This repository compiles an extensive collection of cybersecurity tools, resources, and CTF (Capture the Flag) practice platforms for anyone involved in digital security
This guide aims to be your ultimate reference, whether you're prepping for a CTF competition, strengthening your pentesting toolkit, or learning cybersecurity essentials. Organized by categories, each section covers tools, their functions, and direct links to resources. This format allows you to easily locate the tools you need, understand their capabilities, and access them instantly.
Each section provides a focused list of tools, organized by their category, such as OSINT (Open Source Intelligence), steganography, reverse engineering, and more. Here’s how you can make the most out of each category in this guide:
- Identify Your Objective: Whether you’re looking for exploitation tools, malware analysis frameworks, or OSINT utilities, navigate to the relevant section in the guide to find the tools specifically curated for that purpose.
- Direct Links: Each tool includes a direct link for easy access. Just click to go straight to the download or official page.
- Combine Tools for Comprehensive Use: In many cases, you may need to combine tools from various categories. For example, if you're working on a web security assessment, you might need to pull tools from both the "Penetration Testing" and "Web Vulnerability Scanners" sections.
- Explore Platforms for Skill Development: Check out CTF platforms like Hack The Box and TryHackMe for practical, hands-on exercises that incorporate many of these tools.
Here’s a breakdown of the main categories and how to best utilize each:
These tools are essential for reconnaissance and data gathering. Start with Shodan or Censys to scan for internet-connected devices. Use theHarvester to gather emails and subdomains, while Maltego helps map and visualize relationships. Combine tools like Recon-ng and SpiderFoot for a complete view of your target's digital footprint.
For CTFs or forensic analysis, Steghide allows for data concealment and extraction from images, and zsteg is excellent for hidden data in PNG/BMP files. AperiSolve and StegSolve offer online and local analysis of hidden image content, while ExifTool reveals metadata, often containing valuable information for investigations.
To maintain anonymity, start with Tor Browser for browsing and Tails OS as a secure operating system. ProtonMail and Signal provide encrypted communication, while Orbot and AnonAddy offer anonymous web browsing and email forwarding. These tools help you stay untraceable and protect sensitive information.
For exploitation, use Metasploit for payload and exploit delivery, and GTFOBins for privilege escalation on Unix. PayloadsAllTheThings offers a vast repository of payloads, and RevShells simplifies generating reverse shell payloads. MSFvenom is useful for custom payload generation, while Nishang aids in PowerShell-based exploitation.
For cracking passwords or cryptography challenges, Hashcat and John the Ripper are powerful tools. CyberChef provides extensive encoding, encryption, and data analysis, while Ciphey automates decryption tasks. Use CrackStation for online hash cracking, and Hash-Identifier to determine hash types, making cryptanalysis more manageable.
For penetration testing, Nmap is essential for network discovery, Wireshark for packet analysis, Burp Suite for web vulnerabilities, and SQLMap for SQL injection exploitation. Use Nikto and Dirbuster for web content and server scanning, Hydra for network logon brute-forcing, and Impacket for managing network protocols during exploitation.
Red Team: For offensive operations, Cobalt Strike and BloodHound are invaluable for adversary simulations and Active Directory mapping. Tools like Empire and Sliver support post-exploitation, while Mimikatz and SharpHound handle credential dumping and Active Directory enumeration. Obfuscators like PEzor and ScareCrow help evade detection.
Blue Team: For defense, Security Onion and Wazuh provide intrusion detection and monitoring. Suricata and TheHive support threat detection and incident response, while Velociraptor aids in endpoint visibility. ELK Stack is excellent for managing and analyzing logs to track potential threats.
This section offers CTF platforms like Hack The Box and TryHackMe for hands-on training, PicoCTF and OverTheWire for beginner to intermediate challenges, and Root Me for web and binary exploitation. CTFtime helps track global events, and VulnHub provides vulnerable virtual machines for practice. Use these to build practical skills in a controlled environment.
Quick references like PayloadsAllTheThings and HackTricks are invaluable for live challenges, offering extensive payload lists and techniques. GTFOBins provides privilege escalation techniques, while Linux and Windows Privilege Escalation guides give targeted resources for each operating system. For reverse engineering, Reverse Engineering Cheat Sheet provides quick tips, and Pentest Monkey is a great go-to for shell and payload references.
Specialized tools like PwnTools and Angr assist in exploit development and binary analysis. Qiling supports cross-platform emulation for reverse engineering, while ROPgadget and OneGadget help locate gadgets for ROP chain building. For Android CTF challenges, Apktool enables APK decompilation. SecLists and Insomni'hack payloads provide payloads and wordlists, while CyberChef and Cryptool aid in cryptography challenges.
| Tool | Description | Link |
|---|---|---|
| Shodan | Search engine for internet-connected devices. | shodan.io |
| Censys | Internet-wide scanning and data analysis platform. | censys.io |
| theHarvester | Tool to gather emails, subdomains, hosts, and more. | GitHub |
| Maltego | Data mining and link analysis platform for intelligence gathering. | maltego.com |
| OSINT Framework | Categorized collection of OSINT resources. | osintframework.com |
| Recon-ng | Web reconnaissance tool with various OSINT modules. | GitHub |
| SpiderFoot | OSINT automation tool for threat intelligence gathering. | spiderfoot.net |
| Amass | Tool for in-depth domain mapping and DNS enumeration. | GitHub |
| Tool | Description | Link |
|---|---|---|
| Steghide | Hide data in images and audio files. | SourceForge |
| AperiSolve | Online image steganography analyzer. | aperisolve.com |
| Binwalk | Extract data from binary files; often used for embedded files. | GitHub |
| ExifTool | Read, write, and edit file metadata, often used in forensics. | exiftool.org |
| zsteg | PNG/BMP analysis tool for finding hidden data. | GitHub |
| StegOnline | Web-based steganography tool for encoding/decoding images. | stegonline.georgeom.net |
| OpenStego | Open-source tool for image steganography with encryption options. | openstego.com |
| OutGuess | Universal steganographic tool for JPEG files. | freebsd.org |
| Tool | Description | Link |
|---|---|---|
| Tor Browser | Browse the internet anonymously, routing traffic through Tor. | torproject.org |
| ProtonMail | Encrypted email service with strong privacy policies. | protonmail.com |
| Tails OS | Live operating system focused on privacy; leaves no trace. | tails.boum.org |
| Signal | Secure, end-to-end encrypted messaging app. | signal.org |
| Orbot | Tor proxy for Android devices, enabling anonymous browsing. | guardianproject.info |
| AnonAddy | Anonymous email forwarding to protect real email address. | anonaddy.com |
| Guerrilla Mail | Disposable, temporary email service. | guerrillamail.com |
| Mailinator | Public, disposable email system for quick registrations. | mailinator.com |
| Tool | Description | Link |
|---|---|---|
| Metasploit | Full exploitation framework. | metasploit.com |
| GTFOBins | Unix binaries for privilege escalation. | gtfobins.github.io |
| SearchSploit | CLI search for Exploit Database. | GitHub |
| PayloadsAllTheThings | Comprehensive collection of payloads and bypasses. | GitHub |
| RevShells | Generate reverse shell payloads in multiple languages. | revshells.com |
| MSFvenom | Command-line payload generation tool for Metasploit. | NetSec |
| Nishang | PowerShell for penetration testing and red teaming. | GitHub |
| Covenant | C2 framework with .NET capabilities. | GitHub |
| Tool | Description | Link |
|---|---|---|
| Hashcat | High-performance password cracker, supporting GPU acceleration. | hashcat.net |
| John the Ripper | Popular open-source password cracker. | openwall.com/john |
| CyberChef | Versatile web-based tool for encryption, encoding, and data analysis. | cyberchef.io |
| Ciphey | Automated decryption tool that works without a password. | GitHub |
| CrackStation | Online password hash cracking using large databases. | crackstation.net |
| Hash-Identifier | Tool to identify the type of hash used. | GitHub |
| Hydra | Network logon cracker supporting numerous protocols. | GitHub |
| RSA Tool | Tool for RSA encryption and decryption. | rsatool.org |
| Tool | Description | Link |
|---|---|---|
| Nmap | Network discovery and security auditing. | nmap.org |
| Wireshark | Network protocol analyzer. | wireshark.org |
| Burp Suite | Web vulnerability scanner and proxy tool. | portswigger.net |
| SQLMap | SQL injection automation tool. | sqlmap.org |
| Hydra | Network logon cracker for numerous protocols. | GitHub |
| Nikto | Web server scanner for known vulnerabilities. | cirt.net |
| Aircrack-ng | Suite for WiFi network security assessment. | aircrack-ng.org |
| Impacket | Python library for working with network protocols. | GitHub |
| Tool | Description | Link |
|---|---|---|
| Cobalt Strike | Adversary simulation and red team operations. | cobaltstrike.com |
| BloodHound | AD enumeration and mapping. | GitHub |
| Empire | Post-exploitation framework. | GitHub |
| Mimikatz | Credential dumping tool. | GitHub |
| Sliver | Open-source C2 platform for adversary emulation. | GitHub |
| SharpHound | Data collector for BloodHound, focusing on AD enumeration. | GitHub |
| SilentTrinity | Post-exploitation framework leveraging IronPython. | GitHub |
| Merlin | Cross-platform post-exploitation C2 tool. | GitHub |
| Tool | Description | Link |
|---|---|---|
| Security Onion | Linux distro for intrusion detection and monitoring. | securityonion.net |
| Wazuh | Open-source security monitoring platform. | wazuh.com |
| Suricata | Network threat detection engine. | suricata.io |
| ELK Stack | Log management and analytics platform. | elastic.co |
| Zeek | Network monitoring and analysis framework. | zeek.org |
| Velociraptor | Endpoint visibility and forensic analysis tool. | GitHub |
| MISP | Open-source threat intelligence platform. | misp-project.org |
| TheHive | Scalable incident response platform. | thehive-project.org |
| Tool | Description | Link |
|---|---|---|
| Ghidra | Open-source reverse engineering tool developed by the NSA. | ghidra-sre.org |
| IDA Pro | Leading disassembler and debugger for software analysis. | hex-rays.com |
| Remnux | Linux toolkit for reverse engineering and malware analysis. | remnux.org |
| Cuckoo Sandbox | Automated malware analysis sandbox environment. | cuckoosandbox.org |
| x64dbg | Open-source debugger for x64/x32 Windows binaries. | x64dbg.com |
| Radare2 | Powerful open-source framework for reverse engineering. | rada.re |
| PE Studio | Portable executable analysis tool for malware forensics. | winitor.com |
| ANY.RUN | Interactive online malware sandbox for real-time analysis. | any.run |
| Platform | Description | Link |
|---|---|---|
| Hack The Box | CTF platform with labs for hands-on cybersecurity training. | hackthebox.com |
| TryHackMe | Beginner-friendly platform with guided labs and challenges. | tryhackme.com |
| PicoCTF | CTF platform targeting students and beginners. | picoctf.com |
| OverTheWire | Wargames for learning Linux and cybersecurity basics. | overthewire.org |
| Root Me | Challenges across various hacking domains for skill building. | root-me.org |
| CTFtime | Calendar and ranking of global CTF events. | ctftime.org |
| VulnHub | Download vulnerable virtual machines for practice. | vulnhub.com |
| PentesterLab | Paid platform offering in-depth labs on web and network security. | pentesterlab.com |
| Tool | Description | Link |
|---|---|---|
| OnionShare | Share files securely and anonymously over Tor. | onionshare.org |
| Syncthing | Decentralized file synchronization across devices. | syncthing.net |
| FilePizza | Peer-to-peer file sharing via WebRTC; no server storage. | file.pizza |
| Wormhole | Encrypted file sharing that auto-deletes after transfer. | wormhole.app |
| ToffeeShare | Direct, encrypted file sharing without middlemen. | toffeeshare.com |
| Transfer.sh | Command-line-friendly file sharing with encryption options. | transfer.sh |
| Tool | Description | Link |
|---|---|---|
| Binary Ninja | Reverse engineering platform for complex binary analysis. | binary.ninja |
| Cutter | GUI front-end for Radare2, suitable for beginners. | cutter.re |
| OllyDbg | Classic 32-bit debugger popular for Windows reverse engineering. | ollydbg.de |
| Frida | Dynamic instrumentation toolkit for testing application behaviors. | frida.re |
| Apktool | Reverse-engineering tool for Android APK files. | GitHub |
| Angr | Binary analysis framework useful for symbolic execution. | angr.io |
| Radare2 | Full reverse engineering and binary analysis suite. | rada.re |
| WinDbg | Microsoft’s debugger for Windows applications and drivers. | docs.microsoft.com |
| Tool | Description | Link |
|---|---|---|
| OWASP ZAP | Comprehensive open-source web application security scanner. | zaproxy.org |
| Nikto | Scanner for known vulnerabilities on web servers. | cirt.net |
| W3AF | Web application attack and audit framework. | w3af.org |
| Skipfish | Security reconnaissance tool for web applications. | GitHub |
| Acunetix | Advanced automated web application vulnerability scanner. | acunetix.com |
| Arachni | Modular web application security scanner framework. | arachni-scanner.com |
| Burp Suite | Web vulnerability scanning and exploitation platform. | portswigger.net |
| Wapiti | Open-source web application vulnerability scanner. | wapiti.sourceforge.io |
| Tool | Description | Link |
|---|---|---|
| KeePassXC | Open-source password manager. | keepassxc.org |
| Bitwarden | Secure, open-source password management. | bitwarden.com |
| LastPass | Password vault and manager. | lastpass.com |
| 1Password | Password manager and digital vault. | 1password.com |
| Resource | Description | Link |
|---|---|---|
| PayloadsAllTheThings | Collection of payloads for various pentesting scenarios. | GitHub |
| HackTricks | Tips, tricks, and cheatsheets for penetration testing. | book.hacktricks.xyz |
| GTFOBins | Unix binaries that help with privilege escalation. | gtfobins.github.io |
| Linux Privilege Escalation | Guide and resources for escalating privileges on Linux. | GitHub |
| Windows Privilege Escalation | Comprehensive cheatsheet for privilege escalation on Windows. | GitHub |
| Reverse Engineering Cheat Sheet | Handy reference for common reverse engineering tasks. | GitHub |
| PenTest Monkey | Cheatsheets for reverse shells and more. | pentestmonkey.net |
| Resource | Description | Link |
|---|---|---|
| Cybrary | Free IT and cybersecurity courses. | cybrary.it |
| CTF Field Guide by Trail of Bits | Comprehensive guide for CTF prep. | trailofbits.com |
| OverTheWire | Wargames focused on Linux and security concepts. | overthewire.org |
| Hack The Box | Hands-on platform for cybersecurity training. | hackthebox.com |
| TryHackMe | Accessible CTF and training labs for all levels. | tryhackme.com |
| PicoCTF | Beginner-friendly CTF platform for students. | picoctf.com |
| SANS Cyber Aces | Free training in foundational cybersecurity concepts. | cyberaces.org |
| Codecademy | Online coding and security fundamentals courses. | codecademy.com |
These tools are geared toward obfuscation, evasion, and payload manipulation, making them ideal for red team operations. They allow you to craft undetectable payloads, evade antivirus (AV) detection, and cloak activities to bypass security measures.
| Tool | Description | Link |
|---|---|---|
| Veil | Evasion framework for generating undetectable payloads. | veil-framework.com |
| Shellter | Dynamic shellcode injection tool for Windows, used to evade AV. | shellterproject.com |
| Hyperion | Binary obfuscator to bypass AV detection. | GitHub |
| Obfuscator.io | JavaScript and Node.js obfuscator for web applications. | obfuscator.io |
| ConfuserEx | .NET obfuscator widely used for software protection. | GitHub |
| PEzor | Shellcode and PE file obfuscation tool for AV evasion. | GitHub |
| Exeinfo PE | Packed executable identifier; detects PE file packers and crypters. | exeinfo.com |
| DNGuard HVM | Professional .NET code protection with dynamic virtualization. | dnguard.net |
| obfuscar | Basic .NET obfuscator to protect managed code. | GitHub |
| NetCrypt | Tool for encrypting and obfuscating .NET binaries. | GitHub |
| Dynamic Camo | Framework for obfuscating C2 traffic using various network camouflage techniques. | GitHub |
These tools are essential for red team operators who need to execute, maintain, and manage advanced attacks, often leveraging techniques for persistence, lateral movement, and stealth across target environments.
| Tool | Description | Link |
|---|---|---|
| Covenant | .NET-based C2 framework with encrypted communication for post-exploitation. | GitHub |
| Sliver | Open-source C2 framework supporting various payloads for adversary emulation. | GitHub |
| PoshC2 | PowerShell-based C2 framework with extensive post-exploitation tools. | GitHub |
| Merlin | C2 tool for managing multiple clients across different platforms with HTTPS-based communication. | GitHub |
| Rubeus | Tool for Kerberos abuse, allowing credential extraction and golden ticket attacks. | GitHub |
| SharpHound | Data collector for BloodHound, used to map out AD relationships and find attack paths. | GitHub |
| Impacket | Collection of Python classes for SMB, Kerberos, and other protocols used in network attacks. | GitHub |
| PowerSploit | Post-exploitation framework for PowerShell-based attack techniques. | GitHub |
| DeathStar | Automates Active Directory attacks using Empire and BloodHound. | GitHub |
| Seatbelt | Post-exploitation tool that collects security-relevant information on Windows systems. | GitHub |
| FruityC2 | C2 framework focused on web-based operations and automation. | GitHub |
| Koadic | JScript RAT for Windows; similar to Meterpreter but for JavaScript. | GitHub |
| SharpLocker | Payload that creates a fake lock screen on Windows to capture credentials. | GitHub |
| GhostPack | Collection of tools for offensive security operations, including credential and token abuse. | GitHub |
| Evil-WinRM | PowerShell-based WinRM shell for accessing Windows machines remotely. | GitHub |
| CredNinja | Tool for discovering and managing credentials across Active Directory environments. | GitHub |
For red team operators crafting complex, customized attacks and bypasses, these tools allow for advanced payload development, exploit creation, and extensive evasion capabilities.
| Tool | Description | Link |
|---|---|---|
| Mythic | Open-source C2 framework that supports custom agents and payload flexibility. | GitHub |
| Obsidian C2 | Modular C2 framework designed for stealth and payload customization. | GitHub |
| SharpSploit | Post-exploitation library for .NET with credential extraction and token manipulation. | GitHub |
| Metta | Adversary simulation tool that uses scripts to emulate attacker behavior. | GitHub |
| ScareCrow | Payload generation framework that focuses on evading Windows Defender and AMSI. | GitHub |
| Invoke-DOSfuscation | DOS command obfuscation techniques to evade command-line detection. | GitHub |
| Koadic | JScript-based RAT for advanced post-exploitation on Windows. | GitHub |
| Octopus C2 | Cross-platform C2 with support for modular agent and payload creation. | GitHub |
| FUD-Crypter | Framework for creating fully undetectable payloads to bypass AV detection. | GitHub |
| RedELK | Red team tracking and logging solution, designed for monitoring attacks. | GitHub |
| Demiguise | Tool for obfuscating AMSI bypasses on Windows, used in red team engagements. | GitHub |
| Unicorn | PowerShell tool for obfuscating shellcode and delivering payloads through injection. | GitHub |
| Caldera | Automated adversary emulation platform by MITRE for scalable attack testing. | GitHub |
| Ebowla | Tool for generating encrypted payloads and adding obfuscation for stealth. | GitHub |
These additional tools and resources support niche CTF challenges across cryptography, reverse engineering, web exploitation, and binary analysis, giving you an edge in tackling specific categories.
| Tool | Description | Link |
|---|---|---|
| Qiling | Emulation framework for binary analysis across multiple architectures. | GitHub |
| OneGadget | Finds usable RCE (remote code execution) gadgets in binaries for one-shot exploits. | GitHub |
| GEF (GDB Enhanced Features) | Enhanced GDB features for debugging and exploit development. | GitHub |
| pwndbg | GDB plugin tailored for exploit development and debugging binaries in CTFs. | GitHub |
| Apktool | Tool for decompiling and analyzing Android APK files, commonly used in mobile CTFs. | GitHub |
| Hash Extender | Command-line tool for performing length extension attacks on hashes. | GitHub |
| Z3 | Theorem prover often used for symbolic execution in reverse engineering challenges. | GitHub |
| Binary Ninja Free | Reverse engineering platform (free edition) with powerful binary analysis tools. | binary.ninja |
| Insomni'hack payloads | Payload collection tailored for various CTF challenges and penetration testing. | GitHub |
| NCLab | Training platform offering hands-on labs and virtual machines for CTF practice. | nclab.com |
| SecLists | Compilation of attack payloads, wordlists, and fuzzing lists, commonly used in web and network challenges. | GitHub |
| Forensics Wiki | Resource wiki for digital forensics techniques, tools, and CTF challenges. | forensicswiki.org |
| StegSolve | Java-based tool for stegano analysis, particularly with LSB modifications in images. | GitHub |
| CertGraph | SSL certificate visualization tool, useful in OSINT and network mapping challenges. | GitHub |
| Cryptool | Interactive cryptography learning tool for understanding and analyzing cryptographic techniques. | cryptool.org |
If you’d like to contribute, feel free to fork this repository and add any tools or resources that enhance the guide. Contributions to specific examples or additional resources will help this collection grow and stay up-to-date with the latest in cybersecurity.
Thank you for exploring the Cybersecurity and CTF Resource Guide. Together, we’re building a one-stop resource for digital security mastery.
Happy hacking! 👾