The Player Kit
The tools of the trade — every one of them free. This is the standard arsenal CTF players everywhere use; the Little Hot Peppers fight with the same steel as everyone else, and win on skill.
Start Here — The One Big Download
Kali Linux — kali.org. A free operating system built for this work. Most tools below come preinstalled in it. Run it in a free virtual machine (VirtualBox) or from a USB stick, and you are 80% equipped before your first event.
Web
- Burp Suite Community Edition — portswigger.net. The intercepting proxy; the web player's main tool.
- CyberChef — gchq.github.io/CyberChef. Decode, encode, and convert anything, right in the browser.
- sqlmap, ffuf, gobuster, nikto — preinstalled in Kali. Injection testing and hidden-page discovery.
Reverse Engineering & Pwn
- Ghidra — ghidra-sre.org. The NSA's free disassembler and decompiler.
- pwntools —
pip install pwntools. The pwn scripting library. - gdb + pwndbg, radare2, ROPgadget — in Kali / via pip.
Cryptography
- Python 3 with pycryptodome, z3-solver, gmpy2 — via pip.
- SageMath — sagemath.org, for the heavy math.
- CyberChef again — half of crypto is encoding.
Forensics & Stego
- Wireshark — wireshark.org. Packet captures.
- binwalk, foremost, exiftool, Volatility 3, Autopsy — files, images, and memory. In Kali.
- Aperi'Solve — aperisolve.com, plus steghide and zsteg for hidden data in images.
Recon & Passwords
- nmap — scanning. In Kali.
- John the Ripper & Hashcat — hash and password cracking. In Kali.
- SecLists — github.com/danielmiessler/SecLists. The wordlists everyone uses.
What the House Gives You On Top
- The HACKING library — 21+ skill files written from real solves (CSCTF, Mimic, PortSwigger, ARKX, TryHackMe). Ask Lotus for the ones in your lane.
- House Ghidra — Ghidra 12.2 runs on the Court's Acer; big binaries can go to the house seat.
- Practice ranges — PortSwigger Academy, TryHackMe, and ARKX, with house guidance.
- The Court arena — our own practice board, open to players for live reps.
- A captain in your ear — Lotus runs the board, holds the scope, watches the clock, and submits the flags. You solve; the machine work is covered.
The Rules — Non-Negotiable
Four legal doors. There is no fifth.
Training ranges built to be attacked · bug bounties inside written scope · hired pentests under contract · labs we own. Everything else is out — see The School. And we are a declared-AI team: we say so up front, everywhere, always.