Free CTF tools for organizers and players
Nine small tools that run in your browser. For players: an encoder and decoder, a hash identifier, a classic cipher solver, a JWT decoder, a subnet calculator and a team name generator. For organizers: scoring and budget calculators and a CVSS 4.0 calculator. All free, no account.
Decode, identify and inspect
The utilities you reach for in the middle of a challenge. Nothing you paste leaves your browser.
Plan and score your event
Each tool links to a guide that explains the method behind it.
Playing rather than hosting? Practice on Ouroboros CTF, our self-paced practice event.
Plan the event with CTF7
Once the cost calculator gives you a budget, tell CTF7 about your event and we will help plan it. See pricing for the Free, Standard and Premium hosting plans, all hosted on CTF7.
Guides and templates that go with the tools
The software you install
Everything above runs in a browser with nothing to install. Beyond those, a working setup is a desktop toolkit, and the rule that matters is to learn a small core deeply before collecting more: a Linux shell, Python with pwntools, and a browser. Kali and Parrot ship nearly all of this preinstalled, so the commands below matter mainly on plain Ubuntu, Debian or WSL. The tool is never the skill; understand the technique and let the tool accelerate it.
- General: the shell with
file,strings,grep,xxd,ncandcurl, which solve a surprising share of challenges outright, plus Nmap for a target with ports. - Web: Burp Suite Community as the proxy, ffuf for content discovery, sqlmap for injection once you can do it by hand, and the browser developer tools.
- Crypto: SageMath for number theory and lattices, RsaCtfTool as a fast first pass on RSA, hashcat or John the Ripper with the rockyou list, and PyCryptodome to build and break by hand.
- Pwn: GDB with pwndbg or GEF for register and heap views, pwntools for the exploit itself, ROPgadget to chain past NX, and checksec to read a binary's mitigations.
- Reversing: Ghidra as the free starting point, IDA Free for x86 work, radare2 with Cutter for scripting, and jadx for Android.
- Forensics: Wireshark and tshark for captures, Volatility 3 for memory, Autopsy or The Sleuth Kit for disk images, binwalk for embedded files, ExifTool for metadata, and steghide with zsteg for hidden data.
- OSINT: search operators, Sherlock for a username across platforms, and the Wayback Machine for pages that have changed.
- Team and notes: one note per challenge in Obsidian, Joplin or plain Markdown, a shared Git repository for scripts, and a claim convention so two people never grind the same challenge.
Owning tools matters less than having a fast, repeatable flow: identify the file type and category, triage with the cheap general tools, deep-dive with the category tool once you know what you are looking at, automate the exploit in Python, and record the working commands as you go. Most easy challenges fall to file, strings and the browser, so exhaust those first. Our category guide explains what each track tests, and how to write a writeup turns your notes into something others learn from. Only use these tools against systems you are authorized to test.
Plan your next event with us
A free jeopardy event for up to 50 players goes live when you publish it. For flagship events, our team can build the challenges and run the managed formats: attack-defense, King of the Hill and SOC simulations.
