## Tools

Free online security tools for CTF players and penetration testers.

Use only on systems you own or have explicit permission to test.

## [Nmap Service Suggestor](https://hackindex.io/tools/nmap-suggestor)

Open →

Paste your Nmap output and get matching service pages instantly. Identifies open ports and links them to relevant attack techniques and service documentation.

Nmap Port scanning Recon

## [Command Injection Bypass Generator](https://hackindex.io/tools/cmd-injection-bypass)

Open →

Paste a regex filter and a command — get payloads that bypass it. Supports Linux and Windows, blacklist and whitelist filters, and regex from Python, JavaScript, Go and more.

Command injection Regex bypass Linux Windows CTF

## [Hashcat Rule Builder](https://hackindex.io/tools/rule-builder)

Open →

Build Hashcat rules visually. Chain transformations step by step, preview results against a test wordlist, and download as .rule or John the Ripper .conf.

Hashcat Password cracking Rules John the Ripper

## [Hashcat to John Rule Converter](https://hackindex.io/tools/hashcat-to-john)

Open →

Paste Hashcat rules and download a ready-to-use John the Ripper config file. Wraps rules with hashcat logic mode so John can run them directly.

Hashcat John the Ripper Password cracking Rules

## [SOAP WSDL to Actions Generator](https://hackindex.io/tools/soap-wsdl)

Open →

Paste raw WSDL XML and get ready-to-use SOAP envelopes and curl commands for every operation. Extracts endpoints, namespaces, parameters and SOAPAction headers automatically.

SOAP WSDL XML Web services CTF

## [Laravel Cookie Forge & Decoder](https://hackindex.io/tools/laravel-cookie)

Open →

Decode and verify Laravel AES encrypted cookies using the APP_KEY. Reveals the session payload, checks the HMAC signature, and lets you forge new valid signed cookies.

Laravel Cookie AES Session CTF

## [Flask Cookie Forge & Decoder](https://hackindex.io/tools/flask-cookie)

Open →

Decode Flask itsdangerous session cookies without a key to read the JSON payload. Verify the HMAC-SHA1/SHA512 signature with the SECRET_KEY and forge new valid signed cookies for session manipulation in CTF web challenges.

Flask Cookie HMAC Session CTF

## About these tools

These tools are built for CTF (Capture The Flag) competitions and authorised penetration testing. They run entirely server-side — no input is stored or executed. Each tool is designed to save time on repetitive analysis tasks during engagements.

Nmap Service Suggestor

Parses the PORT/STATE/SERVICE/VERSION table from raw Nmap output and matches each open port to relevant service pages — attack techniques, enumeration methods and exploit resources.

Command Injection Bypass Generator

Generates obfuscated command injection payloads — base64, hex, xxd, ANSI-C quoting, IFS tricks, variable concatenation, wildcards, caret obfuscation, PowerShell encoding — and filters them against your regex to show only working bypasses.

Hashcat to John Rule Converter

Wraps Hashcat rules in a John the Ripper config file using the hashcat logic ON/OFF directive. Paste rules, pick a ruleset name, preview the output, and download the .conf file ready for --config and --rules flags.

SOAP WSDL to Actions Generator

Parses raw WSDL XML to extract every operation, its parameters and SOAPAction header, then generates complete SOAP envelopes and ready-to-run curl commands. Useful when attacking SOAP web services in CTF challenges or authorised penetration tests.

Laravel Cookie Forge & Decoder

Decrypts Laravel AES encrypted cookies using the APP_KEY, verifies the HMAC-SHA256 signature, and reveals the session payload. Also forges new valid signed cookies — useful for session hijacking and privilege escalation in CTF web challenges.

Flask Cookie Forge & Decoder

Decodes Flask itsdangerous session cookies to reveal the JSON payload without a key. Verifies the HMAC-SHA1 or HMAC-SHA512 signature with the SECRET_KEY and forges new valid signed cookies — essential for session manipulation in CTF Flask challenges.