CTF Web Tools
Webové nástroje pre CTF, forensics a lab — bez inštalácie. Použi ich na rýchly decode, lookup alebo callback. Postup s príkazmi nájdeš v tematických cheatsheetoch nižšie.
Obsah
- Rýchly výber
- Univerzálne
- OSINT & recon
- Web exploitation
- Kryptografia
- Forensics & súbory
- Steganografia & médiá
- Sieť & PCAP
- Reverse engineering & binary
- Payloady, shelly & OOB
- Hash & heslá
- Active Directory & privesc
- TLS, certifikáty & PKI
- Encoding & utility
- Tréning & writeupy
Súkromie: neuploaduj flagy, reálne heslá ani klientske dáta na cudzie servery, ak neberieš riziko.
Rýchly výber
| Vidíš / potrebuješ | Otvor najprv |
|---|---|
| Neznámy reťazec alebo formát súboru | CyberChef, Boxentriq |
| JWT / web token | jwt.io |
| Blind SSRF / XSS / XXE callback | Webhook.site, Interactsh |
| Hash lookup (MD5/SHA) | CrackStation, hashes.com |
| Stego v obrázku / audio | Aperi’Solve |
RSA malé n |
factordb, Alpertron ECM |
| PEM / TLS cert | SSL Shopper — Cert Decoder |
| Reverse shell one-liner | RevShells |
| Doména / subdomény | DNSDumpster, Shodan |
| Binary / porovnanie decompilerov | Dogbolt |
Súvisiace cheatsheety: [Cryptography](/cheatsheets/kryptografia/) · [Wireshark CTF](/cheatsheets/wireshark-cheatsheet-ctf-forensics/) · [OSCP Enumeration](/cheatsheets/oscp-htb-enumeration/) · [Offensive Playbook](/cheatsheets/offensive-playbook-penetration/)
Univerzálne
| Nástroj | URL | Na čo |
|---|---|---|
| CyberChef | gchq.github.io/CyberChef | Encoding, XOR, AES, gzip, regex pipeline |
| Boxentriq | boxentriq.com | Detekcia formátu, CTF hub, Morse, Vigenère, binary |
| dCode | dcode.fr | Šifry, encoding, hash, auto-identifikácia |
| IT-Tools | it-tools.tech | Base64, hash, JWT, UUID, chmod, regex |
| emn178 online tools | emn178.github.io | Hash, AES/DES/RSA, hex/Base64 |
| Regex101 | regex101.com | Test regex na logoch a extrahovanom texte |
OSINT & recon
| Nástroj | URL | Na čo |
|---|---|---|
| Shodan | shodan.io | Exponované porty, bannery, IoT |
| Censys | censys.io | Certifikáty, hosty, attack surface |
| DNSDumpster | dnsdumpster.com | DNS mapa, subdomény |
| ViewDNS | viewdns.info | Reverse DNS, IP nástroje |
| Robtex | robtex.com | DNS / IP / ASN |
| BGP.he.net | bgp.he.net | ASN a IP rozsahy |
| urlscan.io | urlscan.io | Requesty stránky, JS, screenshoty |
| Wayback Machine | web.archive.org | Staré verzie webu, skryté cesty |
| BuiltWith | builtwith.com | Technológie na webe |
| Netcraft Site Report | sitereport.netcraft.com | Hosting, TLS, história |
| MXToolbox | mxtoolbox.com | DNS, SMTP, blacklist |
| ipinfo.io | ipinfo.io | Geo, ASN pre IP |
| VirusTotal | virustotal.com | Reputácia URL/domény/súboru |
| ICANN Lookup | lookup.icann.org | WHOIS |
Web exploitation
| Nástroj | URL | Na čo |
|---|---|---|
| JWT.io | jwt.io | Dekód a úprava JWT header/payload |
| jwt.ms | jwt.ms | Microsoft JWT debugger |
| Webhook.site | webhook.site | Zachytávanie HTTP callbackov (SSRF, blind XSS) |
| Interactsh | app.interactsh.com | OOB DNS/HTTP pre blind zraniteľnosti |
| Pipedream RequestBin | pipedream.com/requestbin | Zachytávanie HTTP requestov |
| PHP filter chain generator | GitHub — Synacktiv | LFI → RCE filter chains (CLI) |
| PortSwigger Web Security Academy | portswigger.net/web-security | Lab + vysvetlenia |
| HackTricks — Web | book.hacktricks.wiki | Referencia techník |
Lokálne (nie web): Burp Suite, ffuf, sqlmap, nuclei, feroxbuster
Kryptografia
Celý postup a príkazy → [Cryptography cheatsheet](/cheatsheets/kryptografia/)
| Nástroj | URL | Na čo |
|---|---|---|
| CyberChef | gchq.github.io/CyberChef | Encoding, XOR, AES, vrstvené recepty |
| CrackStation | crackstation.net | MD5/SHA1/SHA256 wordlist lookup |
| hashes.com | hashes.com | Hash lookup a submit |
| md5decrypt.net | md5decrypt.net | MD5/SHA lookup |
| factordb | factordb.com | Už faktorizované RSA moduly |
| Alpertron ECM | alpertron.com.ar/ECM.HTM | Faktorizácia čísel |
| SageMath Cell | sagecell.sagemath.org | factor(), CRT, mod inverse |
| quipqiup | quipqiup.com | Substitution cipher solver |
| dCode — Caesar | dcode.fr/caesar-cipher | ROT-N |
| dCode — Vigenère | dcode.fr/vigenere-cipher | Vigenère + Kasiski |
| Base64 Decode | base64decode.org | Base64 a súbory |
| cryptii | cryptii.com | Modulárne encoding pipes |
Lokálne: john, hashcat, hashid, RsaCtfTool, xortool
Forensics & súbory
| Nástroj | URL | Na čo |
|---|---|---|
| CyberChef | gchq.github.io/CyberChef | From Hex, Extract files, entropia |
| Aperi’Solve | aperisolve.com | Vrstvy obrázka, zsteg, steghide, exiftool |
| VirusTotal | virustotal.com | Hash lookup, upload súboru |
| Hybrid Analysis | hybrid-analysis.com | Sandbox reporty |
| Malware Bazaar | bazaar.abuse.ch | Vzorky podľa hash/tag |
| URLhaus | urlhaus.abuse.ch | Malicious URL |
| Exif.tools | exif.tools | EXIF z obrázka |
| Boxentriq — Binary Analysis | boxentriq.com/analysis/binary-analysis | Hexdump, entropia, strings |
Lokálne: Wireshark, binwalk, foremost, strings, volatility
Steganografia & médiá
| Nástroj | URL | Na čo |
|---|---|---|
| Aperi’Solve | aperisolve.com | Hlavný CTF analyzátor obrázkov |
| Steganography Online | stylesuxx.github.io/steganography | LSB encode/decode PNG/GIF |
| FutureBoy Stego | futureboy.us/steganography | LSB decode |
| StegOnline | stegonline.georgeom.net | LSB, roviny, metadata |
| Boxentriq — Spectrogram | boxentriq.com/steganography/audio-spectrogram | Skryté dáta v audio |
| dCode — Steganography | dcode.fr/steganography | Prehľad metód |
Lokálne: zsteg, steghide, exiftool, Sonic Visualiser
Sieť & PCAP
| Nástroj | URL | Na čo |
|---|---|---|
| CyberChef | gchq.github.io/CyberChef | Dekód payloadov z exportu |
| SSL Shopper — Cert Decoder | sslshopper.com/certificate-decoder.html | Polia PEM certifikátu |
| SSL Labs | ssllabs.com/ssltest | Audit TLS konfigurácie |
| Malware-Traffic-Analysis | malware-traffic-analysis.net | Cvičné PCAP súbory |
Lokálne: Wireshark, tshark, tcpflow
Reverse engineering & binary
| Nástroj | URL | Na čo |
|---|---|---|
| Dogbolt | dogbolt.org | Porovnanie decompilerov naraz |
| RetDec | retdec.com | Online decompiler |
| Compiler Explorer | godbolt.org | C → assembly, pochopenie snippetov |
| libc.rip | libc.rip | Identifikácia verzie libc (pwn) |
| Exploit-DB | exploit-db.com | Verejné exploity |
| Shell-Storm shellcode | shell-storm.org/shellcode | Databáza shellcode |
Lokálne: Ghidra, radare2, gdb, pwntools, ROPgadget
Payloady, shelly & OOB
| Nástroj | URL | Na čo |
|---|---|---|
| RevShells | revshells.com | Reverse/bind shell one-linery |
| Webhook.site | webhook.site | Callback URL |
| Interactsh | app.interactsh.com | OOB DNS/HTTP |
| Canarytokens | canarytokens.org/generate | Tripwire tokeny |
Hash & heslá
| Nástroj | URL | Na čo |
|---|---|---|
| CrackStation | crackstation.net | Rýchly wordlist lookup |
| hashes.com | hashes.com | Lookup + crowd submit |
| md5decrypt.net | md5decrypt.net | MD5/SHA |
| dCode — Hash identifier | dcode.fr/hash-identifier | Odhad typu hashu |
| emn178 — Hash | emn178.github.io/online-tools/md5.html | Výpočet hashu z textu |
Lokálne: hashid, john, hashcat ($6$, bcrypt treba cracknúť offline)
Active Directory & privesc
| Nástroj | URL | Na čo |
|---|---|---|
| LOLBAS | lolbas-project.github.io | Windows LOLBins |
| GTFOBins | gtfobins.github.io | Zneužitie Unix binárok |
| WADComs | wadcoms.github.io | AD attack príkazy |
| HackTricks — AD | book.hacktricks.wiki | AD a lateral movement |
Lokálne: BloodHound, impacket, crackmapexec
TLS, certifikáty & PKI
| Nástroj | URL | Na čo |
|---|---|---|
| SSL Shopper — Cert Decoder | sslshopper.com/certificate-decoder.html | Dekód PEM certifikátu |
| SSL Shopper — CSR Decoder | sslshopper.com/csr-decoder.html | Dekód CSR |
| SSL Shopper — SSL Checker | sslshopper.com/ssl-checker.html | Kontrola inštalácie certu |
| SSL Labs | ssllabs.com/ssltest | TLS hodnotenie a config |
| Let’s Encrypt | letsencrypt.org | Bezplatná CA, PKI docs |
| Certbot | certbot.eff.org | ACME / príkazy na cert |
Encoding & utility
| Nástroj | URL | Na čo |
|---|---|---|
| Base64 Decode | base64decode.org | Base64 encode/decode, súbory |
| cryptii | cryptii.com | Pipe konverzie |
| Diffchecker | diffchecker.com | Porovnanie dvoch textov |
| JSON Formatter | jsonformatter.org | Pretty-print JSON |
Tréning & writeupy
| Zdroj | URL | Na čo |
|---|---|---|
| Hack The Box | hackthebox.com | Lab |
| TryHackMe | tryhackme.com | Guided lab |
| picoCTF | picoctf.org | CTF pre začiatočníkov |
| CTFtime | ctftime.org | Súťaže a writeupy |
| HackTricks | book.hacktricks.wiki | Encyklopédia techník |
| PayloadsAllTheThings | GitHub | Zbierky payloadov |