Skip to main content

Blazing-fast terminal utility for CTF players to find and decode flags

Project description

🛠️ ctfscan – BLACKFLAG

Instant flag finder & decoder for CTFs.
Built by @Anuragmahipal
🦾 No GUI. No bloat. Just raw shell power.

PyPI version Python 3.6+ License: MIT


⚔️ What is ctfscan?

ctfscan is a blazing-fast terminal utility for CTF players, reverse engineers, and anyone trying to slice through encoded clues and flag-filled binaries.

📦 Installs in seconds via pip.
⚡ Runs in a blink.
🕵️‍♂️ Built for real-world use.


🔥 Features

🔧 Tool 📌 Purpose
-ff Find flag{} / FLAG{} / CTF{} patterns
-d64 Decode base64 data from file
-dhex Decode hex strings (like shellcode)
-scan Advanced analysis (exiftool, binwalk, strings)
Default mode Auto-search for flag-like patterns

🚀 Quick Start

Installation

Via pip (recommended):

pip install ctfscan

From source:

git clone https://github.com/Anuragmahipal/ctfscan.git
cd ctfscan
pip install -e .

Usage

# Find all flags recursively
ctfscan -ff secret.txt

# Decode base64
ctfscan -d64 encoded.txt

# Decode hex
ctfscan -dhex shellcode.hex

# Advanced analysis
ctfscan -scan binary_file

⚡ Usage Cheatsheet

ctfscan -ff <file_or_directory>
# 🔎 Search for flags recursively

ctfscan -d64 <file>
# 📜 Decode base64 content

ctfscan -dhex <file>
# 🧬 Decode hex data

ctfscan -scan <file>
# 🔍 Run exiftool, binwalk, and strings analysis

ctfscan -h
# 📖 Show help

💻 CTF Workflow Integration

Pair ctfscan with your favorite tools:

  • Grep for flags while solving CTFs
  • Decode strings on the fly
  • Hex + base64 decoding directly from terminal
  • Use in bash scripts and automation
  • Integrate with fzf and other terminal tools

🧠 Sample Use Cases

# Find all flags in a directory:
ctfscan -ff ./capture/

# Decode a file that's base64 encoded:
ctfscan -d64 encoded.txt

# Pipe into another tool:
ctfscan -ff target.bin | tee flags.txt

# Advanced analysis on binary:
ctfscan -scan challenges/binary_challenge

⚙️ Requirements

  • Python 3.6 or higher
  • Optional: exiftool, binwalk, strings for advanced scanning

📦 Installation Methods

Method 1: PyPI (Recommended)

pip install ctfscan
ctfscan -h

Method 2: From Source

git clone https://github.com/Anuragmahipal/ctfscan.git
cd ctfscan
pip install -e .
ctfscan -h

Method 3: Development Install

git clone https://github.com/Anuragmahipal/ctfscan.git
cd ctfscan
pip install -e ".[dev]"

🐛 Troubleshooting

Command not found after installation?

  • Ensure the pip installation location is in your PATH
  • Try: python -m ctfscan.cli -ff file.txt

Optional tools not working?

  • Install: exiftool, binwalk, strings
  • On Ubuntu/Debian: sudo apt-get install exiftool binwalk
  • On macOS: brew install exiftool binwalk

📝 License

MIT License - See LICENSE file for details


🤝 Contributing

Found a bug? Have a feature request?
Open an issue on GitHub


👨‍💻 Author

Anuragmahipal
GitHub: @Anuragmahipal


☠️ Why Use This?

Because grep is noisy. xxd is clunky. And most tools aren't built for CTF pace.

ctfscan is laser-focused, scriptable, minimal, and shell-native.

Find flags faster. Decode deeper. Hack cleaner. 🧨


📜 License

MIT — Fork it, enhance it, make it yours.


👾 Screenshot

$ ctfscan -ff memory_dump.bin
[+] Found: FLAG{real_binary_capture}

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distributions

No source distribution files available for this release.See tutorial on generating distribution archives.

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

anurag_ctfscan-1.0.0-py3-none-any.whl (7.3 kB view details)

Uploaded Python 3

File details

Details for the file anurag_ctfscan-1.0.0-py3-none-any.whl.

File metadata

  • Download URL: anurag_ctfscan-1.0.0-py3-none-any.whl
  • Upload date:
  • Size: 7.3 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/6.2.0 CPython/3.10.2

File hashes

Hashes for anurag_ctfscan-1.0.0-py3-none-any.whl
Algorithm Hash digest
SHA256 69b9216b564de9a35115acd176a68b3fb68989282448c7f96121867fec078b0b
MD5 76b89131c58fd2f5f40cb89405c2653c
BLAKE2b-256 74ef1f7ec441f3f102fef48417a71328ef485517b1b6dd8bfa59417c06d67988

See more details on using hashes here.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page