Install and Configure Essential CTF Competition Tools

Install and configure the most important CTF tools including pwntools, Burp Suite, Ghidra, Wireshark, John the Ripper, and more — organized by category.

Every CTF category demands a different toolkit, and hunting for installers mid-competition is a fast way to lose hours you could have spent on the actual challenges. This page walks you through installing and verifying the tools you’ll reach for most often, organized by category so you can set up only what you need or work through the whole page before a competition to arrive fully equipped.

All commands below assume you are working inside a dedicated Kali Linux or Parrot OS environment. If you haven’t set one up yet, see the Environment guide first. macOS alternatives are provided where available.

Web Exploitation

Web challenges involve SQL injection, cross-site scripting, authentication bypasses, server-side template injection, and more. These four tools cover the vast majority of what you’ll need.

Linux

apt

# Burp Suite Community Edition
sudo apt install -y burpsuite

# sqlmap — automated SQL injection and database takeover
sudo apt install -y sqlmap

# ffuf — fast web fuzzer for directories, parameters, and vhosts
sudo apt install -y ffuf

# curl — transfer data with URLs; indispensable for quick HTTP testing
sudo apt install -y curl

# sqlmap from source (latest version)
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git ~/tools/sqlmap
echo 'alias sqlmap="python3 ~/tools/sqlmap/sqlmap.py"' >> ~/.bashrc
source ~/.bashrc

# ffuf via Go (if apt version is outdated)
go install github.com/ffuf/ffuf/v2@latest

Verify the installs

burpsuite &          # launches the GUI
sqlmap --version     # sqlmap/1.8...
ffuf -V              # ffuf v2...
curl --version       # curl 8...

macOS

brew

# Burp Suite via Homebrew Cask
brew install --cask burp-suite

# sqlmap
brew install sqlmap

# ffuf
brew install ffuf

# curl (macOS ships curl; upgrade to the Homebrew version for latest features)
brew install curl
echo 'export PATH="$(brew --prefix curl)/bin:$PATH"' >> ~/.zshrc
source ~/.zshrc

# sqlmap from source
git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git ~/tools/sqlmap
echo 'alias sqlmap="python3 ~/tools/sqlmap/sqlmap.py"' >> ~/.zshrc
source ~/.zshrc

Configure Burp Suite’s built-in browser proxy on 127.0.0.1:8080 and install the Burp CA certificate in your browser once — it will intercept all HTTPS traffic without certificate errors for every future challenge.

---

Cryptography

Crypto challenges range from classical ciphers to modern RSA and elliptic-curve attacks. You’ll need both command-line utilities and Python libraries.

Linux

apt

# openssl — Swiss Army knife for TLS, certificates, and classical crypto ops
sudo apt install -y openssl

# SageMath — mathematics software system used heavily for number-theory attacks
sudo apt install -y sagemath

# pycryptodome — drop-in replacement for PyCrypto with modern cipher support
pip3 install pycryptodome

# RsaCtfTool — automates common RSA attacks (small exponent, Wiener, Fermat, etc.)
git clone https://github.com/RsaCtfTool/RsaCtfTool.git ~/tools/RsaCtfTool
pip3 install -r ~/tools/RsaCtfTool/requirements.txt
echo 'alias RsaCtfTool="python3 ~/tools/RsaCtfTool/RsaCtfTool.py"' >> ~/.bashrc
source ~/.bashrc

Verify the installs

openssl version                          # OpenSSL 3.x...
sage --version                           # SageMath version 10.x...
python3 -c "from Crypto.Cipher import AES; print('pycryptodome OK')"
RsaCtfTool --help | head -5

macOS

brew

# openssl
brew install openssl
echo 'export PATH="$(brew --prefix openssl)/bin:$PATH"' >> ~/.zshrc
source ~/.zshrc

# SageMath
brew install --cask sage

pip3 install pycryptodome

git clone https://github.com/RsaCtfTool/RsaCtfTool.git ~/tools/RsaCtfTool
pip3 install -r ~/tools/RsaCtfTool/requirements.txt

When should I use SageMath vs plain Python?

Reach for SageMath whenever a challenge involves modular arithmetic, polynomial rings, lattice reduction (LLL), elliptic curves, or factoring large integers. Its built-in factor(), discrete_log(), and Matrix types save you from implementing textbook algorithms from scratch. For everything else — XOR bruteforcing, base64 gymnastics, padding oracle attacks — plain Python with pycryptodome is faster to write and run.

---

Binary Exploitation

Pwn challenges require you to understand memory layout, craft shellcode, and automate exploit development. This category has the steepest tooling setup, so take your time.

Linux

pip

# pwntools — the core exploit development framework
pip3 install pwntools

# GDB — the GNU debugger; essential for stepping through binaries
sudo apt install -y gdb

# pwndbg — modern GDB plugin with heap visualization and pwntools integration
git clone https://github.com/pwndbg/pwndbg.git ~/tools/pwndbg
cd ~/tools/pwndbg && ./setup.sh

# checksec — reports binary protections (NX, PIE, stack canaries, RELRO)
sudo apt install -y checksec

# ROPgadget — finds ROP gadgets inside binaries for return-oriented programming
pip3 install ROPgadget

# patchelf — modifies ELF binaries to use specific libc versions
sudo apt install -y patchelf

Install PEDA as an alternative GDB plugin (optional)

git clone https://github.com/longld/peda.git ~/tools/peda
echo "source ~/tools/peda/peda.py" >> ~/.gdbinit

pwndbg and PEDA cannot be active at the same time. If you installed pwndbg via its setup script it already wrote to ~/.gdbinit. Comment out one or the other depending on which you prefer for a given session.

macOS

pip

pip3 install pwntools
pip3 install ROPgadget

# macOS ships LLDB rather than GDB; install GDB via Homebrew
brew install gdb

# Code-sign GDB so it can attach to processes (macOS requirement)
# Follow: https://sourceware.org/gdb/wiki/PermissionsDarwin

brew install patchelf

pwntools on macOS has limited support for process spawning and some remote-connection features. If you’re working on binary exploitation challenges, a Linux VM or Docker container will save you significant debugging headaches.

Verify pwntools is working

Run the following snippet to confirm pwntools is installed correctly and can perform basic operations:

#!/usr/bin/env python3
import pwnlib
from pwn import *

# Check the version
print(f"pwntools version: {pwnlib.__version__}")

# Pack and unpack integers (little-endian 64-bit)
value = 0xdeadbeefcafebabe
packed = p64(value)
unpacked = u64(packed)
assert unpacked == value, "p64/u64 round-trip failed"
print(f"p64/u64 round-trip: OK  ({hex(unpacked)})")

# Assemble a NOP sled and check its length
nop_sled = asm("nop") * 16
assert len(nop_sled) == 16, "asm() failed"
print(f"asm() NOP sled: OK  ({len(nop_sled)} bytes)")

# Demonstrate cyclic pattern generation
pattern = cyclic(64)
offset = cyclic_find(pattern[32:36])
assert offset == 32, "cyclic_find failed"
print(f"cyclic_find: OK  (offset {offset})")

print("\nAll pwntools checks passed.")

python3 verify_pwntools.py
# pwntools version: 4.x.x
# p64/u64 round-trip: OK  (0xdeadbeefcafebabe)
# asm() NOP sled: OK  (16 bytes)
# cyclic_find: OK  (offset 32)
# All pwntools checks passed.

---

Reverse Engineering

Reverse engineering (RE) challenges ask you to analyse compiled binaries, firmware, or bytecode to understand what a program does and extract flags hidden in its logic. Ghidra is the de facto open-source tool for this work.

Linux

Install Ghidra

Ghidra requires Java 17 or later. Install the JDK first, then download and extract Ghidra from the official NSA GitHub releases page.

apt

# Install Java 17 JDK
sudo apt install -y openjdk-17-jdk

manual

# Download the latest Ghidra release (check https://github.com/NationalSecurityAgency/ghidra/releases)
wget https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_11.1.2_build/ghidra_11.1.2_PUBLIC_20240709.zip
unzip ghidra_11.1.2_PUBLIC_20240709.zip -d ~/tools/
ln -s ~/tools/ghidra_11.1.2_PUBLIC/ghidraRun ~/bin/ghidra

# Launch Ghidra
ghidra

When you open a binary in Ghidra for the first time, let the auto-analysis run to completion before exploring. It resolves function signatures, identifies strings, and marks up cross-references — saving you significant manual effort.

macOS

brew

# Install Java 17 JDK
brew install openjdk@17

# Install Ghidra
brew install --cask ghidra

# Launch Ghidra
ghidra

Useful Ghidra workflow for CTF RE challenges

# 1. Identify the binary type before opening in Ghidra
file challenge_binary
# challenge_binary: ELF 64-bit LSB executable, x86-64, stripped

# 2. Check security mitigations
checksec --file=challenge_binary

# 3. Find interesting strings before full decompilation
strings -n 8 challenge_binary | grep -i "flag\|ctf\|key\|pass"

---

Password Cracking

Password cracking challenges present you with hashed credentials or encrypted archives. John the Ripper and Hashcat are the two most widely used tools — John excels at versatility and format auto-detection, while Hashcat leverages GPU acceleration for speed.

Linux

apt

# John the Ripper (community jumbo build with extra format support)
sudo apt install -y john

# Hashcat — GPU-accelerated password recovery
sudo apt install -y hashcat

# Build John the Ripper jumbo from source for the latest formats
sudo apt install -y build-essential libssl-dev
git clone https://github.com/openwall/john.git ~/tools/john
cd ~/tools/john/src && ./configure && make -s clean && make -sj4
echo 'export PATH="$HOME/tools/john/run:$PATH"' >> ~/.bashrc
source ~/.bashrc

Verify the installs

john --list=formats | head -5     # lists supported hash formats
hashcat --version                 # hashcat v6.x.x

Common cracking one-liners

# Identify a hash type before cracking
john --list=formats | grep -i md5

# Crack an MD5 hash with rockyou
echo "5f4dcc3b5aa765d61d8327deb882cf99" > hash.txt
john --format=raw-md5 --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

# Extract and crack a ZIP password with zip2john
zip2john protected.zip > zip_hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt zip_hash.txt

# GPU-accelerated MD5 cracking with Hashcat
hashcat -m 0 -a 0 hash.txt /usr/share/wordlists/rockyou.txt

On a fresh Kali install the rockyou wordlist is compressed. Decompress it once with sudo gunzip /usr/share/wordlists/rockyou.txt.gz before use.

macOS

brew

# John the Ripper
brew install john-jumbo

# Hashcat
brew install hashcat

john --list=formats | head -5
hashcat --version

Hashcat GPU acceleration on macOS uses Metal rather than CUDA. Performance is significantly lower than a dedicated NVIDIA GPU. For serious cracking workloads, use a Linux machine with a discrete GPU or a cloud cracking instance.

---

Forensics

Forensics challenges hand you disk images, packet captures, steganography puzzles, and memory dumps. The tools below let you extract, analyze, and reconstruct hidden data.

Linux

apt

# Wireshark — GUI and CLI (tshark) packet analysis
sudo apt install -y wireshark tshark

# Autopsy — GUI digital forensics platform built on Sleuth Kit
sudo apt install -y autopsy

# binwalk — firmware and binary file analysis; extracts embedded files
sudo apt install -y binwalk

# steghide — hide and extract data from JPEG/BMP/WAV/AU files
sudo apt install -y steghide

# exiftool — read and write EXIF metadata in images and documents
sudo apt install -y libimage-exiftool-perl

# foremost — carve files from raw disk images based on headers
sudo apt install -y foremost

# volatility3 — memory forensics framework
pip3 install volatility3

Useful one-liners to get started

# Extract all embedded files from a firmware blob
binwalk -e --run-as=root firmware.bin

# Carve files from a raw disk image
foremost -i disk.img -o carved_output/

# Extract hidden data from a JPEG (prompts for passphrase)
steghide extract -sf suspicious.jpg

# Dump all metadata from an image
exiftool photo.png

# Filter HTTP traffic from a pcap on the command line
tshark -r capture.pcapng -Y "http" -T fields \
  -e http.request.method \
  -e http.request.uri \
  -e http.response.code

macOS

brew

brew install --cask wireshark
brew install binwalk
brew install steghide
brew install exiftool
brew install foremost
pip3 install volatility3

Autopsy does not have an official Homebrew formula. On macOS, download the installer directly from sleuthkit.org/autopsy.

---

General Utilities

These tools are small, fast, and universally useful across every CTF category. Most are already present in Kali or Parrot OS — install any that are missing.

Linux

apt

# python3 and pip
sudo apt install -y python3 python3-pip

# file — identifies file types by magic bytes
sudo apt install -y file

# strings — extracts printable strings from binary files
sudo apt install -y binutils   # strings ships with binutils

# xxd — creates hex dumps; also converts hex back to binary
sudo apt install -y xxd

# netcat — reads and writes data across TCP/UDP connections
sudo apt install -y netcat-openbsd

# git — you'll clone tools and write exploit scripts constantly
sudo apt install -y git

# Upgrade pip itself first
pip3 install --upgrade pip

# requests — HTTP library for scripting web challenges
pip3 install requests

# z3-solver — Microsoft's theorem prover; useful for constraint-solving challenges
pip3 install z3-solver

CyberChef — CyberChef is a browser-based tool for encoding, decoding, hashing, and transforming data without installing anything. Bookmark the hosted version at gchq.github.io/CyberChef, or run it locally:

# Serve CyberChef locally from a cloned copy
git clone https://github.com/gchq/CyberChef.git ~/tools/CyberChef
cd ~/tools/CyberChef
python3 -m http.server 8888
# Open http://localhost:8888/src/index.html

macOS

brew

brew install python3
brew install file
brew install binutils     # provides strings, nm, objdump
brew install netcat
brew install git
brew install xxd

pip3 install --upgrade pip
pip3 install requests z3-solver

Quick sanity checks for general utilities

# Identify a mystery file
file /bin/ls
# /bin/ls: ELF 64-bit LSB pie executable, x86-64, ...

# Dump printable strings from a binary (show strings longer than 8 chars)
strings -n 8 suspicious_binary | head -20

# Create a hex dump of the first 64 bytes of a file
xxd -l 64 suspicious_binary

# Solve a quick constraint with z3 from the command line
python3 -c "
from z3 import *
x = Int('x')
s = Solver()
s.add(x * 7 == 42)
print(s.check(), s.model())
# sat [x = 6]
"

---

Full installation script

If you want to set up every tool in one shot on a fresh Kali or Parrot OS install, save the following as install_ctf_tools.sh and run it as a user with sudo privileges.

#!/usr/bin/env bash
set -euo pipefail

echo "[*] Updating package lists..."
sudo apt update

echo "[*] Installing apt packages..."
sudo apt install -y \
  burpsuite sqlmap ffuf curl \
  openssl sagemath \
  gdb checksec patchelf binutils \
  openjdk-17-jdk john hashcat \
  wireshark tshark autopsy binwalk steghide libimage-exiftool-perl foremost \
  python3 python3-pip netcat-openbsd git xxd

echo "[*] Installing Python packages..."
pip3 install --upgrade pip
pip3 install pwntools pycryptodome ROPgadget volatility3 requests z3-solver

echo "[*] Cloning pwndbg..."
if [ ! -d "$HOME/tools/pwndbg" ]; then
  git clone https://github.com/pwndbg/pwndbg.git "$HOME/tools/pwndbg"
  cd "$HOME/tools/pwndbg" && ./setup.sh
fi

echo "[*] Cloning RsaCtfTool..."
if [ ! -d "$HOME/tools/RsaCtfTool" ]; then
  git clone https://github.com/RsaCtfTool/RsaCtfTool.git "$HOME/tools/RsaCtfTool"
  pip3 install -r "$HOME/tools/RsaCtfTool/requirements.txt"
  echo 'alias RsaCtfTool="python3 '"$HOME"'/tools/RsaCtfTool/RsaCtfTool.py"' >> "$HOME/.bashrc"
fi

echo "[*] Cloning sqlmap (latest)..."
if [ ! -d "$HOME/tools/sqlmap" ]; then
  git clone --depth 1 https://github.com/sqlmapproject/sqlmap.git "$HOME/tools/sqlmap"
fi

echo ""
echo "[+] All tools installed successfully. Restart your shell or run:"
echo "    source ~/.bashrc"

chmod +x install_ctf_tools.sh
./install_ctf_tools.sh

Review any script before running it with elevated privileges. Read through install_ctf_tools.sh and adjust the tool list for your competition category before executing — there is no reason to install Autopsy and Volatility if you’re only doing web and crypto challenges.