🐉 01. Kali Linux

• Availability: FREE
• Platform: Linux / VM / WSL2
• Use Cases: All Categories · Base OS · Pre-built Tools · VM / WSL2

Kali is the operating system built for hackers. It comes pre-loaded with hundreds of security tools so you don’t spend your CTF time installing dependencies. Think of it as your base camp — everything else on this list runs best on Kali.

You don’t need to install Kali on bare metal. Run it as a VirtualBox VM, use WSL2 on Windows, or spin it up in the browser via TryHackMe’s in-browser machine. Most beginners start with a VM.

Installation & Update:

# 1. Download the Kali VM image:
# https://www.kali.org/get-kali/#kali-virtual-machines

# 2. Import into VirtualBox or VMware
# 3. Default credentials: user: kali  /  password: kali

# 4. Update immediately after first boot:
sudo apt update && sudo apt full-upgrade -y

Pro Tip: Give your VM at least 4GB RAM and 2 CPU cores. Ghidra and Burp Suite are hungry and will crawl on less.

---

🌐 02. Burp Suite Community

• Availability: FREE
• Platform: Win / Mac / Linux
• Use Cases: Web Exploitation · SQLi · XSS · IDOR · JWT Tampering

Burp Suite is the Swiss Army knife for web hacking. It sits between your browser and the target website, letting you intercept, modify, and replay every HTTP request. You cannot do serious web CTF challenges without it.

The Community edition is free and more than enough for CTFs. You’ll use the Proxy to capture requests, Repeater to tweak and resend them, Intruder to brute-force parameters, and Decoder to Base64/URL encode and decode on the fly.

Launch / Install:

# Already on Kali — launch from menu or:
burpsuite

# Or download directly from:
# https://portswigger.net/burp/communitydownload

# Set browser proxy to 127.0.0.1:8080
# Install Burp CA cert in browser to intercept HTTPS

Pro Tip: Use the FoxyProxy browser extension to toggle the Burp proxy on and off with one click. Toggling manually in browser settings wastes time mid-challenge.

---

🦈 03. Wireshark

• Availability: FREE
• Platform: Win / Mac / Linux
• Use Cases: Forensics · PCAP Analysis · Credential Hunting · Protocol Analysis

Wireshark captures and dissects network traffic, packet by packet. In CTFs, you’re usually handed a .pcap file — a recording of network activity — and asked to find the flag buried inside the traffic.

You might find credentials sent in plaintext over HTTP, a file being transferred over FTP, or a suspicious DNS query that leaks a flag via DNS exfiltration. Wireshark’s filter bar is the most important feature — learn it first.

Installation & Filters:

# Kali (pre-installed, but update it):
sudo apt install wireshark -y

# Key display filters to learn:
http               # show only HTTP traffic
http.request.method == "POST"  # POST forms
tcp.stream eq 4    # follow a TCP stream
dns                # DNS queries (data exfil!)

Pro Tip: Right-click any packet → Follow → TCP Stream. This reassembles the full conversation between client and server in human-readable form — often the flag is right there.

---

👁️ 04. Ghidra

• Availability: FREE
• Platform: Win / Mac / Linux
• Use Cases: Reverse Engineering · Binary Exploitation · Decompilation · Static Analysis

Ghidra is the NSA’s open-source reverse engineering framework — yes, really. It takes a compiled binary (an EXE or ELF file) and decompiles it back into C-like pseudocode, making it readable again. It’s your main weapon for Reverse and Pwn challenges.

Before Ghidra was released for free, you’d need IDA Pro at thousands of dollars per license. Now there’s no excuse not to have it. The learning curve is steep but the payoff is enormous.

Installation:

# Install Java first (Ghidra requires JDK 17+)
sudo apt install openjdk-17-jdk -y

# Download Ghidra from NSA GitHub:
# https://github.com/NationalSecurityAgency/ghidra/releases

# Extract and run:
unzip ghidra_*.zip && cd ghidra_*/
./ghidraRun

# Or one-liner on Kali:
sudo apt install ghidra -y

Pro Tip: When you open a binary, let Ghidra auto-analyze it (accept all defaults). Then hit S to search for strings — if the flag is hardcoded anywhere in the binary, you’ll find it in 10 seconds.

---

💥 05. pwntools

• Availability: FREE
• Platform: Linux / macOS
• Use Cases: Binary Exploitation · Scripting · ROP Chains · Remote Exploits

pwntools is a Python library purpose-built for writing CTF exploit scripts. Instead of manually sending bytes over netcat, you write clean Python that connects to the challenge server, crafts a payload, and receives the flag automatically.

It handles all the tedious parts of binary exploitation: packing integers to little-endian, finding offsets, interacting with processes locally or remotely, and even has built-in ROP chain support. Even if you’re not doing Pwn, pwntools is useful for web and crypto scripting too.

Installation & Basic Script:

# Install via pip:
# pip install pwntools

from pwn import *

# Connect to remote challenge
conn = remote('challenge.ctf.com', 1337)

# Build and send payload
payload = b'A' * 72 + p64(win_addr)
conn.sendline(payload)

# Read flag
print(conn.recvall())

Pro Tip: Use cyclic(200) to generate a de Bruijn sequence, send it as input, and use cyclic_find() on the crash address to find your exact overflow offset without guessing.

---

🍳 06. CyberChef

• Availability: FREE
• Platform: Browser / Offline
• Use Cases: Cryptography · Forensics · Encoding/Decoding · Hashing · All Categories

CyberChef is “the Cyber Swiss Army Knife” — a web app that lets you chain encoding, decoding, encryption, hashing, and data transformations in a drag-and-drop interface. It’s the fastest way to decode mystery blobs of text during a CTF.

Paste in a suspicious string, apply Base64 decode, then hex decode, then ROT13 — in seconds. The “Magic” operation will auto-detect encoding and try to decode it for you. Beginners live in CyberChef during crypto and forensics challenges.

Accessing CyberChef:

# Online version (use this):
https://gchq.github.io/CyberChef/

# Offline install (for no-internet CTFs):
https://github.com/gchq/CyberChef/releases
# Download CyberChef_vX.X.zip → open index.html

# Most used recipes:
From Base64 → To Hex → ROT13 → Magic

Pro Tip: Drag the Magic operation into your recipe when you don’t know the encoding. It runs 100+ detections and highlights results that look like flags — saved by this more times than we can count.

---

🧠 07. Volatility 3

• Availability: FREE
• Platform: Linux / Win / Mac
• Use Cases: Forensics · Memory Dumps · Process Analysis · Network Connections

Volatility is the standard tool for memory forensics. When a CTF gives you a RAM dump (.mem, .raw, .vmem), Volatility lets you dig into what was running at the time: processes, open network connections, clipboard contents, decrypted strings, and more.

Memory forensics sounds intimidating but the workflow is simple: identify the OS profile, then run plugins to extract interesting artifacts. Flags are often sitting in process memory, command history, or clipboard data.

Installation & Key Commands:

# Clone and install:
git clone https://github.com/volatilityfoundation/volatility3
cd volatility3 && pip install -r requirements.txt

# Key commands for a memory dump:
python3 vol.py -f dump.mem windows.pslist     # running processes
python3 vol.py -f dump.mem windows.cmdline    # command history
python3 vol.py -f dump.mem windows.clipboard  # clipboard!
python3 vol.py -f dump.mem windows.filescan   # open files

Pro Tip: Always run windows.pslist first to get your bearings. Look for suspicious or unusual process names. Then run windows.cmdline — attackers (and flags) often leave traces in executed commands.

---

🔎 08. ExifTool

• Availability: FREE
• Platform: Win / Mac / Linux
• Use Cases: Forensics · OSINT · Image Metadata · GPS Coordinates · File Analysis

Every file carries hidden metadata — the invisible layer of information attached when a file was created. A photo knows the camera model, GPS coordinates, date, and even the software used to edit it. ExifTool reads all of it.

In CTFs, flag organizers love hiding clues in file metadata because most players never check. Run ExifTool on every file you receive before doing anything else — it takes one second and has saved countless hours of searching in the wrong place.

Installation & Usage:

# Kali / Debian / Ubuntu:
sudo apt install libimage-exiftool-perl -y

# Run on any file:
exiftool suspicious.jpg

# Sample output you might find:
# Comment         : CIA{m3tad4ta_1s_ev3rywh3r3}
# GPS Latitude    : 23 deg 42' 0.00" N
# GPS Longitude   : 90 deg 21' 0.00" E

Pro Tip: Run exiftool * in a folder to scan all files at once. Pipe through grep -i flag or grep -i CIA to instantly surface anything flaglike.

---

Recommended Setup Order

1. Set up your Kali VM This is the foundation. Everything else runs inside it. Allocate proper RAM, update, and get comfortable with the terminal. Tools: VirtualBox · Kali Linux

2. Install Burp Suite + Configure Browser Proxy Set up FoxyProxy in your browser and get Burp intercepting traffic. Test it on a basic HTTP site first. Tools: Burp Suite · FoxyProxy

3. Download CyberChef offline copy Some CTFs block internet. Save a local copy now so you’re never caught without it. Bookmark the online version too. Tools: CyberChef

4. Install ExifTool + Wireshark Both come with Kali. Verify they’re updated. Practice opening a .pcap from a past CTF on Wireshark right now. Tools: exiftool · Wireshark

5. Install Ghidra + Java, then practice on a binary Open a simple picoCTF reverse challenge binary in Ghidra. Search strings. Get familiar with the decompiler before you need it under pressure. Tools: Ghidra · JDK 17

6. Install pwntools + Volatility 3 when ready for Pwn/Memory These are more advanced. Come back to them once you’ve solved your first web and forensics challenges. Tools: pwntools · Volatility 3

---

Tool Quick Reference

Tool	Category	Primary Use	Cost
🐉 Kali Linux	All	Security-focused OS with tools pre-installed	Free
🌐 Burp Suite	Web	Intercept and modify HTTP requests	Free
🦈 Wireshark	Forensics	Analyze network packet captures	Free
👁️ Ghidra	Rev / Pwn	Decompile binaries back to readable code	Free
💥 pwntools	Pwn	Python library for writing exploit scripts	Free
🍳 CyberChef	Crypto / Forensics	Drag-and-drop encoding and decoding	Free
🧠 Volatility 3	Forensics	Extract artifacts from RAM dumps	Free
🔎 ExifTool	Forensics / OSINT	Read hidden metadata from any file	Free

Now Go Break Something.

Your toolkit is ready. The best way to learn these tools isn’t reading — it’s using them on real challenges. Start with picoCTF and solve one challenge per tool.