /usr/local/bin/apt-get-install 6 | 7 | RUN apt-get-install build-essential libtool g++ gcc \ 8 | texinfo curl wget automake autoconf python python-dev git subversion \ 9 | unzip virtualenvwrapper sudo git virtualenvwrapper 10 | 11 | RUN useradd -m ctf 12 | RUN echo "ctf ALL=NOPASSWD: ALL" > /etc/sudoers.d/ctf 13 | 14 | COPY .git /home/ctf/tools/.git 15 | RUN chown -R ctf.ctf /home/ctf/tools 16 | 17 | # git checkout of the files 18 | USER ctf 19 | WORKDIR /home/ctf/tools 20 | RUN git checkout . 21 | 22 | # add non-commited scripts 23 | USER root 24 | COPY bin/manage-tools /home/ctf/tools/bin/ 25 | COPY bin/ctf-tools-pip /home/ctf/tools/bin/ 26 | COPY bin/ctf-tools-venv-activate /home/ctf/tools/bin/ 27 | COPY bin/ctf-tools-venv-activate3 /home/ctf/tools/bin/ 28 | RUN chown -R ctf.ctf /home/ctf/tools 29 | 30 | # finally run ctf-tools setup 31 | USER ctf 32 | RUN bin/manage-tools -s setup 33 | RUN bin/ctf-tools-pip install appdirs 34 | #RUN echo "workon ctftools" >> /home/ctf/.bashrc 35 | RUN echo 'source $(which ctf-tools-venv-activate)' >> /home/ctf/.bashrc 36 | 37 | WORKDIR /home/ctf 38 | CMD bash -i 39 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | BSD 3-Clause License 2 | 3 | Copyright (c) 2019-present, Zardus and contributors 4 | All rights reserved. 5 | 6 | Redistribution and use in source and binary forms, with or without 7 | modification, are permitted provided that the following conditions are met: 8 | 9 | * Redistributions of source code must retain the above copyright notice, this 10 | list of conditions and the following disclaimer. 11 | 12 | * Redistributions in binary form must reproduce the above copyright notice, 13 | this list of conditions and the following disclaimer in the documentation 14 | and/or other materials provided with the distribution. 15 | 16 | * Neither the name of the copyright holder nor the names of its 17 | contributors may be used to endorse or promote products derived from 18 | this software without specific prior written permission. 19 | 20 | THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 21 | AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22 | IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE 23 | DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE 24 | FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25 | DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 26 | SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 27 | CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 28 | OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 29 | OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 30 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # ctf-tools 2 | [![Build Status](https://travis-ci.org/zardus/ctf-tools.svg?branch=master)](https://travis-ci.org/zardus/ctf-tools) 3 | [![IRC](https://img.shields.io/badge/freenode-%23ctf--tools-green.svg)](http://webchat.freenode.net/?channels=#ctf-tools) 4 | 5 | This is a collection of setup scripts to create an install of various security research tools. 6 | Of course, this isn't a hard problem, but it's really nice to have them in one place that's easily deployable to new machines and so forth. 7 | The install-scripts for these tools are checked regularly, the results can be found on [the build status page](_buildstatus/index.md). 8 | 9 | Installers for the following tools are included: 10 | 11 | | Category | Source | Tool | Description | 12 | |----------|--------|------|-------------| 13 | | binary | Directory | [afl](http://lcamtuf.coredump.cx/afl/) | State-of-the-art fuzzer. | 14 | | binary | Directory | [angr](http://angr.io) | Next-generation binary analysis engine from Shellphish. | 15 | | binary | Directory | [barf](https://github.com/programa-stic/barf-project) | Binary Analysis and Reverse-engineering Framework. | 16 | | binary | Directory | [bindead](https://bitbucket.org/mihaila/bindead/wiki/Home) | A static analysis tool for binaries. | 17 | | binary | Library | [capstone](http://www.capstone-engine.org) | Multi-architecture disassembly framework. | 18 | | binary | Directory | [checksec](https://github.com/slimm609/checksec.sh) | Check binary hardening settings. | 19 | | binary | Directory | [codereason](https://github.com/trailofbits/codereason) | Semantic Binary Code Analysis Framework. | 20 | | binary | Directory | [crosstool-ng](http://crosstool-ng.org/) | Cross-compilers and cross-architecture tools. | 21 | | binary | Directory | [cross2](http://kozos.jp/books/asm/asm.html) | A set of cross-compilation tools from a Japanese book on C. | 22 | | binary | Directory | [elfkickers](http://www.muppetlabs.com/~breadbox/software/elfkickers.html) | A set of utilities for working with ELF files. | 23 | | binary | Directory | [elfparser](http://www.elfparser.com/) | Quickly determine the capabilities of an ELF binary through static analysis. | 24 | | binary | Directory | [evilize](http://www.mathstat.dal.ca/~selinger/md5collision/) | Tool to create MD5 colliding binaries | 25 | | binary | Directory | [gdb](http://www.gnu.org/software/gdb/) | Up-to-date gdb with python2 bindings. | 26 | | binary | Directory | [gdb-heap](https://github.com/rogerhu/gdb-heap) | gdb extension for debugging heap issues. | 27 | | binary | Directory | [gef](https://github.com/hugsy/gef) | Enhanced environment for gdb. | 28 | | binary | Directory | [hongfuzz](https://github.com/google/honggfuzz) | A general-purpose, easy-to-use fuzzer with interesting analysis options. | 29 | | binary | Library | [keystone](http://www.keystone-engine.org) | Lightweight multi-architecture assembler framework. | 30 | | binary | Directory | [libheap](https://github.com/cloudburst/libheap) | gdb python library for examining the glibc heap (ptmalloc) | 31 | | binary | Library | [lief](https://lief.quarkslab.com/) | Library to Instrument Executable Formats. | 32 | | binary | Directory | [miasm](https://github.com/cea-sec/miasm) | Reverse engineering framework in Python. | 33 | | binary | Directory | [one_gadget](https://github.com/david942j/one_gadget) | Magic gadget search for libc. | 34 | | binary | Directory | [panda](https://github.com/moyix/panda) | Platform for Architecture-Neutral Dynamic Analysis. | 35 | | binary | Directory | [pathgrind](https://github.com/codelion/pathgrind) | Path-based, symbolically-assisted fuzzer. | 36 | | binary | Directory | [peda](https://github.com/longld/peda) | Enhanced environment for gdb. | 37 | | binary | Directory | [preeny](https://github.com/zardus/preeny) | A collection of helpful preloads (compiled for many architectures!). | 38 | | binary | Directory | [pwndbg](https://github.com/zachriggle/pwndbg) | Enhanced environment for gdb. Especially for pwning. | 39 | | binary | Directory | [pwntools](https://github.com/Gallopsled/pwntools) | Useful CTF utilities. | 40 | | binary | Directory | [python-pin](https://github.com/blankwall/Python_Pin) | Python bindings for pin. | 41 | | binary | Directory | [qemu](http://qemu.org) | Latest version of qemu! | 42 | | binary | Directory | [qira](http://qira.me) | Parallel, timeless debugger. | 43 | | binary | Directory | [radare2](http://www.radare.org/) | Some crazy thing crowell likes. | 44 | | binary | Directory | [rappel](https://github.com/yrp604/rappel) | A linux-based assembly REPL. | 45 | | binary | Directory | [ropper](https://github.com/sashs/Ropper) | Another gadget finder. | 46 | | binary | Directory | [rp++](https://github.com/0vercl0k/rp) | Another gadget finder. | 47 | | binary | Directory | [rr](http://rr-project.org) | Record and Replay Debugging Framework | 48 | | binary | Directory | [scratchabit](https://github.com/pfalcon/ScratchABit) | Easily retargetable and hackable interactive disassembler | 49 | | binary | Directory | [scratchablock](https://github.com/pfalcon/ScratchABlock) | Yet another crippled decompiler project | 50 | | binary | Directory | [seccomp-tools](https://github.com/david942j/seccomp-tools) | Provides powerful tools for seccomp analysis | 51 | | binary | Directory | [shellnoob](https://github.com/reyammer/shellnoob) | Shellcode writing helper. | 52 | | binary | Directory | [shellsploit](https://github.com/b3mb4m/shellsploit-framework) | Shellcode development kit. | 53 | | binary | Directory | [snowman](https://github.com/yegord/snowman) | Cross-architecture decompiler. | 54 | | binary | Directory | [taintgrind](https://github.com/wmkhoo/taintgrind) | A valgrind taint analysis tool. | 55 | | binary | Library | [unicorn](http://www.unicorn-engine.org) | Multi-architecture CPU emulator framework. | 56 | | binary | Directory | [valgrind](http://valgrind.org) | A Dynamic Binary Instrumentation framework with some built-in tools. | 57 | | binary | Directory | [villoc](https://github.com/wapiflapi/villoc) | Visualization of heap operations. | 58 | | binary | Directory | [virtualsocket](https://github.com/antoniobianchi333/virtualsocket) | A nice library to interact with binaries. | 59 | | binary | Directory | [wcc](https://github.com/endrazine/wcc) | The Witchcraft Compiler Collection is a collection of compilation tools to perform binary black magic on the GNU/Linux and other POSIX platforms. | 60 | | binary | Directory | [xrop](https://github.com/acama/xrop) | Gadget finder. | 61 | | binary | Directory | [manticore](https://github.com/trailofbits/manticore) | Manticore is a prototyping tool for dynamic binary analysis, with support for symbolic execution, taint analysis, and binary instrumentation. | 62 | | forensics | Directory | [binwalk](https://github.com/devttys0/binwalk.git) | Firmware (and arbitrary file) analysis tool. | 63 | | forensics | Directory | [dislocker](http://www.hsc.fr/ressources/outils/dislocker/) | Tool for reading Bitlocker encrypted partitions. | 64 | | forensics | Directory | [exetractor](https://github.com/kholia/exetractor-clone) | Unpacker for packed Python executables. Supports PyInstaller and py2exe. | 65 | | forensics | Directory | [firmware-mod-kit](https://code.google.com/p/firmware-mod-kit/) | Tools for firmware packing/unpacking. | 66 | | forensics | apt | [foremost](http://foremost.sourceforge.net/) | File carver. | 67 | | forensics | Directory | [pdf-parser](http://blog.didierstevens.com/programs/pdf-tools/) | Tool for digging in PDF files | 68 | | forensics | Directory | [peepdf](https://github.com/jesparza/peepdf) | Powerful Python tool to analyze PDF documents. | 69 | | forensics | Directory | [scrdec](https://gist.github.com/bcse/1834878) | A decoder for encoded Windows Scripts. | 70 | | forensics | Directory | [testdisk](http://www.cgsecurity.org/wiki/TestDisk) | Testdisk and photorec for file recovery. | 71 | | crypto | Directory | [cribdrag](https://github.com/SpiderLabs/cribdrag) | Interactive crib dragging tool (for crypto). | 72 | | crypto | Directory | [fastcoll](https://www.win.tue.nl/hashclash/) | An md5sum collision generator. | 73 | | crypto | Directory | [foresight](https://github.com/ALSchwalm/foresight) | A tool for predicting the output of random number generators. To run, launch "foresee". | 74 | | crypto | Directory | [featherduster](https://github.com/nccgroup/featherduster) | An automated, modular cryptanalysis tool. | 75 | | crypto | Directory | [galois](http://web.eecs.utk.edu/~plank/plank/papers/CS-07-593) | A fast galois field arithmetic library/toolkit. | 76 | | crypto | Directory | [hashkill](https://github.com/gat3way/hashkill) | Hash cracker. | 77 | | crypto | Directory | [hashpump](https://github.com/bwall/HashPump) | A tool for performing hash length extension attaacks. | 78 | | crypto | Directory | [hashpump-partialhash](https://github.com/mheistermann/HashPump-partialhash) | Hashpump, supporting partially-unknown hashes. | 79 | | crypto | Directory | [hash-identifier](https://code.google.com/p/hash-identifier/source/checkout) | Simple hash algorithm identifier. | 80 | | crypto | Directory | [libc-database](https://github.com/niklasb/libc-database) | Build a database of libc offsets to simplify exploitation. | 81 | | crypto | Directory | [littleblackbox](https://github.com/devttys0/littleblackbox) | Database of private SSL/SSH keys for embedded devices. | 82 | | crypto | Directory | [msieve](http://sourceforge.net/projects/msieve/) | Msieve is a C library implementing a suite of algorithms to factor large integers. | 83 | | crypto | Directory | [nonce-disrespect](https://github.com/nonce-disrespect/nonce-disrespect) | Nonce-Disrespecting Adversaries: Practical Forgery Attacks on GCM in TLS. | 84 | | crypto | Directory | [pemcrack](https://github.com/robertdavidgraham/pemcrack) | SSL PEM file cracker. | 85 | | crypto | Directory | [pkcrack](https://www.unix-ag.uni-kl.de/~conrad/krypto/pkcrack.html) | PkZip encryption cracker. | 86 | | crypto | Directory | [python-paddingoracle](https://github.com/mwielgoszewski/python-paddingoracle) | Padding oracle attack automation. | 87 | | crypto | Directory | [reveng](http://reveng.sourceforge.net/) | CRC finder. | 88 | | crypto | Directory | [ssh_decoder](https://github.com/jjyg/ssh_decoder) | A tool for decoding ssh traffic. You will need `ruby1.8` from `https://launchpad.net/~brightbox/+archive/ubuntu/ruby-ng` to run this. Run with `ssh_decoder --help` for help, as running it with no arguments causes it to crash. | 89 | | crypto | Directory | [sslsplit](https://github.com/droe/sslsplit) | SSL/TLS MITM. | 90 | | crypto | Directory | [xortool](https://github.com/hellman/xortool) | XOR analysis tool. | 91 | | crypto | Directory | [yafu](http://sourceforge.net/projects/yafu/) | Automated integer factorization. | 92 | | web | Directory | [burpsuite](http://portswigger.net/burp) | Web proxy to do naughty web stuff. | 93 | | web | Directory | [commix](https://github.com/stasinopoulos/commix) | Command injection and exploitation tool. | 94 | | web | Directory | [dirb](http://dirb.sourceforge.net/) | Web path scanner. | 95 | | web | Directory | [dirsearch](https://github.com/maurosoria/dirsearch) | Web path scanner. | 96 | | web | Directory | [mitmproxy](https://mitmproxy.org/) | CLI Web proxy and python library. | 97 | | web | Directory | [sqlmap](http://sqlmap.org/) | SQL injection automation engine. | 98 | | web | Directory | [subbrute](https://github.com/TheRook/subbrute) | A DNS meta-query spider that enumerates DNS records, and subdomains. | 99 | | stego | apt | [pngtools](https://launchpad.net/ubuntu/+source/pngtools) | PNG's analysis tool. | 100 | | stego | Directory | [sound-visualizer](http://www.sonicvisualiser.org/) | Audio file visualization. | 101 | | stego | Directory | [steganabara](http://www.caesum.com/handbook/stego.htm) | Another image stenography solver. | 102 | | stego | Directory | [stegdetect](http://www.outguess.org/) | Stenography detection/breaking tool. | 103 | | stego | Docker | [stego-toolkit](https://github.com/DominicBreuker/stego-toolkit) | A docker image with dozens of steg tools. | 104 | | stego | Directory | [stegsolve](http://www.caesum.com/handbook/stego.htm) | Image stenography solver. | 105 | | stego | Directory | [stegosaurus](https://github.com/AngelKitty/stegosaurus) | A steganography tool for embedding arbitrary payloads in Python bytecode (pyc or pyo) files. | 106 | | stego | Directory | [zsteg](https://github.com/zed-0xff/zsteg) | detect stegano-hidden data in PNG & BMP. | 107 | | dsniff | apt | [dsniff](http://www.monkey.org/~dugsong/dsniff/) | Grabs passwords and other data from pcaps/network streams. | 108 | | android | Directory | [apktool](https://ibotpeaches.github.io/Apktool/) | Dissect, dis-assemble, and re-pack Android APKs | 109 | | android | Directory | [android-sdk](http://developer.android.com/sdk) | The android SDK (adb, emulator, etc). | 110 | | misc | Directory | [xspy](http://git.kali.org/gitweb/?p=packages/xspy.git;a=summary) | Tiny tool to spy on X sessions. | 111 | | misc | Directory | [z3](https://github.com/Z3Prover/z3) | Theorem prover from Microsoft Research. | 112 | | misc | Directory | [jdgui](http://jd.benow.ca/) | Java decompiler. | 113 | | misc | Directory | [veles](https://codisec.com/veles/) | Binary data analysis and visualization tool. | 114 | | misc | Directory | [youtube-dl](https://yt-dl.org/) | Latest version of the popular youtube downloader. | 115 | 116 | There are also some installers for non-CTF stuff to break the monotony! 117 | 118 | | Category | Tool | Description | 119 | |----------|------|-------------| 120 | | C magic | [C-bind](https://github.com/zwimer/C-bind) | A library used to enable function binding in C! | 121 | | game | [Dwarf Fortress](http://www.bay12games.com/dwarves/) | Something to help you relax after a CTF! | 122 | | pyvmmonitor | [pyvmmonitor](http://www.pyvmmonitor.com/) | PyVmMonitor is a profiler with a simple goal: being the best way to profile a Python program. | 123 | | library collection | [single\_file\_libs](https://github.com/nothings/single_file_libs) | A large collection of useful single file include libraries written for C/C++ | 124 | | dolphin | [sudolphin](https://sudolph.in/) | If your friend ever leaves their laptop unlocked, `curl -sSL sh.sudolph.in \| sh` then wait and see! | 125 | | tor-browser | [tor-browser](https://www.torproject.org/projects/torbrowser.html.en) | Useful when you need to hit a web challenge from different IPs. | 126 | 127 | ## Usage 128 | 129 | To use, do: 130 | 131 | ```bash 132 | # set up the path 133 | /path/to/ctf-tools/bin/manage-tools setup 134 | source ~/.bashrc 135 | 136 | # list the available tools 137 | manage-tools list 138 | 139 | # install gdb, allowing it to try to sudo install dependencies 140 | manage-tools -s install gdb 141 | 142 | # install pwntools, but don't let it sudo install dependencies 143 | manage-tools install pwntools 144 | 145 | # install qemu, but use "nice" to avoid degrading performance during compilation 146 | manage-tools -n install qemu 147 | 148 | # uninstall gdb 149 | manage-tools uninstall gdb 150 | 151 | # uninstall all tools 152 | manage-tools uninstall all 153 | 154 | # search for a tool 155 | manage-tools search preload 156 | ``` 157 | 158 | Where possible, the tools keep the installs very self-contained (i.e., in to tool/ directory), and most uninstalls are just calls to `git clean` (**NOTE**, this is **NOT** careful; everything under the tool directory, including whatever you were working on, is blown away during an uninstall). 159 | One exception to this are python tools, which are installed using the `pip` 160 | package manager if possible. A `ctftools` virtualenv is created during the 161 | `manage-tools setup` command and can be accessed using the command 162 | `workon ctftools`. 163 | 164 | ## Help! 165 | 166 | Something not working? 167 | I didn't write (almost) any of these tools, but hit up [#ctf-tools on freenode](http://webchat.freenode.net/?channels=#ctf-tools) if you're desperate. 168 | Maybe some kind soul will help! 169 | 170 | ## Docker (version 1.7+) 171 | 172 | By popular demand, a Dockerfile has been included. 173 | You can build a docker image with: 174 | 175 | ```bash 176 | git clone https://github.com/zardus/ctf-tools 177 | cd ctf-tools 178 | docker build -t ctf-tools . 179 | ``` 180 | 181 | And run it with: 182 | 183 | ```bash 184 | docker run -it ctf-tools 185 | ``` 186 | 187 | The built image will have ctf-tools cloned and ready to go, but you will still need to install the tools themselves (see above). 188 | 189 | Alternatively, you can also pull ctf-tools (with some tools preinstalled) from dockerhub: 190 | 191 | ```bash 192 | docker run -it zardus/ctf-tools 193 | ``` 194 | 195 | ## Vagrant 196 | 197 | You can build a Vagrant VM with: 198 | 199 | ```bash 200 | wget https://raw.githubusercontent.com/zardus/ctf-tools/master/Vagrantfile 201 | vagrant plugin install vagrant-vbguest 202 | vagrant up 203 | ``` 204 | 205 | And connect to it via: 206 | 207 | ```bash 208 | vagrant ssh 209 | ``` 210 | 211 | ## Kali Linux 212 | 213 | Kali Linux (Sana and Rolling), due to manually setting certain libraries to not use the latest version available (sometimes being out of date by years) causes some tools to not install at all, or fail in strange ways. AFL and Panda comes to mind, in fact any tool that uses QEMU 2.30 will probably fail during compilation under Kali. 214 | Overriding these libraries breaks other tools included in Kali so your only solution is to either live with some of Kali's tools being broken, or running another distribution separately such as Ubuntu. 215 | 216 | Most tools aren't affected though. 217 | 218 | ## Adding Tools 219 | 220 | To add a tool (say, named *toolname*), do the following: 221 | 222 | 1. Create a `toolname` directory. 223 | 2. Create an `install` script. 224 | 3. (optional) if special uninstall steps are required, create an `uninstall` script. 225 | 226 | ### Install Scripts 227 | 228 | The install script will be run with `$PWD` being `toolname`. It should install the tool into this directory, in as contained a manner as possible. 229 | Ideally, full uninstallation should be possible with a `git clean`. 230 | 231 | The install script should create a `bin` directory and put its executables there. 232 | These executables will be automatically linked into the main `bin` directory for the repo. 233 | They could be launched from any directory, so don't make assumptions about the location of `$0`! 234 | 235 | ## License 236 | 237 | The individual tools are all licensed under their own licenses. 238 | As for ctf-tools itself, it is licensed under BSD 2-Clause License. 239 | If you find it useful, star it on github (https://github.com/zardus/ctf-tools). 240 | 241 | Good luck! 242 | 243 | # See Also 244 | 245 | There's a curated list of CTF tools, but without installers, here: https://github.com/apsdehal/aWEsoMe-cTf. 246 | 247 | There's a Vagrant config with a lot of the bigger frameworks here: https://github.com/thebarbershopper/epictreasure. 248 | -------------------------------------------------------------------------------- /TODO: -------------------------------------------------------------------------------- 1 | xrop -- doesn't build 2 | msieve 3 | sonic visualiser -- doesn't build 4 | -------------------------------------------------------------------------------- /Vagrantfile: -------------------------------------------------------------------------------- 1 | # -*- mode: ruby -*- 2 | # vi: set ft=ruby : 3 | 4 | $bootstrap = <