Top 50 Awesome List


Security  2 years ago  7k
A curated list of CTF frameworks, libraries, resources and softwares
View on Github

Awesome CTF Build Status Awesome

A curated list of Capture The Flag (CTF) frameworks, libraries, resources, softwares and tutorials. This list aims to help starters as well as seasoned CTF players to find everything related to CTFs at one place.


Please take a quick look at the contribution guidelines first.

If you know a tool that isn't present here, feel free to open a pull request.


It takes time to build up collection of tools used in CTF and remember them all. This repo helps to keep all these scattered tools at one place.



Tools used for creating CTF challenges


Tools used for creating Forensics challenges


Projects that can be used to host a CTF


Tools used to create stego challenges

Check solve section for steganography.


Tools used for creating Web challenges

JavaScript Obfustcators


Tools used for solving CTF challenges


Tools used for performing various kinds of attacks


Tools used for solving Crypto challenges


Tools used for various kind of bruteforcing (passwords etc.)

  • Hashcat - Password Cracker
  • Hydra - A parallelized login cracker which supports numerous protocols to attack
  • John The Jumbostars6.4k - Community enhanced version of John the Ripper.
  • John The Ripper - Password Cracker.
  • Nozzlrstars61 - Nozzlr is a bruteforce framework, trully modular and script-friendly.
  • Ophcrack - Windows password cracker based on rainbow tables.
  • Patatorstars2.9k - Patator is a multi-purpose brute-forcer, with a modular design.
  • Turbo Intruder - Burp Suite extension for sending large numbers of HTTP requests


Tools used for solving Exploits challenges


Tools used for solving Forensics challenges

  • Aircrack-Ng - Crack 802.11 WEP and WPA-PSK keys.
    • apt-get install aircrack-ng
  • Audacity - Analyze sound files (mp3, m4a, whatever).
    • apt-get install audacity
  • Bkhive and Samdump2 - Dump SYSTEM and SAM files.
    • apt-get install samdump2 bkhive
  • CFF Explorer - PE Editor.
  • Creddumpstars210 - Dump windows credentials.
  • DVCS Ripperstars1.4k - Rips web accessible (distributed) version control systems.
  • Exif Tool - Read, write and edit file metadata.
  • Extundelete - Used for recovering lost data from mountable images.
  • Fibratusstars1.6k - Tool for exploration and tracing of the Windows kernel.
  • Foremost - Extract particular kind of files using headers.
    • apt-get install foremost
  • Fsck.ext4 - Used to fix corrupt filesystems.
  • Malzilla - Malware hunting tool.
  • NetworkMiner - Network Forensic Analysis Tool.
  • PDF Streams Inflater - Find and extract zlib files compressed in PDF files.
  • Pngcheck - Verifies the integrity of PNG and dump all of the chunk-level information in human-readable form.
    • apt-get install pngcheck
  • ResourcesExtract - Extract various filetypes from exes.
  • Shellbagsstars136 - Investigate NT_USER.dat files.
  • Snow - A Whitespace Steganography Tool.
  • USBRipstars1k - Simple CLI forensics tool for tracking USB device artifacts (history of USB events) on GNU/Linux.
  • Volatilitystars5.4k - To investigate memory dumps.
  • Wireshark - Used to analyze pcap or pcapng files

Registry Viewers

  • OfflineRegistryView - Simple tool for Windows that allows you to read offline Registry files from external drive and view the desired Registry key in .reg file format.
  • Registry Viewer® - Used to view Windows registries.


Tools used for solving Networking challenges

  • Masscanstars19.2k - Mass IP port scanner, TCP port scanner.
  • Monit - A linux tool to check a host on the network (and other non-network activities).
  • Nipestars1.4k - Nipe is a script to make Tor Network your default gateway.
  • Nmap - An open source utility for network discovery and security auditing.
  • Wireshark - Analyze the network dumps.
    • apt-get install wireshark
  • Zeek - An open-source network security monitor.
  • Zmap - An open-source network scanner.


Tools used for solving Reversing challenges

JavaScript Deobfuscators

  • Detox - A Javascript malware analysis tool.
  • Revelo - Analyze obfuscated Javascript code.

SWF Analyzers

  • RABCDAsmstars397 - Collection of utilities including an ActionScript 3 assembler/disassembler.
  • Swftools - Collection of utilities to work with SWF files.
  • Xxxswf - A Python script for analyzing Flash files.


Various kind of useful services available around the internet

  • CSWSH - Cross-Site WebSocket Hijacking Tester.
  • Request Bin - Lets you inspect http requests to a particular url.


Tools used for solving Steganography challenges

  • AperiSolve - Aperi'Solve is a platform which performs layer analysis on image (open-source).
  • Convert - Convert images b/w formats and apply filters.
  • Exif - Shows EXIF information in JPEG files.
  • Exiftool - Read and write meta information in files.
  • Exiv2 - Image metadata manipulation tool.
  • Image Steganography - Embeds text and files in images with optional encryption. Easy-to-use UI.
  • Image Steganography Online - This is a client-side Javascript tool to steganographically hide images inside the lower "bits" of other images
  • ImageMagick - Tool for manipulating images.
  • Outguess - Universal steganographic tool.
  • Pngtools - For various analysis related to PNGs.
    • apt-get install pngtools
  • SmartDeblurstars2.2k - Used to deblur and fix defocused images.
  • Steganabara - Tool for stegano analysis written in Java.
  • SteganographyOnline - Online steganography encoder and decoder.
  • Stegbreak - Launches brute-force dictionary attacks on JPG image.
  • StegCrackerstars456 - Steganography brute-force utility to uncover hidden data inside files.
  • stegextractstars97 - Detect hidden files and text in images.
  • Steghide - Hide data in various kind of images.
  • StegOnline - Conduct a wide range of image steganography operations, such as concealing/revealing files hidden within bits (open-source).
  • Stegsolve - Apply various steganography techniques to images.
  • Zstegstars884 - PNG/BMP analysis.


Tools used for solving Web challenges

  • BurpSuite - A graphical tool to testing website security.
  • Commixstars3.3k - Automated All-in-One OS Command Injection and Exploitation Tool.
  • Hackbar - Firefox addon for easy web exploitation.
  • OWASP ZAP - Intercepting proxy to replay, debug, and fuzz HTTP requests and responses
  • Postman - Add on for chrome for debugging network requests.
  • Raccoonstars2.5k - A high performance offensive security tool for reconnaissance and vulnerability scanning.
  • SQLMapstars23.8k - Automatic SQL injection and database takeover tool. pip install sqlmap
  • W3afstars4k - Web Application Attack and Audit Framework.
  • XSSer - Automated XSS testor.


Where to discover about CTF

Operating Systems

Penetration testing and security lab Operating Systems

Malware analysts and reverse-engineering

Starter Packs

Collections of installer scripts, useful tools

  • CTF Toolsstars6.6k - Collection of setup scripts to install various security research tools.
  • LazyKalistars39 - A 2016 refresh of LazyKali which simplifies install of tools and configuration.


Tutorials to learn how to play CTFs


Always online CTFs

  • Backdoor - Security Platform by SDSLabs.
  • Crackmes - Reverse Engineering Challenges.
  • CryptoHack - Fun cryptography challenges.
  • echoCTF.RED - Online CTF with a variety of targets to attack.
  • Exploit Exercises - Variety of VMs to learn variety of computer security issues.
  • Exploit.Education - Variety of VMs to learn variety of computer security issues.
  • Grackerstars4 - Binary challenges having a slow learning curve, and write-ups for each level.
  • Hack The Box - Weekly CTFs for all types of security enthusiasts.
  • Hack This Site - Training ground for hackers.
  • Hacker101 - CTF from HackerOne
  • Hacking-Lab - Ethical hacking, computer network and security challenge platform.
  • Hone Your Ninja Skills - Web challenges starting from basic ones.
  • IO - Wargame for binary challenges.
  • Microcorruption - Embedded security CTF.
  • Over The Wire - Wargame maintained by OvertheWire Community.
  • PentesterLab - Variety of VM and online challenges (paid).
  • PicoCTF - All year round ctf game. Questions from the yearly picoCTF competition.
  • PWN Challenge - Binary Exploitation Wargame.
  • - Pwn Game.
  • - Binary wargame.
  • - Binary Exploitation Wargame.
  • - Reversing challenge.
  • Ringzer0Team - Ringzer0 Team Online CTF.
  • Root-Me - Hacking and Information Security learning platform.
  • ROP Wargamesstars18 - ROP Wargames.
  • SANS HHC - Challenges with a holiday theme released annually and maintained by SANS.
  • SmashTheStack - A variety of wargames maintained by the SmashTheStack Community.
  • Viblo CTF - Various amazing CTF challenges, in many different categories. Has both Practice mode and Contest mode.
  • VulnHub - VM-based for practical in digital security, computer application & network administration.
  • W3Challs - A penetration testing training platform, which offers various computer challenges, in various categories.
  • WebHacking - Hacking challenges for web.

Self-hosted CTFs


Various general websites about and on CTF


Various Wikis available for learning about CTFs

Writeups Collections

Collections of CTF write-ups


CC0 :)


  1. Awesome CTF Build Status Awesome
  2. Contributing
  3. Why?
  4. Contents
  5. Create
  6. Forensics
  7. Platforms
  8. Steganography
  9. Web
  10. Solve
  11. Attacks
  12. Crypto
  13. Bruteforcers
  14. Exploits
  15. Forensics
  16. Networking
  17. Reversing
  18. Services
  19. Steganography
  20. Web
  21. Resources
  22. Operating Systems
  23. Starter Packs
  24. Tutorials
  25. Wargames
  26. Websites
  27. Wikis
  28. Writeups Collections
Last Checked At: 2022-06-24T18:39:02.789Z


Track your favorite github awesome repo, not just star it. provides website, newsletter, RSS for tracking the popular awesome list by daily and weekly.
Contact us: [email protected]
Track Awesome List - Track your favorite Github awesome repos, not just star them | Product Hunt


Subscribe to our weekly newsletter to receive the awesome updates! We never send spam and you can unsubscribe instantly with one click. Here's past issues.


Follow us on TwitterSubscribe us on TelegramSubmit awesome list repoNewsletterDonateSitemap