Suggested Tools
All tools below work in any modern web browser — no installation required.
No sign-up needed unless noted with *.
Start here: CyberChef handles encoding,
decoding, hashing, ciphers, and file analysis. Try it before anything else.
Encoding & Ciphers
| Tool |
Use |
| CyberChef |
Base64, binary, hex, Caesar, ROT13, XOR, and hundreds more |
| dCode |
Identify and decode classical ciphers |
| quipqiup |
Automatically solve substitution ciphers |
| CrackStation |
Look up MD5/SHA1/SHA256 hashes against a massive database |
File Analysis
| Tool |
Use |
| CyberChef — Strings |
Extract readable text from binary files |
| AperiSolve |
This will find most image flags |
| PDF24 |
Extract text, metadata, and hidden content from PDFs |
| Hexed.it |
Open any file as raw hex in the browser |
| Forensically |
Image forensics — detect hidden edits, metadata, error level analysis |
OSINT & Research
| Tool |
Use |
| Google |
Start here — use site:, filetype:, and intitle: operators |
| who.is |
WHOIS domain registration lookup |
| DNSdumpster |
DNS record enumeration |
| ViewDNS.info |
Reverse IP lookup, DNS history, port check, and more |
| Wayback Machine |
Historical snapshots of websites |
| ipinfo.io |
IP address geolocation and ASN info |
Web & API Analysis
| Tool |
Use |
| Browser DevTools |
Press F12 — inspect elements, view source, check cookies, watch network requests |
| Hoppscotch |
Send HTTP requests and explore APIs |
AI Safety Challenges
For the GL1TCH challenges, you interact with GL1TCH directly through its chat interface.
No special tools needed — just your thinking. Read carefully, experiment with your inputs,
and pay attention to how GL1TCH responds.
Tips
- Can't decode something? Paste it into CyberChef and click "Magic" — it will
guess the encoding automatically.
- Stuck on a cipher? Copy the text into dCode → "Cipher Identifier" and it
will suggest what type it might be.
- Hash not cracking? Make sure you have the right hash type selected in CrackStation.
- Shodan (device/port search) requires a free account — skip it unless you already have one.