Tools
Free online security tools for CTF players and penetration testers.
Use only on systems you own or have explicit permission to test.
Nmap Service Suggestor
Open →Paste your Nmap output and get matching service pages instantly. Identifies open ports and links them to relevant attack techniques and service documentation.
Command Injection Bypass Generator
Open →Paste a regex filter and a command — get payloads that bypass it. Supports Linux and Windows, blacklist and whitelist filters, and regex from Python, JavaScript, Go and more.
Hashcat Rule Builder
Open →Build Hashcat rules visually. Chain transformations step by step, preview results against a test wordlist, and download as .rule or John the Ripper .conf.
Hashcat to John Rule Converter
Open →Paste Hashcat rules and download a ready-to-use John the Ripper config file. Wraps rules with hashcat logic mode so John can run them directly.
SOAP WSDL to Actions Generator
Open →Paste raw WSDL XML and get ready-to-use SOAP envelopes and curl commands for every operation. Extracts endpoints, namespaces, parameters and SOAPAction headers automatically.
Laravel Cookie Forge & Decoder
Open →Decode and verify Laravel AES encrypted cookies using the APP_KEY. Reveals the session payload, checks the HMAC signature, and lets you forge new valid signed cookies.
Flask Cookie Forge & Decoder
Open →Decode Flask itsdangerous session cookies without a key to read the JSON payload. Verify the HMAC-SHA1/SHA512 signature with the SECRET_KEY and forge new valid signed cookies for session manipulation in CTF web challenges.
About these tools
These tools are built for CTF (Capture The Flag) competitions and authorised penetration testing. They run entirely server-side — no input is stored or executed. Each tool is designed to save time on repetitive analysis tasks during engagements.
Nmap Service Suggestor
Parses the PORT/STATE/SERVICE/VERSION table from raw Nmap output and matches each open port to relevant service pages — attack techniques, enumeration methods and exploit resources.
Command Injection Bypass Generator
Generates obfuscated command injection payloads — base64, hex, xxd, ANSI-C quoting, IFS tricks, variable concatenation, wildcards, caret obfuscation, PowerShell encoding — and filters them against your regex to show only working bypasses.
Hashcat to John Rule Converter
Wraps Hashcat rules in a John the Ripper config file using the hashcat logic ON/OFF directive. Paste rules, pick a ruleset name, preview the output, and download the .conf file ready for --config and --rules flags.
SOAP WSDL to Actions Generator
Parses raw WSDL XML to extract every operation, its parameters and SOAPAction header, then generates complete SOAP envelopes and ready-to-run curl commands. Useful when attacking SOAP web services in CTF challenges or authorised penetration tests.
Laravel Cookie Forge & Decoder
Decrypts Laravel AES encrypted cookies using the APP_KEY, verifies the HMAC-SHA256 signature, and reveals the session payload. Also forges new valid signed cookies — useful for session hijacking and privilege escalation in CTF web challenges.
Flask Cookie Forge & Decoder
Decodes Flask itsdangerous session cookies to reveal the JSON payload without a key. Verifies the HMAC-SHA1 or HMAC-SHA512 signature with the SECRET_KEY and forges new valid signed cookies — essential for session manipulation in CTF Flask challenges.