Get all CTF tools installed with a single command using DPM.
You need Linux, macOS, or a Linux VM on Windows (e.g. VirtualBox). DPM does not run on Windows natively.
Run this in your terminal.
Want to see what DPM does before committing? Run dpm bubble first — it creates a temporary environment where you can try things out. Everything disappears when you exit.
This installs all the tools you'll need for the event. Version-pinned, verified, ready to go.
Everything is installed. Below are starting checklists and tool hints for each category.
Using YouTube to learn the tools is encouraged. A short tutorial video often gets you up and running faster than reading the docs — search for the tool name plus tutorial or CTF.
These are not challenge hints. They are first steps for each category: how to inspect what you were given, pick tools, and avoid random guessing.
file to check what it really is.strings and check metadata with exiftool.binwalk.checksec.file, strings, and symbols to learn what kind of binary it is.dpm list if you are unsure what tools are available.Open these only if you have tried the category checklist and still do not know where to begin. These are starter hints, not walkthroughs.
Try common encodings first. After the first readable result, the title may describe the next movement.
Identify the symbol alphabet or cipher family first. The text you get may still have one classic lock left.
Is there a way to communicate with only short and long signals? The gaps matter too: they separate pieces of the message.
Line breaks are meaningful. For short versus long, think about how the words are spoken, not only written.
The map may carry more than visible pixels. Inspect metadata, then consider file-carving tools such as binwalk.
Good tools: exiftool, binwalk
Images can carry readable data beyond pixels. A simple file inspection command may be enough.
Good tools: strings, exiftool
When many files look alike, compare their properties and look for the one that does not match the pattern.
Start by identifying protocols. Useful files and key material may be split across different conversations.
Good tools: tshark, Wireshark
The title points to which bits are worth inspecting. Try viewing image bit planes or LSB data.
Start with metadata. If you extract something that is still locked, switch to archive and wordlist tools.
Good tools: exiftool, binwalk, john
For audio stego, listening is only one view. Try looking at the sound over frequency and time.
This calculator evaluates Python, not only arithmetic. After code execution, inspect the environment like a small Linux box.
Compare what the filter blocks with what Python can still execute without using those blocked syntax nodes.
All provided files are pieces of one larger image. Use visual alignment instead of hidden-byte tools.
Start by identifying protocols and conversations in the capture. Look for transferred payloads or unusual data.
Good tools: tshark, Wireshark
The exact amount of cargo matters. Compare input length, reserved space, and what pressing Enter sends.
Good tools: gdb, pwntools
Check how the program reads your name. Inspect symbols before assuming you need shellcode.
Good tools: gdb, pwntools, ghidraRun
If the right choice still refuses to open the lock, inspect the branch that decides whether the lock opens.
Good tools: ghidraRun, gdb, radare2
Look at the integer array and how each value is transformed before printing.
Good tools: strings, ghidraRun
Treat the tracking ID as something the database might interpret. Error messages can be useful evidence.
Good tools: browser DevTools
After logging in, pay attention to how documents are identified and whether ownership is checked.
Good tools: browser DevTools
The file viewer receives a filename from the URL. Think carefully about what can count as a filename.
Good tools: browser DevTools
The preview request is made by the server, not your browser. Start from the internal status page and follow clues.
Good tools: browser DevTools
Client-side JavaScript controls most of the behavior. Inspect state and attributes with browser DevTools.
Good tools: browser DevTools
Compare stable landmarks across the images. Once you know the area, nearby map features can narrow the exact place.
The first page is not the end. Follow connected usernames and remember that the internet can preserve old pages.
Good tools: sherlock, browser
Identify the exact branch or location, not only the brand. The timestamp is visible in the scene.
The filenames are part of the puzzle. Identify all three viewpoints, then think geometrically.
Use transport and road details before searching hotel names. The correct name may have changed.
Identify the city and park first. These lanterns are tied to a public design project, and only named people count.
Once you know what kind of problem you are looking at, these tools can help with the actual inspection and solving.
Hash cracking, cipher analysis, and encoded data. You might need to identify hash types or brute-force weak keys.
GPU-accelerated hash cracker. Identify the hash type first, then pick the right mode.
hashcat -m 0 -a 0 hash.txt /usr/share/wordlists/rockyou.txt
Versatile password cracker. Good at auto-detecting hash formats.
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
Packet captures, file carving, and hidden data in files. Look at what's inside, not just at the surface.
Wireshark on the command line. Filter and inspect packet captures.
tshark -r capture.pcap -Y "http.request"
Scans files for embedded data and extracts hidden content.
binwalk -e suspicious_file.bin
Reads all metadata from a file. Check for comments, GPS data, hidden fields.
exiftool image.jpg
Data hidden in images, audio, or other media. Metadata and embedded content are worth checking.
Start here — metadata often reveals what's been embedded or modified.
exiftool -v2 image.png
Scans for files hidden inside other files — archives, images, data appended after EOF.
binwalk --signature image.png
Binary exploitation. Analyze the binary, find the vulnerability, write the exploit.
Step through execution, inspect memory, set breakpoints. Essential for understanding what a binary does.
gdb ./challenge
Python library for writing exploits. Handles connections, packing, shellcode.
from pwn import *; p = remote('host', 1337)
Decompiler with a GUI. Import a binary and read the decompiled C output to understand the logic.
ghidraRun
CLI disassembler and debugger. Fast for quick analysis when you don't need a full GUI.
r2 -A ./challenge
Compiled programs, hidden checks, patching, and data transformations. Understand what the program does before changing it.
Decompiler with a GUI. Good for finding checks, branches, constants, and hidden functions.
ghidraRun
CLI disassembler and patching tool. Useful when you want to inspect or change a small branch.
r2 -Aw ./challenge
Web application vulnerabilities. Inspect requests, test inputs, look at what the server reveals.
Scan for open ports and services. Useful for recon before attacking a web target.
nmap -sV -sC target-ip
Open-source intelligence. Metadata in files can reveal more than you'd expect, and a username often turns up across the rest of the internet.
Check GPS coordinates, author info, software used, timestamps — anything the creator left behind.
exiftool -G -a photo.jpg
Hunts a username across hundreds of social platforms. Useful when a challenge gives you a handle and asks where else the person shows up.
sherlock username
Anything goes. The right tool depends on the challenge — explore what you have available.
Run dpm list to see everything installed. Sometimes the answer is a tool you didn't expect to need.
Some challenges are easier to solve in the browser. These are worth bookmarking.
Encode, decode, encrypt, compress, and transform data — drag and drop operations into a chain.
Online hash lookup. Paste a hash and check if it's already been cracked.
Cipher identifier and solver. Handles Caesar, Vigenere, substitution, and many more.
Browser-based hex editor. Useful for inspecting and patching file headers.
Upload an image and run multiple stego analysis tools at once — zsteg, steghide, exiftool, binwalk and more.
dpm list — see what's installeddpm update — check for tool updatesdpm doctor — diagnose issuesdpm bubble — disposable environment for experimentingHelp us improve DPM — it takes less than two minutes. Your feedback is anonymous.
Give feedback →