Skip to content

resources.md

Latest commit

 

History

History
331 lines (286 loc) · 39 KB

resources.md

File metadata and controls

331 lines (286 loc) · 39 KB
Raw

Flag format: grey{...}. This is the curated external-resource index.

CTF Reference & Tooling Guide — Grey Cat The Flag 2026

A deduplicated, ranked working reference for a serious team. Categories: AI, Crypto, Forensics, Pwn, RE, Web, Misc. Flag format grey{...}. Quals are remote, finals onsite at NUS. Each resource is a link + one-line why; highest-value/most-canonical first.

Top 10 — must-bookmark

  1. CTFtime — the hub: event calendar with weights, team rankings, and per-task writeup links; pick high-weight events and track standing.
  2. HackTricks — the single most comprehensive, continuously-updated attack wiki; technique-per-page across web, pwn, forensics, AI (canonical domain is now .wiki; old .xyz is dead).
  3. pwntools — the Python exploit-dev framework: process/remote IO, ELF/ROP/shellcraft, fmtstr_payload, cyclic; also the workhorse for any scripted socket interaction.
  4. Ghidra — free NSA decompiler/disassembler (x86/ARM/MIPS/…); the default static-analysis tool for RE and firmware.
  5. PortSwigger Web Security Academy — free interactive labs for every web class CTFs test; the best place to actually build web skill, not just look it up.
  6. pwn.college — ASU's structured dojo curriculum (asm, shellcode, memory errors, ROP, heap, kernel) plus a large archive of replayable past-event challenges.
  7. CryptoHack — the best interactive crypto trainer (number theory → RSA/AES/ECC/lattices) plus a permanent archive of real past-CTF crypto challenges.
  8. CyberChef — drag-and-drop encode/decode/crypto pipeline with a "Magic" auto-detector; fastest triage for layered encodings in misc/forensics/web.
  9. PayloadsAllTheThings — copy-paste payload/bypass repo organized per web vuln; fast reference during a live solve.
  10. NUS Greyhats GitHub — past GreyCTF repos — greyctf23/24/25-challs-public and earlier: the organizer's own challenge sources + solutions, the single best style/difficulty calibration for this event.

Pwn

  • pwntools — canonical exploit-dev framework; docs at docs.pwntools.com.
  • pwndbg — best GDB plugin for fast heap pwn: bins, vis_heap_chunks, telescope, context view, tcache/fastbin inspection.
  • GEF — single-file multi-arch GDB plugin (x86/ARM/MIPS/PPC/SPARC); pick GEF for non-x86, pwndbg for x86 heap speed.
  • how2heap (shellphish) — the reference collection of runnable heap-exploitation PoCs (tcache poisoning, fastbin dup, the Houses, poison-null-byte), organized per glibc version.
  • Nightmare (guyinatuxedo) — free 90+ challenge course built from real CTF problems with full walkthroughs; the best bridge from theory to live pwn (also covers RE).
  • ir0nstone Binary Exploitation Notes — clear notes on canaries, PIE/ASLR, ROP, ret2libc, PLT/GOT, ret2dlresolve, SROP, stack pivoting, intro heap.
  • CTF Wiki (EN) — Pwn — deep technique-by-technique reference; full heap taxonomy, format-string internals, IO_FILE, and kernel-pwn basics.
  • HackTricks — Binary Exploitation — practical lookup for stack overflow, ROP/JOP, ret2libc, ret2dlresolve, GOT/PLT leak, stack pivoting (cross-check addresses/offsets).
  • ctf101 — Binary Exploitation — clean, beginner-correct primers on overflow, format string, GOT/PLT, ROP, ret2libc; good for onboarding.
  • ROP Emporium — focused, progressively harder ROP-only challenges (ret2win → ret2csu) in x86/x64/ARM; the cleanest way to drill ROP mechanics.
  • pwnable.tw / pwnable.kr / pwnable.xyz — classic wargame sets; kr/xyz are beginner-to-intermediate, tw is harder modern glibc heap.
  • kernelpwn (smallkirby) — curated kernel-pwn learning path + writeups (SMEP/SMAP/KPTI/KASLR bypasses, ret2usr, modprobe_path, cred overwrite).
  • lkmidas — Learning Linux Kernel Exploitation — the standard step-by-step beginner series for kernel pwn (building/running challenges, QEMU+gdb, core primitives).

Rev

  • IDA Free / IDA Pro (Hex-Rays) — best-in-class decompiler and largest plugin ecosystem; IDA Free now has a usable x64 decompiler for many CTF binaries.
  • Binary Ninja — powerful scriptable IL (BNIL/HLIL) with a fast Python API; excellent for automated analysis (free cloud version available).
  • angr — the canonical Python symbolic/concolic-execution engine for "find the input that reaches WIN" challenges and deobfuscating opaque predicates.
  • Rizin + Cutter — modern radare2 fork with a Ghidra-derived decompiler and clean GUI; strong free scriptable CLI+GUI combo.
  • radare2 — command-line-first RE framework for fast triage, scripting, patching, and ESIL emulation.
  • x64dbg — best free Windows user-mode debugger for dynamic analysis, anti-debug bypass, manual unpacking, and patching.
  • Frida — dynamic instrumentation/hooking across Windows/Linux/macOS/Android/iOS; intercept functions, dump decrypted data, bypass checks at runtime.
  • dnSpyEx — the maintained fork for decompiling, editing, and live-debugging .NET/C# (Mono/Unity) binaries.
  • ILSpy / de4dot — open-source .NET decompilation (ILSpy) and obfuscation cleanup (de4dot) for managed binaries.
  • Detect It Easy (DiE) — first-step triage: file type, compiler, packer (UPX/Themida/…), and entropy.
  • Triton — research-grade DSE + taint + AST framework for advanced deobfuscation and VM devirtualization beyond angr's easy cases.
  • FLARE-On Challenge — Mandiant's annual single-player RE/malware CTF; the best high-quality practice for hard rev (packers, VM obfuscation, anti-debug).
  • FLARE-On archive (binaries + writeups) — all past FLARE-On binaries with official + community writeups for offline study.
  • crackmes.one — huge searchable repository of crackmes by difficulty/platform for daily rev practice (successor to crackmes.de).
  • HackTricks — Reversing — broad reversing cheatsheet: tools, common tricks, anti-debug, per-platform notes.
  • ctf101 — Reverse Engineering — clean primer on disassembly vs decompilation, tooling, and the core workflow.
  • Awesome Reverse Engineering — curated, learning-oriented index of RE courses, books, tools, and obfuscation/VM guides.
  • re-list (extremecoders-re) — comprehensive open-source catalog of disassemblers, unpackers, deobfuscators, and symbolic-execution tools.
  • OpenToAllCTF/REsources — curated RE resource list aimed specifically at CTF players.

Web

  • PortSwigger Research / Learning Paths — source of the cutting-edge techniques that become CTF challenges (request smuggling/desync, web cache deception, client-side prototype-pollution gadgets); James Kettle's smuggling work is canonical.
  • HackTricks — Pentesting Web — per-vuln pages (SQLi, SSTI, SSRF, XSS, JWT, deserialization, prototype pollution, smuggling) with payloads and bypasses.
  • The Hacker Recipes — Web — clean, methodology-driven companion to HackTricks; strong on recon/fuzzing and per-technique tradecraft.
  • jwt_tool wiki — Attack Methodology — definitive JWT attack checklist: alg:none, RS256→HS256 confusion, weak-HMAC cracking, kid injection, jku/jwk header injection.
  • GTFOBins — post-exploitation reference for the RCE/file-read stage web challenges lead into (after SSTI/upload/deserialization gives a shell or restricted binary).
  • ctf101 — Web Exploitation — concise primer on web CTF concepts; good for onboarding newer teammates.
  • Trail of Bits CTF Field Guide — Web — structured, CTF-oriented intro to web exploitation methodology.
  • 0xdf hacks stuff — extremely detailed CTF/box writeups; the gold standard for learning the thought process behind web (and other) solves.
  • Hacker101 CTF — HackerOne's web-focused practice CTF; strong complement to the PortSwigger labs for web specialists.

Crypto

  • Cryptopals — the canonical 8-set guided "learn by breaking" course (XOR, ECB/CBC/CTR attacks, padding oracle, RSA, DSA, length extension); the de facto onboarding path.
  • CryptoBook (CryptoHack community) — consolidated math+crypto wiki (modular arithmetic, algebra, LLL, RSA, DH, ECC, AES, hashes) with SageMath throughout.
  • SageMath — the essential math engine: LLL/BKZ, small_roots (Coppersmith), elliptic curves/discrete logs, factoring, polynomial rings over Zmod(N), CRT.
  • sage.crypto reference — official docs for Sage's crypto primitives (LFSR/stream ciphers, classical ciphers, EC helpers).
  • RsaCtfTool — Swiss-army RSA tool: auto-runs Wiener, Boneh-Durfee, Hastad, Fermat, ROCA, ECM/Pollard, partial-key/Coppersmith, factordb lookups; the go-to first pass on RSA.
  • jvdsn/crypto-attacks — clean, broad Python/Sage implementations of named attacks (Coppersmith variants, HNP/ECDSA nonce, LCG recovery, GCM/CBC).
  • defund/coppersmith — compact, widely-copied Sage small_roots; the standard drop-in for partial-info RSA and polynomial-mod-N problems.
  • kionactf/coppersmith — modern, robust Coppersmith library (univariate/linear/multivariate with bound/beta tuning) for cases where older scripts fail.
  • mimoo/RSA-and-LLL-attacks — reference Sage Coppersmith/Howgrave-Graham (stereotyped messages, factoring with high bits known) with a cryptologie.net explainer.
  • maple3142/lll_cvp — general-purpose Sage helper for building lattices and solving CVP/SVP (HNP, truncated LCG, knapsack, biased-nonce ECDSA).
  • HashPump / hashpumpy — automates hash length-extension against H(secret||data) MACs (MD5/SHA1/SHA256/SHA512); Python via pip install hashpumpy.
  • mpgn/Padding-oracle-attack — clean, readable PKCS7 CBC padding-oracle implementation you can adapt to a challenge oracle.
  • FeatherDuster + cryptanalib (NCC Group) — automated cryptanalysis triage that detects weak cryptosystems and suggests attacks.
  • HackTricks — Crypto & Stego — fast lookup for cipher/encoding identification, ECB/CBC tells, and a step-by-step CBC padding-oracle page.
  • ctf101 — Cryptography — concise, accurate beginner primers on RSA, AES, XOR, hashing.
  • Practical CTF (Jorian Woltjer) — Cryptography — practical, tooling-oriented notes on RSA, AES, custom ciphers, and Z3 solving with copy-paste recipes.
  • CryptoHack Blog — high-quality deep-dive writeups for hard crypto (CryptoCTF etc.) explaining the math and exploit construction.
  • Connor McCartney — crypto writeups — large, current archive heavy on Coppersmith/small_roots, LLL/CVP, and ECC with reusable Sage snippets.
  • cryptohack/ctf_archive — source files for the best past-CTF crypto challenges for offline study.

Forensics

AI

  • Gandalf (Lakera) — the canonical prompt-injection / secret-extraction warm-up; graded levels mirroring how AI challenges gate a hidden flag behind input/output guards.
  • Crucible (Dreadnode) — 80+ hands-on AI red-team challenges (prompt injection, fingerprinting, evasion, model inversion/extraction); same platform as DEF CON AI Village and GovTech SG's AI CTF, so closest in style to a real AI category.
  • HackTricks — AI / AI-Prompts — fast offensive reference for prompt injection, jailbreaks, system-prompt leaking, filter bypass, and LLM-driven code/command injection.
  • OWASP Top 10 for LLM Applications 2025 — authoritative enumeration of LLM risk classes (prompt injection, info disclosure, excessive agency, poisoning) to map challenge themes to named vulns.
  • MITRE ATLAS — ATT&CK-style adversary tactics/techniques for AI systems (evasion, extraction, inference, poisoning, agentic) for the full kill chain beyond chat.
  • HackAPrompt / Learn Prompting — Prompt Hacking — the largest prompt-injection dataset plus a clear taxonomy (injection, jailbreaking, leaking, token smuggling, payload splitting, obfuscation).
  • redteams.ai Navigator — navigable taxonomy of prompt-injection, jailbreak, and agent-exploitation techniques for quickly picking a technique class.
  • Arcanum AI Security Resources — curated launch page for offensive-AI labs, tooling, and reading.
  • awesome-MLSecOps — actively maintained curated index of ML/AI security tools (garak, PyRIT, promptfoo, ART, TextAttack) and learning resources.
  • aivillage/crucible_ctf — official DEF CON AI Village starter tips and orientation for AI-CTF archetypes.
  • alexdevassy/Machine_Learning_CTF_Challenges — self-hostable CTF challenges built around ML apps (adversarial inputs, model abuse) with solutions.
  • JosephTLucas/HackThisAI — adversarial-ML capture-the-flag exercises teaching AML techniques hands-on.
  • arturmiller/adversarial_ml_ctf — focused CTF on adversarial-image vulnerability; clean target for practicing the evasion workflow end-to-end.
  • boschko.ca — Adversarial ML walkthrough — detailed breakdown of multiple AML attack types via Crucible-style challenges; one of the best technique + tooling writeups.
  • rpriven/ai-ctf-writeups — collected AI-CTF writeups (incl. full Gandalf walkthrough) with concrete winning prompts.
  • Bishop Fox — Top LLM CTF recommendations — vendor-curated shortlist of LLM/AI CTFs with notes on what each teaches.

Misc

  • HackTricks — Bypass Python Sandboxes (pyjail) — the most complete pyjail-escape reference: builtins recovery, subclass traversal, frame walking, audit-hook and import bypasses, restricted-charset tricks.
  • salvatore-abello/python-ctf-cheatsheet — modern CTF-focused pyjail walkthrough plus Jinja2/pickle/format-string notes; mirrors how pyjails actually appear.
  • Shirajuki Pyjail Cheatsheet — concise copy-paste payloads for restricted-charset pyjails, NFKC/Unicode bypasses, and audit-hook escapes.
  • jia.je — Python Jail Escape Techniques — deep catalogue of escapes (CodeType crafting, bytecode tricks, traceback builtins recovery) with worked examples.
  • dcode.fr — massive web toolkit of cipher/encoding/esolang decoders with auto-identification; fastest way to ID an unknown encoding.
  • TIO.run (Try It Online) — runs 600+ languages incl. nearly every esolang (Whitespace, Brainfuck, Befunge, Piet) in-browser to run/verify esoteric programs.
  • esolangs.org Wiki — canonical reference for esoteric-language specs and command tables when you must hand-decode or write an interpreter.
  • TonyCrane/note — esolang notes — concise esolang identification + decoding reference table.
  • Z3 Solver guide (Practical CTF) — practical intro to modeling constraint/algorithmic puzzles with Z3 (BitVec, solver loops).
  • Ethernaut (OpenZeppelin) — beginner-friendly Solidity/EVM wargame (delegatecall, fallback, storage layout, tx.origin); the right blockchain-basics entry point.
  • Damn Vulnerable DeFi (v4) — the benchmark Solidity/DeFi exploit set (flash loans, oracle manipulation, governance, reentrancy), now Foundry-based.
  • blockthreat/blocksec-ctfs — curated index of blockchain-security CTFs and writeups for prior solutions and recurring EVM patterns.
  • OSINT Framework — categorized tree of OSINT tools (username, email, image, geolocation, social); the standard starting map.
  • The-Osint-Toolbox — Geolocation/Image OSINT — curated geolocation and reverse-image-search tradecraft mapping directly to image-geolocation tasks.
  • CTF Support — OSINT — practical CTF-oriented OSINT playbook (metadata, reverse image, social, geolocation workflows).

General / Meta

Cross-category references & wikis

  • ctf101.org (CTF Handbook) — best single beginner reference; structured intros to every category before techniques (OSIRIS Lab @ NYU).
  • CTF Field Guide (Trail of Bits) — higher-altitude guide to vuln discovery, exploitation theory, and forming/running a team.
  • awesome-ctf (apsdehal) — most-starred curated index of CTF tools, libraries, wargames, and platforms by category.
  • ctf.support — per-category cheatsheets with concrete tool usage for quick reference.
  • LiveOverflow (YouTube) — canonical intuition-building video series taking pwn/RE from beginner to advanced; great for onboarding.

Event tracking & writeups

  • CTFtime — event calendar with weights, team ratings, and archived tasks; the hub for event selection and standings.
  • CTFtime Writeups archive — largest cross-event writeup aggregator, linked per task; the primary place to study how challenges were solved.
  • CTFtime Rating Formula — how rating points are computed (best 10 results/year, event weight) so you can prioritize high-weight events.

Practice platforms (multi-category)

  • picoCTF / picoGym — free CMU-run beginner-to-intermediate challenges across all categories with year-round practice; ideal for ramping up.
  • OverTheWire (Bandit & wargames) — Bandit teaches Linux/CLI fundamentals; Narnia/Leviathan/Behemoth cover exploitation basics. The classic first stop.
  • Root-Me — huge breadth of challenges (web, network, crypto, forensics, RE) for steady all-category practice.
  • HackTheBox / TryHackMe — established platforms with categorized pwn/rev/web/crypto/forensics practice to drill the toolchain.

Grey Cat The Flag (target event)

Tooling — recommended install list

When sources conflicted, the best/most-current method is given. Note the gotchas: several tools are Ruby gems or Rust/Go installs and are not in apt/pip.

Pwn / exploitation

  • pwntools — pip install pwntools
  • GDB — apt install gdb (gdb-multiarch for non-x86)
  • pwndbg — curl -qsL 'https://install.pwndbg.re' | sh (portable installer; not in apt)
  • GEF — bash -c "$(curl -fsSL https://gef.blah.cat/sh)" (single file; alternative to pwndbg, better multi-arch)
  • one_gadget — gem install one_gadget (Ruby gem; not apt/pip)
  • ROPgadget — pip install ROPgadget (case-sensitive)
  • ropper — pip install ropper
  • ropr — cargo install ropr (fast modern Rust alternative; not apt/pip)
  • pwninit — cargo install pwninit (auto-patch binary to provided libc/loader + scaffold solve.py; near-essential for libc challenges)
  • patchelf — apt install patchelf
  • libc-database — git clone https://github.com/niklasb/libc-database (or use the hosted libc.rip)
  • seccomp-tools — gem install seccomp-tools (Ruby gem; not apt/pip)
  • checksec — ships with pwntools (pwn checksec), or apt install checksec
  • QEMU — apt install qemu-system-x86 qemu-utils (kernel-pwn boot/debug)

Reverse engineering

  • Ghidra — download from ghidra-sre.org (needs JDK 21+; brew install ghidra on macOS; in Kali apt)
  • IDA Free — installer from hex-rays.com/ida-free
  • radare2 — official install.sh / r2env (apt's version is often outdated)
  • rizin — apt install rizin (24.04+) or build from source
  • Cutter — AppImage from cutter.re (or brew install --cask cutter)
  • angr — pip install angr (use a venv)
  • Triton — pip install triton-library (or build from source)
  • x64dbg (Windows) — winget install x64dbg.x64dbg or choco install x64dbg.portable
  • frida + frida-tools — pip install frida-tools
  • Detect It Easy (diec) — apt install detect-it-easy / brew install --cask detect-it-easy / GitHub
  • dnSpyEx (Windows) — release from github.com/dnSpyEx/dnSpy; ilspycmd via dotnet tool install -g ilspycmd
  • jadx / apktool (Android) — apt install jadx apktool (or brew install jadx apktool)
  • Python rev — pip install decompyle3; build pycdc from zrax/pycdc; pyinstxtractor from GitHub
  • capstone / keystone / unicorn — pip install capstone keystone-engine unicorn
  • qemu-user — apt install qemu-user qemu-user-static
  • wabt (WebAssembly) — apt install wabt
  • upx — apt install upx-ucl (or brew install upx)
  • ltrace / strace — apt install ltrace strace

Crypto

  • SageMath — apt install sagemath (Apple Silicon: use conda-forge)
  • pycryptodome — pip install pycryptodome (imports as Crypto; do NOT also install pycryptodomex unless you need the Cryptodome namespace)
  • gmpy2 — pip install gmpy2 (needs apt install libgmp-dev libmpc-dev libmpfr-dev)
  • sympy — pip install sympy
  • z3-solver — pip install z3-solver (import as z3; NOT pip install z3)
  • RsaCtfTool — git clone …/RsaCtfTool && pip install -r requirements.txt (apt deps: libgmp3-dev libmpc-dev)
  • defund/coppersmith — download coppersmith.sage
  • jvdsn/crypto-attacks — git clone https://github.com/jvdsn/crypto-attacks
  • hashpumpy — pip install hashpumpy (length-extension)
  • PadBuster — apt install padbuster (Kali; HTTP padding oracles)
  • factordb-pycli — pip install factordb-pycli
  • yafu / cado-nfs — build from source (heavy integer factoring backends)

Web

  • Burp Suite Community — brew install --cask burp-suite (macOS) / apt install burpsuite (Kali). Add BApp extensions: Turbo Intruder, JWT Editor, HTTP Request Smuggler, Param Miner; use built-in DOM Invader.
  • sqlmap — apt install sqlmap (or pipx install sqlmap)
  • ffuf — apt install ffuf / go install github.com/ffuf/ffuf/v2@latest
  • feroxbuster — cargo install feroxbuster (or Kali apt)
  • gobuster — apt install gobuster / go install github.com/OJ/gobuster/v3@latest
  • wfuzz — pip install wfuzz
  • nuclei — go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
  • httpx — go install github.com/projectdiscovery/httpx/cmd/httpx@latest
  • katana — go install github.com/projectdiscovery/katana/cmd/katana@latest
  • jwt_tool — git clone https://github.com/ticarpi/jwt_tool && pip install -r requirements.txt (not in apt)
  • SSTImap — git clone https://github.com/vladko312/SSTImap && pip install -r requirements.txt (maintained replacement for tplmap)
  • phpggc — git clone https://github.com/ambionics/phpggc (PHP unserialize gadget chains; not apt/pip)
  • ysoserial — JAR from GitHub releases (Java deserialization; ysoserial.net for .NET targets)
  • Smuggler — git clone https://github.com/defparam/smuggler (request-smuggling detection)
  • SecLists — apt install seclists (/usr/share/seclists) or git clone

Forensics / stego

  • Wireshark / tshark — apt install wireshark tshark
  • tcpdump — apt install tcpdump
  • zeek — apt install zeek (turns pcap into structured conn/http/dns logs)
  • scapy — pip install scapy
  • NetworkMiner — download from netresec.com (Linux via Mono)
  • volatility3 — pip install volatility3 (needs Python 3.8+)
  • dwarf2json — build from volatilityfoundation/dwarf2json (to make Linux/Mac symbol tables)
  • binwalk — cargo install binwalk (fast v3 Rust rewrite; apt install binwalk gives older v2)
  • foremost / scalpel / bulk-extractor — apt install foremost scalpel bulk-extractor
  • sleuthkit — apt install sleuthkit (mmls, fls, icat, tsk_recover); autopsy — apt install autopsy
  • testdisk + photorec — apt install testdisk
  • exiftool — apt install libimage-exiftool-perl (package name is NOT exiftool)
  • exiv2 — apt install exiv2
  • steghide — apt install steghide
  • stegseek — .deb from RickdeJager/stegseek (ultra-fast steghide cracker; also in Kali apt)
  • zsteg — gem install zsteg (Ruby gem; not apt/pip)
  • stegolsb — pip install stegolsb (incl. wavsteg)
  • Stegsolve — Java jar from zardus/ctf-tools or eugenekolo/sec-tools
  • pngcheck — apt install pngcheck
  • sonic-visualiser / audacity — apt install sonic-visualiser audacity (audio/spectrogram stego)
  • oletools (olevba) — pip install oletools (Office macro analysis)
  • pdf-parser + pdfid — Didier Stevens' tools (or apt install pdf-parser)
  • chainsaw — from WithSecureLabs/chainsaw (Windows EVTX hunting); python-evtx — pip install python-evtx
  • yara — apt install yara
  • bkcrack — build from kimci86/bkcrack (ZipCrypto known-plaintext)
  • fcrackzip — apt install fcrackzip
  • zbar-tools — apt install zbar-tools (QR/barcode decode)

AI / adversarial ML

  • garak — pip install garak (NVIDIA LLM vulnerability scanner; 50+ probes)
  • PyRIT — pip install pyrit (Microsoft; multi-turn/agentic jailbreaks; Python 3.10–3.13)
  • promptfoo — npm install -g promptfoo (or npx promptfoo@latest; LLM eval + red-team)
  • adversarial-robustness-toolbox (ART) — pip install adversarial-robustness-toolbox (evasion/poisoning/extraction/inference)
  • textattack — pip install textattack (adversarial attacks on NLP/text classifiers)
  • foolbox — pip install foolbox (image adversarial examples; PyTorch/TF/JAX)
  • torch + torchvision — pip install torch torchvision
  • transformers + huggingface_hub — pip install transformers huggingface_hub
  • modelscan — pip install modelscan (scan model files for unsafe pickle/serialization)
  • ollama — download from ollama.com (brew install ollama); run local LLMs to prototype attacks offline

Misc / blockchain / general

  • Foundry (forge / cast / anvil) — curl -L https://foundry.paradigm.xyz | bash && foundryup (EVM toolkit for DVDeFi; not apt/pip)
  • slither — pip install slither-analyzer (Solidity static analysis; CLI is slither)
  • networkx — pip install networkx (graph/maze algorithmic challenges)
  • sherlock — pip install sherlock-project (hunt usernames across social networks)
  • CyberChef — use online at gchq.github.io/CyberChef or self-host

Cracking / shared utilities

  • john (Jumbo) — apt install john (incl. zip2john, rar2john, pdf2john)
  • hashcat — apt install hashcat (needs GPU drivers/OpenCL for full speed)
  • GNU binutils (objdump/readelf/nm/strings) — apt install binutils
  • file — apt install file; TrID from mark0.net (fine-grained type ID)
  • xxd — apt install xxd; hex editors: apt install hexedit wxhexeditor, or ImHex from GitHub
  • nc / socat — apt install netcat socat (remote challenge interaction)
  • curl / httpie / jq — apt install curl httpie jq
  • Docker — apt install docker.io (version-pinned toolchains: Volatility symbols, headless Ghidra, matching glibc/libc for pwn)
  • Python 3.10+ — required by current pwntools and GDB Python plugins
  • Recommended base OS — Kali Linux or a dedicated VM with the above preinstalled, updated, and configured before each event.

Tooling additions — 2026-05-29 gap audit (installed + new references)

A cross-category gap analysis (vs the hardest challenges) drove a round of installs. What's installed and where is authoritative in sandbox/INSTALLED.md — summary baked into ctftools: kernel-pwn (qemu-system-x86, extract-vmlinux, vmlinux-to-elf, glibc-all-in-one, pwndbg), Go/Android RE (GoReSym, jadx, apktool), web deser/JWT/OOB (phpggc, ysoserial, jwt_tool, interactsh-client, Node 20, php), DFIR (dwarf2json, testdisk, multimon-ng, Didier-Stevens PDF/OLE suite), misc/ai (ortools, onnx/onnxruntime); host .venv helpers (fickling, safetensors, primefac, factordb-pycli, regipy, frida-tools). Hard crypto gets a derived ctf-sage image (full Sage + defund/coppersmith + cuso + qemu-user), launched via sandbox/sage (native) or sandbox/sage --cop (qemu). Raw LLL/fpylll/ECC/factoring run natively; Coppersmith (small_roots/cuso) SIGILLs natively (FLINT's AVX large-multiply) but works in-house under --cop (qemu-user) — verified to recover (or toolkit/coppersmith_fast.sage for fast native univariate). No native-x86/cloud box needed — see crypto playbook §0. Heavy/situational stacks are one-command on-demand: sandbox/install-{ai-ml,dotnet-re,forensics-extra,web-browser}.sh.

New high-value references (complement the lists above):

Clone-and-go script libs (defund/coppersmith, ECC_Attacks, pyjailbreaker, PayloadsAllTheThings, SecLists, CyberChef) fetch locally via reference/fetch-attack-libs.sh → reference/_libs/ (gitignored, so the repo stays lean).