CTF Toolkit

file image.jpg

exiftool image.jpg

strings image.jpg

strings image.jpg | grep -iE "flag|ctf|key|pass|secret"

xxd image.jpg | head -50

hexdump -C image.jpg | head -50

# Steghide — extract hidden data (JPEG/BMP)
steghide extract -sf image.jpg
steghide extract -sf image.jpg -p ""          # empty password
steghide info image.jpg

# Stegseek — fast steghide brute-force
stegseek image.jpg /usr/share/wordlists/rockyou.txt
stegseek --crack image.jpg /usr/share/wordlists/rockyou.txt

# zsteg — LSB steganography (PNG/BMP)
zsteg image.png
zsteg -a image.png            # try all methods
zsteg -e "b1,rgb,lsb,xy" image.png

# Binwalk — extract embedded files
binwalk image.jpg
binwalk -e image.jpg           # extract
binwalk --dd='.*' image.jpg    # extract all

# Foremost — carve files
foremost -i image.jpg -o ./output

# OpenStego
openstego extract -sf image.png -xf extracted.txt

# pngcheck — validate PNG structure
pngcheck -v image.png

# Audacity — open and check spectrogram view
# Look for hidden messages in the spectrogram

# Sonic Visualiser — detailed audio analysis
# Check spectral layers for hidden data

# Deepsound — extract from audio
deepsound -extract audio.wav

# DTMF decoder
multimon-ng -t wav -a DTMF audio.wav

# Morse code from audio
# Use an online morse decoder or:
sox audio.wav -n spectrogram

# Volatility — memory forensics
volatility -f memory.dmp imageinfo
volatility -f memory.dmp --profile=Win7SP1x64 pslist
volatility -f memory.dmp --profile=Win7SP1x64 filescan
volatility -f memory.dmp --profile=Win7SP1x64 hashdump
volatility -f memory.dmp --profile=Win7SP1x64 cmdline
volatility -f memory.dmp --profile=Win7SP1x64 consoles

# Disk forensics
fdisk -l disk.img
mmls disk.img
fls -r -o OFFSET disk.img
icat -o OFFSET disk.img INODE > extracted_file

# PDF analysis
pdfinfo document.pdf
pdf-parser document.pdf
pdftotext document.pdf output.txt
qpdf --show-xref document.pdf

# ZIP analysis
zipinfo archive.zip
zipdetails archive.zip
# Known plaintext attack
pkcrack -C encrypted.zip -c known.txt -P plain.zip -p known.txt -d decrypted.zip

cewl http://example.com -w custom_wordlist.txt

cewl http://example.com -d 3 -m 5 -w custom_wordlist.txt

# With email scraping
cewl http://example.com -e --email_file emails.txt -w custom_wordlist.txt

# crunch [min-len] [max-len] [charset] -o output
crunch 6 8 abcdefghijklmnopqrstuvwxyz0123456789 -o custom_wordlist.txt

# With pattern (@ = lowercase, , = uppercase, % = numbers, ^ = symbols)
crunch 8 8 -t pass%%%% -o custom_wordlist.txt

# Common patterns
crunch 4 4 0123456789 -o pins.txt          # 4-digit PINs
crunch 8 8 -t @@@@%%%% -o custom_wordlist.txt    # 4 letters + 4 numbers

# Interactive mode — asks about target person
cupp -i

# From existing wordlist — add common mutations
cupp -w base_wordlist.txt

# Download default wordlists
cupp -l

# SecLists (recommended)
/usr/share/seclists/Passwords/Common-Credentials/
/usr/share/seclists/Discovery/Web-Content/
/usr/share/seclists/Discovery/DNS/
/usr/share/seclists/Usernames/
/usr/share/seclists/Fuzzing/

# System wordlists
/usr/share/wordlists/rockyou.txt
/usr/share/wordlists/dirbuster/
/usr/share/wordlists/dirb/