CTF Tool Selection

Use this skill to translate a broad CTF tool list into safe, scoped, evidence-producing workflows. Prefer well-known, maintained tools with reproducible CLI output. Treat old "awesome list" entries as leads, not installation instructions.

Handoffs: Use web-inspection-forensics for web, URL, HAR, log, JS bundle, and PCAP triage. Use reverse-engineering-analysis for binaries, firmware, mobile apps, WebAssembly, and decompilation. Use exploitation-sandbox for active validation only after explicit authorization. Use bug-hunt-planner when tool selection grows into a structured hunting plan.

Selection Rules

1. Start passive: decode, inspect, inventory, decompile, parse captures, and summarize Evidence before probing a live Target.
2. Prefer current upstream projects, distro packages, or pinned container images. Avoid random mirrors, abandoned binaries, and browser extensions from unknown publishers. If a recommended tool is not installed, check with command -v, report it as unavailable, and request a durable approval before any download, package install, or image pull — never improvise an install mid-analysis.
3. Record provenance for every tool: version, install source, command, input hash, output hash, timestamp, exit code, and timeout.
4. Use a Workspace Container for unknown artifacts, password cracking, dynamic instrumentation, exploit frameworks, fuzzers, scanners, and any tool that runs untrusted code.
5. Gate active tools behind durable approvals (see docs/durable-approvals.md): scanners, brute-forcers, exploit modules, MITM, packet injection, credential tests, browser mutation, downloads, writes, and high-rate requests. A target grant establishes scope only; it does not authorize any specific command.
6. Stop when the tool has produced sufficient Evidence. Do not keep escalating because a tool supports a more aggressive mode.

Default Tool Choices

Task	Prefer	Use Carefully / Notes
Data decoding and crypto puzzles	CyberChef, Python, openssl, xxd, base64, hashid, RsaCtfTool, hash_extender, xortool	Online decoders may expose secrets; prefer local CyberChef or CLI for sensitive artifacts.
Web proxying and manual inspection	Burp Suite Community/Pro, OWASP ZAP, mitmproxy, browser DevTools, Postman/Insomnia, httpie/xh	Manual browsing is safer than automated attack mode. Authenticated and mutating flows need scope confirmation.
Web discovery	katana, hakrawler, gau, waybackurls, ffuf, feroxbuster, gobuster, httpx, whatweb, nuclei	Content discovery, whatweb, nuclei, and fuzzing are active — even info-only templates send live requests. Set host allowlists, low rates, small wordlists, and stop conditions, and carry a durable approval.
Injection validation	Manual curl, Burp Repeater/Intruder, sqlmap, Commix, XSSer	Automated exploitation requires a durable approval. Start with benign differential tests and lowest risk/level settings.
Network inventory	dig, host, openssl s_client, testssl.sh, nmap, Wireshark/tshark, Zeek	Any nmap invocation is active and needs a durable approval. masscan and zmap are high-volume and should be avoided unless a durable approval explicitly covers broad scanning and rate limits.
Password/hash recovery	John the Ripper Jumbo, hashcat, hashid, cewl, SecLists wordlists	Only against provided hashes or explicitly authorized accounts. Never run online credential attacks without durable approval.
File and disk forensics	file, stat, sha256sum, strings, exiftool, binwalk, foremost, bulk_extractor, sleuthkit, photorec, KAPE	Mount images read-only. Preserve original hashes and work on copies.
Memory and malware-style triage	Volatility 3, Rekall only for legacy cases, YARA, capa, FLOSS, REMnux/FLARE VM	Unknown samples stay offline in a VM/container. No internet access unless explicitly approved.
PCAP and traffic analysis	Wireshark, tshark, Zeek, NetworkMiner, tcpdump -r	Only analyze owned/provided captures. Report credentials and session tokens exactly.
Steganography and media	exiftool, pngcheck, zsteg, stegsolve, stegseek/StegCracker, ImageMagick, Audacity, binwalk, foremost	Prefer local tools for sensitive images/audio. Brute forcing hidden data can be expensive; record dictionaries and limits.
Native reversing	Ghidra, IDA, Binary Ninja, radare2/Rizin/Cutter, GDB with pwndbg/GEF, RetDec, objdump, readelf, nm	Dynamic debugging and packed samples require isolation.
Mobile/JVM/.NET reversing	apktool, jadx, Androguard, Frida, Objection, ILSpy, dnSpyEx, dotPeek, CFR/FernFlower/Procyon	Runtime mobile instrumentation may affect devices/services; use test devices and scoped apps.
Exploit development in labs	pwntools, ROPgadget, ropper, one_gadget, GDB + pwndbg/GEF, checksec, Metasploit in a lab	Do not point exploit frameworks at live Targets without explicit technique-level approval.

Tool Triage From Old Catalogs

When a provided list contains many historical CTF tools, classify each entry before recommending it:

• Established default: actively maintained or still widely used, good docs, reproducible output, packageable. Examples: CyberChef, Burp Suite, OWASP ZAP, Nmap, Wireshark, Zeek, Ghidra, radare2/Rizin, pwntools, ROPgadget, John, hashcat, Volatility 3, apktool, jadx, Frida, binwalk, exiftool.
• Useful but narrow: good for one artifact class or challenge pattern. Examples: RsaCtfTool, hash_extender, xortool, zsteg, stegsolve, StegCracker/stegseek, pngcheck, one_gadget, angr, Triton, YARA, KAPE.
• Use only if needed: commercial, GUI-only, old but still useful, or replaced by safer defaults. Examples: IDA Pro, Binary Ninja, Hopper, Magnet AXIOM, CFF Explorer, NetworkMiner, OfflineRegistryView.
• Avoid by default: abandoned, broken-link, unknown provenance, high-risk, or superseded entries. Recommend a maintained replacement instead and note uncertainty.

Usage Patterns

Web Collection Baseline

Start with genuinely passive fetches (no crawling):

mkdir -p evidence/{raw,normalized,stats}
curl -sSIL "$URL" > evidence/raw/headers.txt 2> evidence/raw/headers.err
curl -sS "$URL/robots.txt" > evidence/raw/robots.txt
curl -sS "$URL/sitemap.xml" > evidence/raw/sitemap.xml
sha256sum evidence/raw/* > evidence/stats/hashes.txt

whatweb and katana send live HTTP requests and are active: they require target authorization plus a matching durable approval before running.

# DURABLE APPROVAL REQUIRED (active crawl)
whatweb --log-brief evidence/raw/whatweb.txt "$URL"
katana -u "$URL" -d 1 -silent > evidence/raw/urls.txt

Escalate to Burp/ZAP only after a durable approval defines auth state and capture boundaries. Disable active scanning until approved.

Nmap Baseline

Every nmap invocation — including this minimal baseline — is an active probe of a live host and requires target authorization plus a matching durable approval before running.

# DURABLE APPROVAL REQUIRED (active scan)
nmap -sT -Pn -p 80,443,8080 --max-retries 2 --host-timeout 60s "$HOST" \
  -oA evidence/raw/nmap-web

Full port scans, UDP scans, version scripts, NSE vulnerability scripts, masscan, and zmap additionally need explicit rate limits and narrower scope named in the approval.

Artifact Forensics Baseline

sha256sum "$ARTIFACT" > evidence/stats/artifact.sha256
file "$ARTIFACT" | tee evidence/raw/file.txt
exiftool "$ARTIFACT" > evidence/raw/exiftool.txt 2> evidence/raw/exiftool.err
binwalk "$ARTIFACT" > evidence/raw/binwalk.txt 2> evidence/raw/binwalk.err
strings -a "$ARTIFACT" > evidence/raw/strings.txt

Extract only into a disposable folder. Do not execute extracted files on the host.

Password Or Hash Work

command -v john || echo "john not installed - request durable approval before installing"
ls /usr/share/wordlists/rockyou.txt 2>/dev/null || echo "rockyou.txt missing - use an available wordlist or request durable approval to obtain one"
hashid hashes.txt | tee evidence/raw/hashid.txt
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt \
  --pot=evidence/raw/john.pot --session=project-hashes

Only run against provided hashes or authorized lab services; every online credential attempt needs its own durable approval. Record wordlist, mask/rules, runtime, and hardware. Stop when the proof bar is met.

Binary Exploit Lab

Static-first binary work (checksec, gadget inventory, local ELF inspection) lives here:

checksec --file ./challenge > evidence/raw/checksec.txt
ROPgadget --binary ./challenge > evidence/raw/ropgadgets.txt

For anything beyond static inspection — running the binary, building and testing exploits — defer to exploitation-sandbox, which owns runtime isolation and durable approvals. Keep this local unless the Target scope explicitly allows remote exploit validation.

Output Shape

Return:

• Tool plan: chosen tools, why each fits, and tools intentionally avoided.
• Availability check: which tools were verified present with command -v, and which are missing (report; do not install without a durable approval).
• Authorization state: passive-only or approved active scope, with the durable approvals on record, rate limits, and stop conditions.
• Commands: exact commands or GUI steps, with evidence paths and any truncation noted.
• Expected Evidence: what each tool should prove or disprove.
• Fallbacks: maintained alternatives if a tool is unavailable, broken, commercial, or too risky.