ctf-tools

This is a Nix flake packaging various security research tools. Of course, this isn't a hard problem, but it's really nice to have them in one place that's easily deployable to new machines and so forth. CI evaluates the catalog and builds the repository-packaged x86_64 tools every day, so breakage should be caught quickly.

The following tools are included. The first table lists tools packaged in this repo (under nix/pkgs/); the second lists tools taken from nixpkgs.

NIX??????

Long-time ctf-tools users might be surprised by this development, but it is a good development. Nix provides isolated packaging and can be deployed into a dev/hack environment, locally into a user's home directory, or globally system/container-wide. It also happily installs alongside your normal OS and package manager (e.g., ubuntu and apt) with zero interference. Trust me, I was as skeptical as you are for years, but it is the way.

Packaged in this repo

Category	Tool	Description
binary	angr	Next-generation binary analysis engine from Shellphish.
binary	angr-management	A GUI reverse engineering and decompilation tool.
binary	beef	Browser exploitation framework.
binary	crosstool	Cross-compilers and cross-architecture tools.
binary	cross2	A set of cross-compilation tools from a Japanese book on C.
binary	decomp2dbg	A plugin to introduce interactive symbols into your debugger from your decompiler.
binary	deepmage	Terminal hex editor for bit-level and non-octet-oriented data.
binary	elfparser	Multiplatform CLI and GUI tool to show information about ELF files.
binary	evilize	Tool to create MD5 colliding binaries
binary	forkever	Debugger with fork-based checkpoints for exploit development.
binary	ida	Decompilation and reversing tool (proprietary: you download it yourself — drop the Hex-Rays tarball in ~/Downloads, or set IDA_HOME to an unpacked install).
binary	ida-pro-mcp	MCP server that drives IDA Pro (headless via idalib, or attached to a running IDA; set up with ida --activate-idalib).
binary	kuna	An agent-first decompiler in Rust, originally ported from Ghidra's decompiler.
binary	manticore	Manticore is a prototyping tool for dynamic binary analysis, with support for symbolic execution, taint analysis, and binary instrumentation.
binary	patchkit	Python toolkit for patching ELF binaries.
binary	preeny	A collection of helpful preloads (compiled for 64- and 32-bit x86).
binary	pwndbg	Enhanced environment for gdb. Especially for pwning.
binary	pwnsh	Useful shell scripts for assembly, exploitation, etc.
binary	qiling	A dynamic binary instrumentation framework. Entry point is qltool.
binary	qira	Parallel, timeless debugger.
binary	reko	General-purpose machine-code decompiler. Entry point is reko.
binary	shellnoob	Shellcode writing helper.
binary	taintgrind	A valgrind taint analysis tool. Builds and runs, but upstream's IR translator aborts on many binaries (tnt_translate: expr2vbits_Unop).
binary	villoc	Visualization of heap operations.
binary	xrop	Gadget finder.
mobile	frick	Interactive debugger built on Frida.
forensics	firmware-mod-kit	Tools for firmware packing/unpacking.
forensics	origami-pdf	Ruby framework and command-line tools for parsing and manipulating PDF files.
forensics	peepdf	Powerful Python tool to analyze PDF documents.
forensics	scrdec18	A decoder for encoded Windows Scripts.
forensics	volatility	Analyzer for system memory dumps (classic Python 2 version with its runtime included).
crypto	codext	Python codecs extension featuring CLI tools for encoding/decoding anything including AI-based guessing mode.
crypto	cribdrag	Interactive crib dragging tool (for crypto).
crypto	fastcoll	An md5sum collision generator.
crypto	foresight	A tool for predicting the output of random number generators. To run, launch "foresee".
crypto	featherduster	An automated, modular cryptanalysis tool. Its Python 2 runtime is included in the package.
crypto	galois	A fast galois field arithmetic library/toolkit.
crypto	hashpump-partialhash	Hashpump, supporting partially-unknown hashes.
crypto	libc-database	Build a database of libc offsets to simplify exploitation. Ships the scripts only: run libc-database-get all once to populate the database.
crypto	nonce-disrespect	Nonce-Disrespecting Adversaries: Practical Forgery Attacks on GCM in TLS.
crypto	pemcrack	SSL PEM file cracker.
crypto	reveng	CRC finder.
crypto	rsactftool	RSA attack tool.
crypto	ssh_decoder	A tool for decoding SSH traffic from hosts affected by the Debian OpenSSL PRNG bug. Its Ruby runtime is included.
crypto	yafu	Automated integer factorization.
web	burpsuite	Web proxy to do naughty web stuff.
web	subbrute	A DNS meta-query spider that enumerates DNS records, and subdomains.
web	webgrep	grep for Web pages, with JS deobfuscation, CSS unminifying and OCR on images.
stego	steganabara	Another image stenography solver.
stego	stegano-tools	A collection of text and image steganography tools (incl LSB, PVD, PIT).
stego	stegdetect	Stenography detection/breaking tool.
stego	stegosaurus	A steganography tool for embedding arbitrary payloads in Python bytecode (pyc or pyo) files.
misc	jdgui	Java decompiler.
misc	python2	For when you really need it...
misc	social-analyzer	Social media reconnaissance tool...
misc	veles	Binary data analysis and visualization tool.
misc	xspy	Tiny tool to spy on X sessions.
game	df	Dwarf Fortress! Something to help you relax after a CTF!

From nixpkgs

Category	Tool	Description
binary	aflplusplus	Modern coverage-guided fuzzer.
binary	checksec	Reports executable hardening features.
binary	elfkickers	Utilities for manipulating ELF files.
binary	gdb	GDB with Python 3 scripting and support for many targets.
binary	gef	Enhanced environment for GDB.
binary	ghidra	Open-source reverse engineering and decompilation tool.
binary	grap	Defines and matches graph patterns in binaries.
binary	honggfuzz	General-purpose security-oriented fuzzer.
binary	imhex	Extensible graphical hex editor.
binary	one_gadget	Finds one-shot code-execution gadgets in libc.
binary	poke	Extensible editor for structured binary data.
binary	pwninit	Automates preparing binary-exploitation challenges.
binary	pwntools	Python framework and utilities for exploit development.
binary	qemu	Full-system and user-mode machine emulator.
binary	radare2	Reverse-engineering framework and command-line toolkit.
binary	rappel	Linux assembly REPL.
binary	rizin	Reverse-engineering framework forked from radare2.
binary	ropper	ROP gadget finder and binary analysis utility.
binary	rp++	Fast ROP gadget finder.
binary	rr	Record-and-replay debugger.
binary	seccomp-tools	Utilities for seccomp analysis.
binary	upx	Executable packer and unpacker.
binary	valgrind	Dynamic instrumentation framework and debugging tools.
binary	wcc	Witchcraft Compiler Collection for binary analysis.
mobile	apktool	Decodes and rebuilds Android APK resources.
mobile	dex2jar	Tools for Android DEX and Java class files.
mobile	frida-tools	Command-line tools for Frida dynamic instrumentation.
mobile	jadx	Dex-to-Java decompiler with CLI and GUI frontends.
forensics	autopsy	Graphical digital-forensics platform.
forensics	binwalk	Firmware and embedded-file analysis tool.
forensics	dislocker	Reads BitLocker-encrypted volumes.
forensics	exiftool	Reads and writes file metadata.
forensics	foremost	File carver based on headers and footers.
forensics	pdf-parser	Inspects objects and streams in PDF files.
forensics	sleuthkit	Filesystem and disk-image analysis toolkit.
forensics	testdisk	Partition recovery and file undelete tools.
forensics	volatility3	Current memory-forensics framework.
forensics	yara	Pattern-matching engine for malware and forensic artifacts.
crypto	hash-identifier	Identifies likely hash algorithms.
crypto	hashcat	GPU-accelerated password recovery tool.
crypto	hydra	Parallel network-login cracker.
crypto	john	John the Ripper password cracker.
crypto	msieve	Integer factorization library and application.
crypto	pkcrack	Classic PKZIP known-plaintext attack.
crypto	sage	Mathematics system useful for cryptanalysis and algebra.
crypto	xortool	Repeating-key XOR analysis tool.
crypto	z3	SMT theorem prover and constraint solver.
networking	bettercap	Network reconnaissance and attack framework.
networking	dsniff	Network auditing and traffic-analysis tools.
networking	nmap	Network discovery and port scanner.
networking	socat	Bidirectional relay for sockets and many other streams.
networking	sslsplit	SSL/TLS interception proxy.
networking	tshark	Command-line packet analyzer from Wireshark.
web	commix	Command-injection discovery and exploitation tool.
web	dirb	Web content scanner.
web	dirsearch	Web path scanner.
web	feroxbuster	Fast recursive content-discovery tool.
web	ffuf	Fast web fuzzer.
web	mitmproxy	Interactive HTTP interception proxy and Python library.
web	nikto	Web-server scanner.
web	sqlmap	SQL-injection detection and exploitation engine.
web	tor-browser	Tor-enabled browser bundle.
web	wfuzz	Web application fuzzer.
web	xsstrike	Cross-site scripting detection and exploitation suite.
stego	pngtools	Utilities for inspecting PNG files.
stego	sonic-visualizer	Audio visualization and analysis application.
stego	stegsolve	Image steganography solver.
stego	zsteg	Detects data hidden in PNG and BMP images.
osint	sherlock	Finds accounts by username across social networks.

Usage

Every tool is a flake output. To use, do:

# install a tool into your Nix profile
nix profile install github:zardus/ctf-tools#gdb

# run a tool without installing it
nix run github:zardus/ctf-tools#ropper

# run a shell with a tool in it
nix shell github:zardus/ctf-tools#ropper

# list every available tool
nix flake show github:zardus/ctf-tools

A bin/manage-tools wrapper around nix profile is also provided, for the familiar CLI:

# (once) configure Nix + the binary cache
/path/to/ctf-tools/bin/manage-tools setup

manage-tools list                 # list the available tools
manage-tools install pwntools
manage-tools uninstall gdb
manage-tools search preload
manage-tools list -t              # list generated cross-toolchains

manage-tools install all          # every catalogued tool
manage-tools install all-toolchains
manage-tools install everything   # catalog + toolchains

Tools install into your Nix profile, and uninstalling removes them cleanly. The three aggregate names install as single profile entries, so Nix shares common dependencies and does not activate a partial set if a build fails. manage-tools prints Nix's download/build plan before installing an aggregate. On ARM, all contains every supported catalog tool; the generated toolchain aggregates are x86_64-only.

Downloads outside Nix

Package inputs are downloaded by Nix and pinned by SHA-256, including the two legacy plain-HTTP sources (steganabara and pkcrack's fallback mirror). A server or network attacker can make those fetches unavailable, but cannot make Nix accept different bytes under the recorded hash.

The exceptions are:

• libc-database-get all downloads the multi-gigabyte libc corpus into the user's data directory after installation.
• IDA itself is downloaded by the user from Hex-Rays. The ida wrapper can unpack that local archive and activate the vendor's bundled idapro wheel; activation tries an offline install first, with PyPI only as a fallback if that wheel declares an unavailable dependency.
• Running the crosstool package's ct-ng driver directly downloads the sources selected by the user's configuration. The prebuilt crosstool-ng-* flake outputs instead fetch a hash-pinned source set during the Nix build and compile offline.

Network scanners and clients naturally contact targets when run; that is tool operation, not package installation.

Platform support

The ordinary package set is available on both x86_64-linux and aarch64-linux. Packages that nixpkgs or their upstream binary releases mark as unsupported are omitted from the ARM package set instead of making the whole profile fail to evaluate.

The generated cross2-* and crosstool-ng-* toolchain outputs are x86_64-only. ARM packages are evaluated by CI, but are not built or uploaded to the size-limited ctftools Cachix cache; ARM users build repository-packaged tools locally. Tools forwarded unchanged from nixpkgs can still substitute from cache.nixos.org on either architecture.

Cross-compiler toolchains (cross2, crosstool)

On x86_64, two of the tools are toolchain builders rather than single programs, so they expose one output per target instead of one output overall. Install only the target you need — each is an independent package.

crosstool is the crosstool-NG ct-ng driver, and only the driver — unlike the old shell tool, it puts no cross compilers on your PATH. Installing crosstool gives you ct-ng itself, ready to build your own toolchain from a config:

nix profile install github:zardus/ctf-tools#crosstool
ct-ng list-samples

The compilers themselves are separate outputs: 77 of crosstool-NG's 146 samples are prebuilt as crosstool-ng-<sample>, so you can install a ready-made toolchain (say, arm-none-eabi-gcc) instead of spending an hour building one:

# a bare-metal ARM toolchain: arm-none-eabi-gcc, -gdb, -objdump, ...
nix profile install github:zardus/ctf-tools#crosstool-ng-arm-none-eabi

# a full Linux/musl cross toolchain, with sysroot
nix profile install github:zardus/ctf-tools#crosstool-ng-aarch64-unknown-linux-musl

# see all of them (bare-metal newlib/picolibc plus Linux
# glibc/uClibc/musl, and the mingw-w64 Windows targets)
nix flake show github:zardus/ctf-tools | grep crosstool-ng-

The sample name is the crosstool-NG sample id with any character outside [a-zA-Z0-9_-] replaced by - (so x86_64-ubuntu16.04-linux-gnu becomes crosstool-ng-x86_64-ubuntu16-04-linux-gnu).

The other 69 samples that ct-ng list-samples prints have no crosstool-ng-* output — build them yourself with ct-ng <sample> && ct-ng build, or pin one as a flake output by running nix/pkgs/crosstool/pin-samples.sh and folding the hash it prints into nix/pkgs/crosstool/hashes.nix (anything in there is surfaced automatically).

cross2 is the companion toolchain set for the kozos.jp assembly book — binutils 2.21.1 + gcc 3.4.6 + newlib 1.20.0 (+ gdb 7.3.1 where it still builds, or just its CPU simulator, <target>-run, where it does not), for 34 mostly-retro bare-metal targets. Installing cross2 gives you the book's six "major architecture" toolchains (arm, h8300, i386, mips, powerpc, sh); the other targets are individual cross2-<target> outputs:

# the major-architecture bundle
nix profile install github:zardus/ctf-tools#cross2

# or just one target, e.g. mmix or vax
nix profile install github:zardus/ctf-tools#cross2-mmix-elf
nix profile install github:zardus/ctf-tools#cross2-vax-netbsdelf

These are large, from-source gcc builds, so install them with the binary cache configured — otherwise Nix will build the whole toolchain locally (tens of minutes to hours each).

Help!

Something not working? I didn't write (almost) any of these tools, but hit up the discord if you're desperate. Maybe some kind soul will help!

Binary cache

CI builds the x86_64 tools packaged in this repo and pushes them to a public Cachix cache, so x86_64 installs download prebuilt binaries instead of compiling. Trusted Nix users pick this up automatically from the flake's nixConfig; otherwise run cachix use ctftools once (or pass --accept-flake-config).

ARM outputs are deliberately not pushed to this cache. Unchanged tools in the "From nixpkgs" table use the official cache.nixos.org binary cache and do not consume space in the ctftools cache. dirsearch is the exception on x86_64: our setuptools compatibility override produces a distinct output, so CI caches it alongside the tools packaged in this repository.

Dockerized Tools

You can get the tools packaged in this repo in prebuilt x86_64 containers from dockerhub. For example:

$ echo hi | docker run -i ctftools/taintgrind taintgrind --taint-stdin=yes /bin/cat

The images are generated by CI, which installs the tool into a nixos/nix base with nix profile install.

Adding Tools

To add a tool (say, named toolname):

1. If it is already in nixpkgs, add a line to nix/passthrough.nix.
2. Otherwise, create nix/pkgs/toolname/default.nix — a callPackage-style derivation with its sources pinned by hash — and build it with nix build .#toolname.
3. Add it to the README.

The flake discovers nix/pkgs/* automatically; the output name is the directory name.

License

The individual tools are all licensed under their own licenses. As for ctf-tools itself, it is licensed under BSD 2-Clause License. If you find it useful, star it on GitHub (https://github.com/zardus/ctf-tools).

Good luck!

See Also

There's a curated list of CTF tools, but without installers, here: https://github.com/apsdehal/aWEsoMe-cTf.

There's a Vagrant config with a lot of the bigger frameworks here: https://github.com/thebarbershopper/epictreasure.

The old apt-only tool list has been fully migrated to Nix outputs.

Useful CTF tools in docker images

Previously, this repository included some scripts that were wrappers around docker pull. We trust that you can do that yourself :-)

Category	Source	Tool	Description
binary	docker	panda	Platform for Architecture-Neutral Dynamic Analysis.
stego	Docker	stego-toolkit	A docker image with dozens of steg tools.

Useful CTF Libraries

Previously, this repository included library installers. Because of how bespoke library install preferences are (e.g., unlike a tool, it's not clear if per-library venvs are a desired thing), we've stopped shipping them, and link them here for posterity.

Category	Source	Tool	Description
binary	Library	capstone	Multi-architecture disassembly framework.
binary	Library	keystone	Lightweight multi-architecture assembler framework.
binary	Library	lief	Library to Instrument Executable Formats.
binary	Library	miasm	Reverse engineering framework in Python.
binary	Library	unicorn	Multi-architecture CPU emulator framework.
binary	Library	virtualsocket	A nice library to interact with binaries.
crypto	Library	cryptanalib3	The surviving core of featherduster cryptanalysis tool, updated for python3.
crypto	Library	python-paddingoracle	Padding oracle attack automation.