🛠 Tools I Use

A reference list of tools in my CTF and pentesting workflow, organised by category.

Reconnaissance & Scanning

Tool Use Install
RustScan Fast port scanner cargo install rustscan
nmap Service/version/script scanning apt install nmap
gobuster Directory/subdomain fuzzing apt install gobuster
ffuf Web fuzzing apt install ffuf
wfuzz Web fuzzing with complex payloads pip install wfuzz 
# My standard nmap one-liner
nmap -p- --min-rate 10000 -sCV -oN nmap_full.txt $TARGET

Web Exploitation

Tool Use
Burp Suite HTTP proxy, repeater, scanner
sqlmap Automated SQL injection
jwt.io JWT decode/encode
nikto Web server scanner

Binary Exploitation (Pwn)

Tool Use Install
pwntools Exploit scripting pip install pwntools
pwndbg GDB plugin for pwn See GitHub
Ghidra Decompiler / reverse engineering Download from NSA
checksec Check binary mitigations apt install checksec
ROPgadget Find ROP gadgets pip install ropgadget 
# Quick binary recon
file binary && checksec binary && strings binary | grep -i flag

Cryptography

Tool Use
CyberChef Browser crypto swiss-army knife
hashcat GPU password cracking
john CPU password cracking
Python pycryptodome Crypto primitives 
# Common hashcat modes
hashcat -m 0     # MD5
hashcat -m 1000  # NTLM
hashcat -m 1800  # sha512crypt
hashcat -m 16500 # JWT HS256
hashcat -m 124   # Django SHA1

Post-Exploitation & Priv Esc

Tool Use
linpeas Linux priv esc enumeration
linux-exploit-suggester Kernel exploit suggestions
pspy Monitor processes without root
chisel TCP tunnelling / port forwarding 
# Quick priv esc checks
sudo -l
find / -perm -4000 2>/dev/null   # SUID binaries
crontab -l && cat /etc/crontab

Wordlists

  • SecLists — the essential collection
  • rockyou.txt — /opt/SecLists/Passwords/Leaked-Databases/rockyou.txt I have a few I have created myself for certain targets.

My Setup

  • OS: Kali Linux (VM daily) + Ubuntu WSL (Laptop daily) + Debian ( VM daily) + Windows (Gaming Desktop daily)
  • Terminal: terminator
  • Editor: nano
  • Note-taking: These HonKit pages + VSCode with WSL Ubuntu autodeploying with a git push Oh and usually also Obsidian locally

results matching ""

    No results matching ""