Resources
Study material, practice platforms and the tools we use in CTFs.
Security+ (SY0-701)
What most members use to pass. Watch Messer for the concepts, then drill practice questions until the weak domains stop being weak.
- Professor Messer (opens in a new tab)FreeA complete free video course that follows the exam objectives in order, plus monthly live study groups.
- Dion Training (opens in a new tab)PaidJason Dion's video course and full-length practice exams; the practice exams are close to the real thing.
- Sybex Study Guide (opens in a new tab)BookCompTIA Security+ Study Guide by Mike Chapple and David Seidl: the whole syllabus in book form, with review questions per chapter.
- Sybex Practice Tests (opens in a new tab)BookCompTIA Security+ Practice Tests by David Seidl: around a thousand questions organised by domain.
- CompTIA exam objectives (opens in a new tab)FreeThe official list of everything the exam can ask. Use it as a checklist.
Platforms
Where to practise. Start with TryHackMe if you are new.
TryHackMe (opens in a new tab)
Start hereThe best place to start. Guided rooms explain each concept and then give you a browser-based machine to try it on, so there is nothing to install.
Recommended path · Cyber Security 101 (opens in a new tab): The learning path we recommend to every new member: networking, Linux, Windows, web, cryptography and the core tools, in order.
- Udemy (opens in a new tab)PaidVideo courses and Security+ practice exam sets. Wait for a sale; courses drop to around $15 most weeks.
- Hack The Box (opens in a new tab)Free tierFull machines to break into: enumerate the network, exploit a service, escalate to root.
- CyLabs (opens in a new tab)FreeCarnegie Mellon's CTF platform, formerly picoCTF. Short challenges in every category, good for building general CTF skills.
CTF tools: websites
Nothing to install. Keep these open in another tab.
- CyberChef (opens in a new tab)Chain decoding, encoding, hashing and conversions in a drag-and-drop recipe. The Magic operation guesses the encoding for you.
- dCode (opens in a new tab)Identifiers and solvers for hundreds of classical ciphers and encodings.
- Hashes.com (opens in a new tab)Identify a hash type and look it up against a large database of cracked hashes.
- CrackStation (opens in a new tab)Looks up unsalted hashes against huge precomputed tables.
- Aperi'Solve (opens in a new tab)Upload an image and it runs the common steganography tools (zsteg, steghide, binwalk, exiftool) at once.
- HexEd.it (opens in a new tab)A hex editor in the browser, for inspecting and fixing file headers and raw bytes.
- RevShells (opens in a new tab)Generates reverse shell one-liners for your IP and port, in every language and shell.
- Exploit-DB (opens in a new tab)A searchable archive of public exploits, indexed by software and CVE.
CTF tools: software
Installed locally. Most come preinstalled on Kali Linux.
- Nmap (opens in a new tab)Scans a host or network for open ports and identifies the services and versions behind them.
- Gobuster (opens in a new tab)Brute-forces directories, files, DNS subdomains and virtual hosts from a wordlist.
- ffuf (opens in a new tab)A fast web fuzzer: put FUZZ anywhere in a request (path, parameter, header) and it tries every word in a list.
- sqlmap (opens in a new tab)Detects and exploits SQL injection automatically, from finding the bug to dumping the database.
- Burp Suite Community (opens in a new tab)A proxy that intercepts, edits and replays the HTTP requests your browser sends.
- Hydra (opens in a new tab)Brute-forces logins over SSH, FTP, HTTP forms and dozens of other protocols.
- John the Ripper / Hashcat (opens in a new tab)Offline password crackers for hashes, zip files, SSH keys and more.
- Ghidra (opens in a new tab)A free reverse engineering suite that disassembles binaries and decompiles them to readable C.
- Binary Ninja (opens in a new tab)A reverse engineering platform with a cleaner interface than Ghidra; the free version covers most CTF binaries.
- pwntools (opens in a new tab)A Python library for writing exploits: talking to processes and sockets, packing addresses, building ROP chains.
- ExifTool (opens in a new tab)Reads and edits the metadata hidden in images, documents and media files.
- Binwalk (opens in a new tab)Finds and extracts files embedded inside other files and firmware images.
- Wireshark (opens in a new tab)Opens packet captures and lets you filter, follow streams and extract transferred files.
- CherryTree (opens in a new tab)A hierarchical note-taking app; keep one tree per box or CTF with commands, creds and screenshots.
Stuck, or know a tool that belongs here? Ask in Discord (opens in a new tab).