ctf-tool-selection

name	ctf-tool-selection
description	Select established CTF and security-research tools for authorized artifact triage, web inspection, reversing, crypto, forensics, networking, and exploit validation. Use when a user provides a CTF-style tool catalog, asks which tools to use, or needs safe usage instructions for common offensive/security tools.

CTF Tool Selection

Use this skill to translate a broad CTF tool list into safe, scoped, evidence-producing workflows. Prefer well-known, maintained tools with reproducible CLI output. Treat old "awesome list" entries as leads, not installation instructions.

Handoffs: Use web-inspection-forensics for web, URL, HAR, log, JS bundle, and PCAP triage. Use reverse-engineering-analysis for binaries, firmware, mobile apps, WebAssembly, and decompilation. Use exploitation-sandbox for active validation only after explicit authorization.

Selection Rules

1. Start passive: decode, inspect, inventory, decompile, parse captures, and summarize Evidence before probing a live Target.
2. Prefer current upstream projects, distro packages, or pinned container images. Avoid random mirrors, abandoned binaries, and browser extensions from unknown publishers.
3. Record provenance for every tool: version, install source, command, input hash, output hash, timestamp, exit code, and timeout.
4. Use a Workspace Container for unknown artifacts, password cracking, dynamic instrumentation, exploit frameworks, fuzzers, scanners, and any tool that runs untrusted code.
5. Gate active tools behind approvals: scanners, brute-forcers, exploit modules, MITM, packet injection, credential tests, browser mutation, downloads, writes, and high-rate requests.
6. Stop when the tool has produced sufficient Evidence. Do not keep escalating because a tool supports a more aggressive mode.

Default Tool Choices

Task	Prefer	Use Carefully / Notes
Data decoding and crypto puzzles	CyberChef, Python, openssl, xxd, base64, hashid, RsaCtfTool, hash_extender, xortool	Online decoders may expose secrets; prefer local CyberChef or CLI for sensitive artifacts.
Web proxying and manual inspection	Burp Suite Community/Pro, OWASP ZAP, mitmproxy, browser DevTools, Postman/Insomnia, httpie/xh	Manual browsing is safer than automated attack mode. Authenticated and mutating flows need scope confirmation.
Web discovery	katana, hakrawler, gau, waybackurls, ffuf, feroxbuster, gobuster, httpx, whatweb, nuclei templates for passive/low-impact checks	Content discovery, nuclei, and fuzzing are active. Set host allowlists, low rates, small wordlists, and stop conditions.
Injection validation	Manual curl/curl_cffi, Burp Repeater/Intruder, sqlmap, Commix, XSSer	Automated exploitation requires explicit approval. Start with benign differential tests and lowest risk/level settings.
Network inventory	dig, host, openssl s_client, testssl.sh, nmap, Wireshark/tshark, Zeek	nmap is active. masscan and zmap are high-volume and should be avoided unless the user explicitly approves broad scanning and rate limits.
Password/hash recovery	John the Ripper Jumbo, hashcat, hashid, cewl, SecLists wordlists	Only against provided hashes or explicitly authorized accounts. Never run online credential attacks without durable approval.
File and disk forensics	file, stat, sha256sum, strings, exiftool, binwalk, foremost, bulk_extractor, sleuthkit, photorec, KAPE	Mount images read-only. Preserve original hashes and work on copies.
Memory and malware-style triage	Volatility 3, Rekall only for legacy cases, YARA, capa, FLOSS, REMnux/FLARE VM	Unknown samples stay offline in a VM/container. No internet access unless explicitly approved.
PCAP and traffic analysis	Wireshark, tshark, Zeek, NetworkMiner, tcpdump -r	Only analyze owned/provided captures. Redact credentials and session tokens from reports.
Steganography and media	exiftool, pngcheck, zsteg, stegsolve, stegseek/StegCracker, ImageMagick, Audacity, binwalk, foremost	Prefer local tools for sensitive images/audio. Brute forcing hidden data can be expensive; record dictionaries and limits.
Native reversing	Ghidra, IDA, Binary Ninja, radare2/Rizin/Cutter, GDB with pwndbg/GEF, RetDec, objdump, readelf, nm	Dynamic debugging and packed samples require isolation.
Mobile/JVM/.NET reversing	apktool, jadx, Androguard, Frida, Objection, ILSpy, dnSpyEx, dotPeek, CFR/FernFlower/Procyon	Runtime mobile instrumentation may affect devices/services; use test devices and scoped apps.
Exploit development in labs	pwntools, ROPgadget, ropper, one_gadget, GDB + pwndbg/GEF, checksec, Metasploit in a lab	Do not point exploit frameworks at live Targets without explicit technique-level approval.

Tool Triage From Old Catalogs

When a provided list contains many historical CTF tools, classify each entry before recommending it:

• Established default: actively maintained or still widely used, good docs, reproducible output, packageable. Examples: CyberChef, Burp Suite, OWASP ZAP, Nmap, Wireshark, Zeek, Ghidra, radare2/Rizin, pwntools, ROPgadget, John, hashcat, Volatility 3, apktool, jadx, Frida, binwalk, exiftool.
• Useful but narrow: good for one artifact class or challenge pattern. Examples: RsaCtfTool, hash_extender, xortool, zsteg, stegsolve, StegCracker/stegseek, pngcheck, one_gadget, angr, Triton, YARA, KAPE.
• Use only if needed: commercial, GUI-only, old but still useful, or replaced by safer defaults. Examples: IDA Pro, Binary Ninja, Hopper, Magnet AXIOM, CFF Explorer, NetworkMiner, OfflineRegistryView.
• Avoid by default: abandoned, broken-link, unknown provenance, high-risk, or superseded entries. Recommend a maintained replacement instead and note uncertainty.

Usage Patterns

Passive Web And API Review

mkdir -p evidence/{raw,normalized,stats}
curl -sSIL "$URL" > evidence/raw/headers.txt 2> evidence/raw/headers.err
whatweb --log-brief evidence/raw/whatweb.txt "$URL"
katana -u "$URL" -d 1 -silent > evidence/raw/urls.txt
sha256sum evidence/raw/* > evidence/stats/hashes.txt

Escalate to Burp/ZAP only after defining auth state and capture boundaries. Disable active scanning until approved.

Low-Risk Nmap Baseline

nmap -sT -Pn -p 80,443,8080 --max-retries 2 --host-timeout 60s "$HOST" \
  -oA evidence/raw/nmap-web

Full port scans, UDP scans, version scripts, NSE vulnerability scripts, masscan, and zmap need explicit approval and rate limits.

Artifact Forensics Baseline

sha256sum "$ARTIFACT" > evidence/stats/artifact.sha256
file "$ARTIFACT" | tee evidence/raw/file.txt
exiftool "$ARTIFACT" > evidence/raw/exiftool.txt 2> evidence/raw/exiftool.err
binwalk "$ARTIFACT" > evidence/raw/binwalk.txt 2> evidence/raw/binwalk.err
strings -a "$ARTIFACT" > evidence/raw/strings.txt

Extract only into a disposable folder. Do not execute extracted files on the host.

Password Or Hash Work

hashid hashes.txt | tee evidence/raw/hashid.txt
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt \
  --pot=evidence/raw/john.pot --session=project-hashes

Use only provided hashes or explicit authorization. Record wordlist, mask/rules, runtime, and hardware. Stop when the proof bar is met.

Binary Exploit Lab

checksec --file ./challenge > evidence/raw/checksec.txt
ROPgadget --binary ./challenge > evidence/raw/ropgadgets.txt
python3 - <<'PY'
from pwn import *
elf = context.binary = ELF("./challenge", checksec=False)
print(hex(elf.entry))
PY

Keep this local unless the Target scope explicitly allows remote exploit validation.

Output Shape

Return:

• Tool plan: chosen tools, why each fits, and tools intentionally avoided.
• Authorization state: passive-only or approved active scope, with rate limits and stop conditions.
• Commands: exact commands or GUI steps, with evidence paths and redaction notes.
• Expected Evidence: what each tool should prove or disprove.
• Fallbacks: maintained alternatives if a tool is unavailable, broken, commercial, or too risky.