Essential tools

A basic, well-known arsenal solves most CTF challenges. This card gathers tools by category; knowing them deeply is worth more than having hundreds installed without mastering any. (For general offensive tools, see the Tooling area.)

Base environment

- Kali / Parrot / your distro + tools; or a container with your toolkit
- note organization (Obsidian/CherryTree): one challenge = one note with everything
- Python/bash scripting to automate the repetitive

By category

Web        Burp Suite (tool-burp), ffuf/gobuster (tool-ffuf), nikto, sqlmap (tool-sqlmap),
           curl, wfuzz, the browser + DevTools
Pwn/rev    pwntools, gdb + pwndbg/GEF, Ghidra, IDA Free, checksec, ROPgadget, one_gadget,
           radare2/rizin, ltrace/strace
Crypto     CyberChef, Python (PyCryptodome), sage, z3, RsaCtfTool, hashcat (tool-hashcat)
Forensics  Wireshark (tool-wireshark), Volatility3, binwalk, foremost, exiftool, steghide,
           zsteg, stegsolve, Autopsy
OSINT/misc  exiftool, strings, search engines, tools for the specific category

Enumeration (boot2root)

nmap (tool-nmap)        port/service/script scanning
ffuf/gobuster/feroxbuster  directory and file fuzzing
enum4linux-ng, smbclient, crackmapexec/netexec (tool-netexec)  SMB/AD
nikto, whatweb, wpscan   web enumeration

Exploitation and post

Metasploit (tool-metasploit)  exploits/payloads (carefully in CTF, sometimes "by hand" is better)
pwntools                      scripting pwn exploits
Impacket (tool-impacket)      all things Windows/AD (psexec, secretsdump...)
hashcat/John (tool-hashcat)   hash cracking

CyberChef and decoding utilities

- CyberChef: the "Swiss army knife" for base64/hex/XOR/ciphers/compression in a chain
- identify: hashid/name-that-hash (hashes), DIE (binaries), file/strings
- automate with Python when the challenge needs it (brute-forcing logic, network scripting)

Blue Team / learning

Master a few tools deeply over having hundreds installed and unused.
Keep notes per challenge (which tool, which command, which result) to speed up future ones.
Many of these have their own card in the Tooling area (tool-*): use them as reference.
Automating the repetitive with Python/pwntools is the difference in complex challenges.

Tips and common mistakes

Have your toolkit ready and tested before the CTF (pwntools, Ghidra, Burp, CyberChef); don’t install mid-challenge.
Common mistake: fighting the tool instead of the challenge; script the repetitive parts yourself.
Keep your scripts and templates (pwntools, base exploits) from past CTFs; they get reused constantly.

Testing checklist

Base environment ready (distro/container + notes)
Web: Burp + ffuf + sqlmap + curl
Pwn/rev: pwntools + gdb/pwndbg + Ghidra + checksec
Crypto: CyberChef + Python + sage/z3
Forensics: Wireshark + Volatility + binwalk + steg tools
Boot2root enum: nmap + ffuf + netexec/impacket
Master a few deeply; notes per challenge