CTF Tooling

TTTRTA (The Tool That Rules Them All)

• CyberChef: The best 300 in 1 shampoo you’ll find.

Forensics

• Binary Ninja: For reverse engineering, often a better use of time than Ghidra
• Autopsy: For analyzing storage images for evidence
  • Carves deleted files
• Binwalk: For file extraction/analysis of binaries
  • binwalk firmware.bin - list all known signatures
  • binwalk -e firmware.bin - extract found files
  • Supports recursive extraction, entry analysis, etc.

Password Cracking

• John the Ripper
  • Great for extracting PDF hashes
  • Can auto detect hash type during crack
  • Usage: john --wordlist=rockyou.txt --rules user_hashes.txt
• Hashcat
  • Stronger hardware acceleration/out of box GPU usage
  • Usage: hashcat -a 6 -m 0 hashes.txt wordlist.txt ?d?d?d?d (-a 6 append)
  • Usage: hashcat -a 7 -m 0 hashes.txt ?s?d wordlist.txt -r rules/best64.rule (-a 7 prepend)
• Ophcrack
  • For older and unsalted Windows LM/NTLM hashes
  • XP free fast and Vista proba are solid rainbow table choices