Brunnerne - User contributions [en]

Binwalk

2025-05-02T17:35:59Z

Brunn: Created page with "== Binwalk CTF Quick Reference == === Introduction === Binwalk is a powerful tool primarily used for analyzing binary files to find embedded files and executable code within them. It scans for file signatures (magic bytes) that indicate the start of known file types. In CTFs, Binwalk is essential for: * Finding hidden files packed inside other files (e.g., images hidden in documents, archives hidden in executables, firmware analysis). * Carving out embedded data struct..."

== Binwalk CTF Quick Reference ==

=== Introduction ===
Binwalk is a powerful tool primarily used for analyzing binary files to find embedded files and executable code within them. It scans for file signatures (magic bytes) that indicate the start of known file types.

In CTFs, Binwalk is essential for:
* Finding hidden files packed inside other files (e.g., images hidden in documents, archives hidden in executables, firmware analysis).
* Carving out embedded data structures.
* Identifying potential compression or encryption through entropy analysis.

It's a go-to tool in forensics challenges when you suspect a file contains more than meets the eye.

=== Basic Signature Scan ===
'''Goal:''' Scan a file for known file signatures (magic bytes).
<syntaxhighlight lang="bash">
binwalk <filename>
</syntaxhighlight>
* This is the most fundamental command.
* Output shows the decimal offset, hexadecimal offset, and description of found signatures.

=== Extraction ===
'''Goal:''' Scan for signatures and automatically extract recognized file types.
<syntaxhighlight lang="bash">
# Scan and extract known file types
binwalk -e <filename>
# OR (same command)
binwalk --extract <filename>
</syntaxhighlight>
* Creates a directory named <code>_<filename>.extracted</code> containing the carved files.
* '''Note:''' Extraction isn't perfect; it might miss files, create corrupted files, or extract overlapping data incorrectly. Always inspect results.

'''Goal:''' Recursively scan and extract files found within extracted files.
<syntaxhighlight lang="bash">
# Scan, Extract, and Scan/Extract recursively within extracted files
binwalk -eM <filename>
</syntaxhighlight>
* <code>-M</code> : Recursively scan extracted files. Powerful but can take time and disk space.
* Use <code>--matryoshka=<int></code> to limit recursion depth if needed.

'''Goal:''' Extract specific signature types only.
<syntaxhighlight lang="bash">
# Extract only files matching 'zip archive' description
binwalk -e --dd='zip archive.*' <filename>

# Extract only JPEGs
binwalk -e --dd='jpeg image.*' <filename>
</syntaxhighlight>
* <code>--dd='<type>.*'</code> : Dump (extract) only files whose description matches the regex pattern.

=== Entropy Analysis ===
'''Goal:''' Analyze file entropy to identify potential compression, encryption, or obfuscated data.
<syntaxhighlight lang="bash">
# Perform entropy analysis
binwalk -E <filename>

# Perform entropy analysis and attempt to plot it (requires library setup)
binwalk -E -J <filename>

# Perform entropy analysis and save plot data to files (if plotting libraries fail)
binwalk -E --save <filename>
</syntaxhighlight>
* High entropy regions often indicate compressed or encrypted data, which might warrant closer inspection.
* Low entropy often indicates null bytes, repetitive patterns, or uninitialized data.

=== Searching for Specific Signatures ===
'''Goal:''' Fine-tune the signature scan.
<syntaxhighlight lang="bash">
# Only show signatures matching 'zlib' (case-insensitive)
binwalk -I zlib <filename>
# OR
binwalk --include=zlib <filename>

# Exclude signatures matching 'png'
binwalk -X png <filename>
# OR
binwalk --exclude=png <filename>

# Use a custom magic signature file
binwalk -m /path/to/custom.magic <filename>
</syntaxhighlight>
* <code>-I / --include</code> : Only display results containing this string.
* <code>-X / --exclude</code> : Exclude results containing this string.

=== Other Useful Options ===
* <code>-r</code> : Attempt to clean up extraction artifacts (e.g., partially extracted files due to errors).
* <code>-l <int></code> : Limit scan depth to a certain number of bytes.
* <code>-o <int></code> : Start scan at a specific byte offset.
* <code>-A</code> : Scan for common executable opcodes for specified architectures (e.g., x86, ARM). Useful for finding embedded code.
* <code>-W</code> / <code>--hexdump</code> : Show hex dump around signature matches.

=== CTF Tips ===
* Start with <code>binwalk <filename></code> to get an overview.
* Use <code>binwalk -e <filename></code> for quick extraction, but '''always''' examine the <code>_*.extracted</code> directory carefully. Check file sizes and types.
* Use <code>binwalk -E <filename></code> to visually spot areas of high entropy (potential hidden data).
* If extraction fails or seems incomplete, manually carve data using tools like <code>dd</code> based on the offsets reported by Binwalk.
* Combine with other forensics tools like <code>strings</code>, <code>exiftool</code>, <code>foremost</code>, or <code>scalpel</code>.

[[Category:Tools]]
[[Category:Forensics]]

ExifTool

2025-05-02T17:31:56Z

Brunn:

== ExifTool CTF Quick Reference ==

=== Introduction ===
ExifTool, created by Phil Harvey, is an extremely powerful command-line application and Perl library for reading, writing, and manipulating '''metadata''' in a vast range of file types. Metadata is "data about data" – information embedded within a file that describes its properties, origin, creator, location, and more.

In CTFs, ExifTool is indispensable for:
* Extracting hidden flags or clues embedded in metadata comments, author fields, GPS coordinates, etc.
* Identifying the software used to create or modify a file, which might hint at specific vulnerabilities or techniques.
* Analyzing file properties beyond simple extensions (e.g., confirming image dimensions, document authors).
* Extracting embedded images like thumbnails or previews.

It supports a huge number of file formats (images like JPEG, PNG, GIF; documents like PDF, Office; audio/video like MP3, MP4, AVI) and understands thousands of different metadata tags (EXIF, IPTC, XMP, GPS, MakerNotes, and many more).

=== Basic Reading ===
'''Goal:''' View all metadata found in a file.
<syntaxhighlight lang="bash">
exiftool <filename>
</syntaxhighlight>
* This outputs all extracted metadata groups and tags with human-readable descriptions.

'''Goal:''' View metadata with shorter tag names (often easier to parse).
<syntaxhighlight lang="bash">
# Show only tag names (keys), not descriptions
exiftool -s <filename>

# Show very short tag names (keys) and values only
exiftool -S -s <filename>
</syntaxhighlight>

=== Reading Specific Tags ===
'''Goal:''' Extract only the value(s) of specific metadata tags.
<syntaxhighlight lang="bash">
# Get the value of the 'Comment' tag
exiftool -Comment <filename>

# Get GPS Latitude and Longitude
exiftool -GPSLatitude -GPSLongitude <filename>

# Get Author and Creator Tool
exiftool -Author -CreatorTool <filename>

# Get a tag from a specific group (e.g., EXIF Make)
exiftool -EXIF:Make <filename>
</syntaxhighlight>
* Use the exact tag name (case-sensitive). Find tag names using the basic `exiftool <filename>` command or check the [https://exiftool.org/TagNames/ ExifTool Tag Name documentation].
* Common CTF tags: <code>Comment</code>, <code>UserComment</code>, <code>Author</code>, <code>Copyright</code>, <code>Description</code>, <code>Title</code>, <code>Subject</code>, <code>Keywords</code>, <code>GPSPosition</code>, <code>Software</code>, <code>Make</code>, <code>Model</code>.

=== Searching / Filtering ===
'''Goal:''' Filter output or search within metadata.
<syntaxhighlight lang="bash">
# Use grep to find keywords (e.g., 'flag' case-insensitive) in the output
exiftool <filename> | grep -i 'flag'

# Use ExifTool's conditional processing to print only files containing a specific comment
exiftool -if '$Comment =~ /password/' -Comment <directory>
</syntaxhighlight>
* Combining `exiftool` with `grep` is often the quickest way to search metadata.
* The <code>-if</code> option allows complex Perl-based conditions.

=== Output Formatting ===
'''Goal:''' Get metadata in structured formats or extract binary data.
<syntaxhighlight lang="bash">
# Output in JSON format
exiftool -j <filename>

# Output in XML/RDF format
exiftool -X <filename>

# Extract binary data for a specific tag (e.g., Thumbnail) to a file
exiftool -b -ThumbnailImage <filename> > thumbnail.jpg

# Extract binary data for common preview/thumbnail tags
exiftool -b -PreviewImage <filename> > preview.jpg
exiftool -b -JpgFromRaw <filename> > preview.jpg
</syntaxhighlight>
* <code>-j</code> (JSON) and <code>-X</code> (XML) are useful for scripting.
* <code>-b</code> is essential for extracting embedded images or data streams.

=== Writing / Removing Metadata (Use with Caution!) ===
'''Goal:''' Modify or delete metadata tags. (Less common for *finding* flags, but good general knowledge).
<syntaxhighlight lang="bash">
# Write a comment (creates backup file by default)
exiftool -Comment="This is my secret message" <filename>

# Remove a specific tag
exiftool -Comment= <filename>

# Remove ALL metadata (DANGEROUS - may corrupt some files)
exiftool -all= <filename>

# Prevent backup file creation when writing
exiftool -overwrite_original -Comment="No backup needed" <filename>
</syntaxhighlight>
* ExifTool creates backup files (<code>filename_original</code>) by default when writing. Use <code>-overwrite_original</code> to prevent this.
* Removing all metadata (<code>-all=</code>) can sometimes damage files or remove essential structural information. Be careful!

=== Other Useful Options ===
* <code>-r</code> : Recursively process files in subdirectories.
* <code>-ext <extension></code> : Process only files with specific extensions (e.g., <code>-ext jpg -ext png</code>). Add <code>--ext</code> to include files with no extension.
* <code>-p <format_string></code> : Create custom output formats using tag names (e.g., <code>exiftool -p '$FileName: $ImageWidth x $ImageHeight' <filename></code>).
* <code>-FileTypeCode</code>, <code>-MIMEType</code> : Display file type information.
* <code>-fast</code> / <code>-fast2</code> : Speed up processing by skipping certain tags or parts of files.

=== CTF Tips ===
* Always run <code>exiftool <filename></code> first to see everything.
* Pay close attention to <code>Comment</code>, <code>UserComment</code>, <code>Description</code>, <code>Author</code>, <code>Copyright</code>, <code>Software</code>, <code>GPS...</code> tags.
* Use <code>-s -S</code> for cleaner output when searching for specific known tags.
* Use <code>| grep -i 'keyword'</code> extensively to search the full output.
* Try extracting thumbnails/previews with <code>-b -ThumbnailImage</code>, <code>-b -PreviewImage</code> etc. - sometimes they differ from the main image or contain hidden info.
* Check uncommon tags or MakerNotes if standard tags yield nothing.

[[Category:Tools]]
[[Category:Forensics]]

ExifTool

2025-05-02T17:31:42Z

Brunn:

ExifTool

2025-05-02T17:31:05Z

Brunn: Created page with "== ExifTool CTF Quick Reference == === Introduction === ExifTool, created by Phil Harvey, is an extremely powerful command-line application and Perl library for reading, writing, and manipulating '''metadata''' in a vast range of file types. Metadata is "data about data" – information embedded within a file that describes its properties, origin, creator, location, and more. In CTFs, ExifTool is indispensable for: * Extracting hidden flags or clues embedded in metadat..."

Category:Tools

2025-05-02T17:25:52Z

Brunn:

= CTF Tools =

{{:Tools}}

Category:Tools

2025-05-02T17:25:30Z

Brunn:

= CTF Tools =

{{Tools}}

Category:Web

2025-05-02T17:23:06Z

Brunn: Created page with "= Web = Category:CTFCategory"

= Web =

[[Category:CTFCategory]]

Category:Forensics

2025-05-02T17:22:49Z

Brunn: Created page with "= Forensics = Category:CTFCategory"

= Forensics =

[[Category:CTFCategory]]

Category:Cracking Tools

2025-05-02T17:22:20Z

Brunn: Created page with "= Cracking Tools = Category:Tools"

= Cracking Tools =

[[Category:Tools]]

Category:CTFCategory

2025-05-02T17:21:28Z

Brunn: Created page with "= CTF Category ="

= CTF Category =

MediaWiki:Sidebar

2025-05-02T17:21:04Z

Brunn:

MediaWiki:Sidebar

2025-05-02T17:18:50Z

Brunn:

MediaWiki:Sidebar

2025-05-02T17:18:16Z

Brunn:

MediaWiki:Sidebar

2025-05-02T17:17:46Z

Brunn:

* navigation
** mainpage|mainpage-description
** recentchanges-url|recentchanges
** randompage-url|randompage
** helppage|help-mediawiki
* pages
** Special:SpecialPages
* SEARCH
* TOOLBOX
* LANGUAGES

MediaWiki:Sidebar

2025-05-02T17:14:50Z

Brunn:

* navigation
** mainpage|mainpage-description
** recentchanges-url|recentchanges
** randompage-url|randompage
** helppage|help-mediawiki
* SEARCH
* TOOLBOX
* LANGUAGES

MediaWiki:Sidebar

2025-05-02T17:14:34Z

Brunn:

* navigation
** mainpage|mainpage-description
** recentchanges-url|recentchanges
** randompage-url|randompage
** helppage|help-mediawiki
** Categories
* SEARCH
* TOOLBOX
* LANGUAGES

MediaWiki:Sidebar

2025-05-02T17:11:01Z

Brunn:

* navigation
** mainpage|mainpage-description
** recentchanges-url|recentchanges
** randompage-url|randompage
** helppage|help-mediawiki
* SEARCH
* TOOLBOX
* LANGUAGES

MediaWiki:Sidebar

2025-05-02T17:10:42Z

Brunn: Created page with " * navigation ** mainpage|mainpage-description ** recentchanges-url|recentchanges ** randompage-url|randompage ** helppage|help-mediawiki * tools ** web * SEARCH * TOOLBOX * LANGUAGES"

* navigation
** mainpage|mainpage-description
** recentchanges-url|recentchanges
** randompage-url|randompage
** helppage|help-mediawiki
* tools
** web
* SEARCH
* TOOLBOX
* LANGUAGES

Category:Tools

2025-05-02T17:04:22Z

Brunn: Created page with "= CTF Tools ="

= CTF Tools =

SQL Map

2025-05-02T17:01:41Z

Brunn:

Tool, used to exploit [[SQLI]].

sqlmap is an open-source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers.

== How to use ==

Please reference the [usage guide](https://github.com/sqlmapproject/sqlmap/wiki/Usage) for full usage guide, but below some of the main usages are listed.

Default usage:

<code>
python sqlmap.py -u "http://brunnerne.dk"
</code>

[[Category:Tools]]
[[Category:Web]]

Steghide

2025-05-02T17:01:27Z

Brunn:

== Steghide ==

'''Steghide''' is a command-line [[Steganography|steganography tool]] used to hide secret data within cover files (typically JPEG, BMP, WAV, or AU files) and extract data hidden using the same method. It often requires a passphrase for extraction.

Commonly used in [[Forensics|forensics]] challenges to extract hidden flags or messages from provided media files.

=== Basic Extraction Example ===
To extract potentially hidden data from a file named ''challenge.jpg'' (you might be prompted for a passphrase if one was used):
steghide extract -sf challenge.jpg

If you know the passphrase is ''SuperSecret'', you can provide it directly:
steghide extract -sf challenge.jpg -p SuperSecret

If successful, ''steghide'' will write the extracted hidden file (e.g., ''flag.txt'') to the current directory.

[[Category:Tools]]
[[Category:Forensics]]

Hashcat

2025-05-02T17:01:14Z

Brunn:

== Hashcat ==

'''Hashcat''' is a powerful password recovery tool, known for being one of the fastest based on its highly optimized kernel code that can leverage GPUs and other hardware accelerators. It supports a vast number of hash types and attack modes, making it a versatile tool for [[Cracking Tools|cracking]].

Hashcat is frequently used in CTFs for [[Cracking Tools|cracking]] challenges where performance is key, such as:
* Cracking various password hashes much faster than CPU-only tools.
* Performing brute-force, dictionary, combination, and other advanced attacks on hashes.
* Leveraging graphics cards (Nvidia, AMD, Intel) for significant speed improvements.

=== Basic Usage Examples ===

==== Cracking Hashes with a Wordlist ====
To crack hashes stored in a file named ''hashes.txt'' using a wordlist ''rockyou.txt''. You first need to know the hash type. You can find a list of hash modes in Hashcat's documentation or by running `hashcat --help`. For example, if the hashes are MD5, the mode is `0`:
hashcat -m 0 hashes.txt /path/to/your/wordlist.txt

Replace `0` with the appropriate mode number for your specific hash type.

Hashcat will start the cracking process. You can check the status and see cracked hashes while it's running. To view the cracked passwords after the process is complete or stopped:
hashcat -m 0 --show hashes.txt

==== Specifying Attack Mode ====
The default attack mode is straight (wordlist), which is `-a 0`. Other common modes include brute-force (`-a 3`) using masks:
hashcat -m 0 -a 3 hashes.txt ?l?d?u

This example attempts to crack MD5 hashes using a mask that includes lowercase letters (`?l`), digits (`?d`), and uppercase letters (`?u`).

Hashcat's power comes from selecting the correct hash mode (`-m`), attack mode (`-a`), and providing appropriate input (wordlists, masks, rule files).

==== Wordlists ====

Wordlists are crucial for dictionary attacks, which are often the most effective way to crack common passwords. A good wordlist contains lists of common passwords, leaked passwords, or relevant terms.

In environments like Kali Linux, common wordlists, including the large `rockyou.txt` (often compressed), can be found. You might need to locate or decompress them first. A general command to find wordlist directories in Kali is similar to the one used for John the Ripper:
wordlists

The popular `rockyou.txt` file is often located in `/usr/share/wordlists/` and might need to be decompressed:
gunzip /usr/share/wordlists/rockyou.txt.gz

Using the correct path to your chosen wordlist with the `-w` or `--wordlist` option (or just specifying the path after the hash file in the standard straight attack mode) is essential for effective wordlist attacks with Hashcat.

[[Category:Tools]]
[[Category:Cracking Tools]]

John the Ripper

2025-05-02T17:01:03Z

Brunn:

== John the Ripper ==

'''John the Ripper''' (often shortened to '''JtR''') is a widely used, powerful password cracking tool. It is designed to detect weak Unix passwords, but it also supports hundreds of hash and cipher types, including many commonly found in software and files (like [[zip]] files, [[rar]] files, and [[pdf]]s).

It is an essential tool in [[Cracking Tools|cracking]] challenges in CTFs, often used to:
* Crack password hashes found in various formats.
* Recover passwords for encrypted files (ZIP, RAR, PDF, etc.).
* Perform dictionary attacks or brute-force attacks against weak passwords.

=== Basic Usage Examples ===

==== Cracking a Password Hash ====
To crack a hash stored in a file named ''hashes.txt'' using a common wordlist (like the built-in ''rockyou.txt'' or one you provide):
john hashes.txt --wordlist=/path/to/your/wordlist.txt

John will attempt to crack the hashes and will display any cracked passwords. You can view previously cracked passwords with:
john --show hashes.txt

==== Cracking a Password-Protected Zip File ====
First, you need to extract the hash from the zip file using a specific John tool called ''zip2john''. Then, feed the output to John:
zip2john challenge.zip > challenge.zip.hash
john challenge.zip.hash --wordlist=/path/to/your/wordlist.txt

Replace ''challenge.zip'' with the name of your zip file. This process is similar for other file types like RAR (using ''rar2john'') and PDF (using ''pdf2john'').

Remember that the effectiveness of cracking depends heavily on the strength of the password and the quality of the wordlist used.

==== Wordlists ====

In Kali Linux installations, wordlists may be found using the following command ([https://www.kali.org/tools/wordlists/ source])
wordlists

[[Category:Tools]]
[[Category:Cracking Tools]]

Hashcat

2025-05-02T17:00:41Z

Brunn:

John the Ripper

2025-05-02T17:00:26Z

Brunn:

SQL Map

2025-05-02T17:00:12Z

Brunn:

Tools

2025-05-02T16:59:47Z

Brunn:

Common CTF tools

== Web ==
* [[Burp Suite]] ([https://portswigger.net/burp/releases/community/latest get]) - An integrated platform for performing security testing of web applications. The Community Edition is free and widely used. Essential for proxying requests, inspecting traffic, and finding vulnerabilities.
* [[OWASP ZAP]] ([https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy Project]) - Another popular free and open-source web application security scanner and proxy. A strong alternative to Burp Suite.
* [[SQL_Map|SQLMap]] ([https://sqlmap.org/ get]) - Automates the process of detecting and exploiting SQL injection flaws and taking over database servers.
* [[Wfuzz]] ([https://github.com/xmendez/wfuzz get]) - A tool designed for brute-forcing web applications, useful for finding hidden directories, files, or parameters.
* [[Dirb]] ([http://dirb.sourceforge.net/ get]) - A web content scanner that looks for existing (and hidden) web objects. Based on a dictionary attack.
* [[Nikto]] ([https://cirt.net/nikto2 get]) - A web server scanner that performs comprehensive tests against web servers for multiple items, including over 6700 potentially dangerous files/programs, checks for outdated versions, and other problems.
* [[Gobuster]] ([https://github.com/OJ/gobuster get]) - A directory/file & DNS busting tool written in Go. Often faster than Dirb or Wfuzz in certain scenarios.

== Cracking Tools ==
* [[John the Ripper]] ([https://en.wikipedia.org/wiki/John_the_Ripper wiki]) - A powerful password cracking tool supporting numerous hash and cipher types.
* [[Hashcat]] ([https://en.wikipedia.org/wiki/Hashcat wiki]) - A fast, GPU-accelerated password recovery tool supporting a vast number of hash types and attack modes.
* [[fcrackzip]] ([https://oldhome.schmorp.de/marc/fcrackzip.html get]) - A fast and efficient zipper password cracker. Often used in conjunction with wordlists.
* [[Aircrack-ng]] ([https://www.aircrack-ng.org/ get]) - While primarily for WiFi, its cracking components are often listed under cracking tools as well.

== Cryptography ==
* [[CyberChef]] ([https://gchq.github.io/CyberChef/ Project]) - The "Swiss Army Knife" of cryptography, encoding, and data analysis.
* [[Factordb]] ([http://factordb.com/ Project]) - A database of factored numbers. Useful for RSA challenges.
* [[Online Decoders/Encoders]] (e.g., [https://emn178.github.io/online-tools/ Project]) - Various websites offer quick encoding/decoding for formats like Base64, Hex, URL encoding, etc.
* [[GnuPG]] ([https://gnupg.org/ get]) - The GNU Privacy Guard. Used for encrypting and signing data.
* [[OpenSSL]] ([https://www.openssl.org/docs/man1.1.1/man1/openssl.html wiki]) - A versatile command-line tool for various cryptographic operations.

== Forensics ==
* [[Wireshark]] ([https://www.wireshark.org/ get]) - A widely-used network protocol analyzer. Essential for examining packet captures (.pcap files).
* [[ foremost]] ([http://foremost.sourceforge.net/ get]) - A console program to recover files based on their headers, footers, and internal data structures (file carving).
* [[ scalpel]] ([http://www.digitalforensicssolutions.com/Scalpel/ get]) - Improved version of foremost, also used for file carving from images.
* [[Binwalk]] ([https://github.com/devttys0/binwalk get]) - A tool for analyzing, reverse engineering, and extracting firmware images and embedded files.
* [[ExifTool]] ([https://exiftool.org/ get]) - A command-line program for reading, writing, and editing meta information in various files.
* [[Autopsy]] ([https://www.autopsy.com/ get]) - A GUI-based digital forensics platform for analyzing disk images.
* [[Steghide]] ([https://steghide.sourceforge.net/ get]) - A steganography tool to hide/extract data in JPEG, BMP, WAV, and AU files.
* [[StegSolve]] ([https://github.com/bannsec/stegsolve get]) - A Java tool for analyzing images for hidden data, often used for pixel manipulation.
* [[Volatility]] ([https://www.volatilityfoundation.org/ get]) - An advanced memory forensics framework. Used to analyze memory dumps.

== Reversing ==
* [[Ghidra]] ([https://ghidra-sre.org/ get]) - A free and open-source software reverse engineering (SRE) suite with disassembler and decompiler.
* [[IDA Pro]] ([https://hex-rays.com/ida-pro/ get]) - A commercial multi-processor disassembler and debugger.
* [[radare2]] ([https://rada.re/n/ get]) - A complete framework for reverse-engineering and analyzing binaries.
* [[Cutter]] ([https://cutter.re/ get]) - A free and open-source reverse engineering platform powered by radare2, with a GUI.
* [[x64dbg]] ([https://github.com/x64dbg/x64dbg get]) - An open-source x64/x32 debugger for Windows.
* [[gdb]] ([https://www.gnu.org/software/gdb/ get]) - The GNU Debugger. A powerful command-line debugger for Linux binaries.
* [[objdump]] ([https://linux.die.net/man/1/objdump wiki]) - Displays information from object files.
* [[readelf]] ([https://linux.die.net/man/1/readelf wiki]) - Displays information about ELF format files.
* [[strings]] ([https://linux.die.net/man/1/strings wiki]) - Prints printable character strings from files.
* [[CodemerxDecompile]] ([https://decompiler.codemerx.com/]) - Free .NET decompiler

== Pwn (Binary Exploitation) ==
* [[pwntools]] ([https://github.com/pwntools/pwntools get]) - A CTF framework (Python library) for writing exploits.
* [[gdb]] ([https://www.gnu.org/software/gdb/ get]) - (See Reversing) Used for dynamic analysis and exploit development, often with plugins.
* [[PEDA]] ([https://github.com/longld/peda get]) - Python Exploit Development Assistance for GDB.
* [[GEF]] ([https://github.com/hugsy/gef get]) - GDB Enhanced Features. Another popular GDB plugin.
* [[pwndbg]] ([https://github.com/pwndbg/pwndbg get]) - A third excellent GDB plugin.
* [[ROPgadget]] ([https://github.com/JonathanSalwan/ROPgadget get]) - A tool and a library to find gadgets for Return-Oriented Programming (ROP).
* [[one_gadget]] ([https://github.com/david94203/one_gadget get]) - A tool to find the "one gadget RCE" in libc.

== Networking ==
* [[Nmap]] ([https://nmap.org/ get]) - A free and open-source network scanner for host and service discovery.
* [[Netcat]] ([https://nc110.sourceforge.io/ get]) - The "TCP/IP Swiss Army knife" for reading and writing data across network connections.
* [[Socat]] ([http://www.dest-unreach.org/socat/ get]) - A relay for bidirectional data transfer.
* [[tcpdump]] ([https://www.tcpdump.org/ get]) - A powerful command-line packet analyzer.

== Miscellaneous ==
* [[Hex Editors]] (e.g., [[HxD]] [https://mh-nexus.de/en/hxd/ get] for Windows, [[Bless Hex Editor]] [https://github.com/afrantzis/bless get] for Linux, or just `hexedit` or `xxd` on command line) - Tools for viewing and editing binary data at the byte level.
* [[dd]] ([https://linux.die.net/man/1/dd wiki]) - A command-line utility for copying and converting files, used for disk imaging.
* [[zsteg]] ([https://github.com/zed-0xff/zsteg get]) - A steganography tool specifically for PNG and BMP images.
* Scripting Languages (Python, Ruby, PHP, Node.js, etc.) - Essential for automating tasks and writing custom scripts.
* Online Assemblers/Disassemblers (e.g., [https://godbolt.org/ Project]) - Web-based tools for small code snippets.
* Online Decompilers (e.g., [https://dogbolt.org/ Dogbolt]) - Web services for decompiling binaries.

[[Category:Tools]]

Main Page

2025-05-02T16:46:31Z

Brunn:

= Brunnerne Wiki =

Bare log ind med Discord og lav nogle pages!

Skriv enten dansk eller engelsk tho :p

== Main articles ==
[[Tools]]

== Getting started ==
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Configuration_settings Configuration settings list]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:FAQ MediaWiki FAQ]
* [https://lists.wikimedia.org/postorius/lists/mediawiki-announce.lists.wikimedia.org/ MediaWiki release mailing list]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Localisation#Translation_resources Localise MediaWiki for your language]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Combating_spam Learn how to combat spam on your wiki]

For more information on how to write articles, Consult the [https://www.mediawiki.org/wiki/Special:MyLanguage/Help:Contents User's Guide] for information on using the wiki software.

Brunnerne:About

2025-05-02T16:45:58Z

Brunn: Created page with "Learn more about brunnerne at brunnerne.dk"

Learn more about brunnerne at brunnerne.dk

MediaWiki:Citizen-footer-tagline

2025-05-02T16:45:39Z

Brunn:

Learn more about brunnerne at [https://brunnerne.dk brunnerne.dk]

MediaWiki:Citizen-footer-tagline

2025-05-02T16:45:27Z

Brunn:

Learn more about brunnerne at [[https://brunnerne.dk|brunnerne.dk]]

MediaWiki:Citizen-footer-tagline

2025-05-02T16:45:16Z

Brunn: Created page with "Learn more about brunnerne at brunnerne.dk"

Learn more about brunnerne at [[Brunnerne.dk|brunnerne.dk]]

MediaWiki:Citizen-footer-desc

2025-05-02T16:44:44Z

Brunn: Created page with "Wiki provided for and by Brunnerne, a CTF team based in southern Denmark"

Wiki provided for and by Brunnerne, a CTF team based in southern Denmark