HackBlue

Tools · CTF categories for beginners · 02 / 18

Setting up a CTF practice lab: a Linux VM, core tools, and safe networking

Build a virtual machine with the tools most beginner challenges need, keep it isolated from your personal data, and organize challenge files and notes.

10 min read · practice only with authorization

Use a dedicated VM

Run challenges in a virtual machine such as Kali Linux, Parrot, or plain Ubuntu in VirtualBox, VMware, or UTM. Challenge files are untrusted by nature, and a VM keeps them away from your personal files and browser sessions. Take a snapshot after setup so you can roll back.

Core tools

Most beginner challenges need a small toolkit: file, strings, xxd, and binwalk for file analysis; exiftool for metadata; Wireshark and tshark for captures; Python 3 with requests and pycryptodome; CyberChef for encoding puzzles; Ghidra for reversing; gdb with an extension like GEF or pwndbg; and a browser with developer tools for web challenges.

Snippet
sudo apt update && sudo apt install -y file binutils xxd binwalk libimage-exiftool-perl \
  wireshark tshark python3-pip python3-venv gdb netcat-openbsd steghide
python3 -m venv ~/ctf && . ~/ctf/bin/activate && pip install requests pycryptodome
mkdir -p ~/ctf-work/{challenges,notes,tools}

Lab: verify the toolkit

After installing, run a quick self-test: create a small file, inspect it with file and xxd, hide a short text inside a ZIP appended to an image and find it with binwalk, and open a sample packet capture from the Wireshark sample captures page in tshark. If each step works, snapshot the VM and name it “clean toolkit”.

Snippet
echo 'practice flag{hello_lab}' > note.txt && zip secret.zip note.txt
cat picture.jpg secret.zip > combined.jpg
file combined.jpg && binwalk combined.jpg
binwalk -e combined.jpg && cat _combined.jpg.extracted/note.txt
tshark -r sample.pcap -q -z conv,tcp | head

Stay organized

Keep one folder per challenge with the original file, a working copy, and a notes.md file. Record the commands you ran. Good notes speed up later challenges and become the basis for write-ups.

Diagram

Lab setup

  1. VM

    Install a Linux VM; keep it separate from personal data.

  2. Toolkit

    Install file analysis, network, Python, reversing, and web tools.

  3. Self-test

    Run each tool on a known sample.

  4. Snapshot

    Save a clean state to roll back to.

Check yourself

1. Why run challenges in a VM?

2. Which tool finds files embedded inside another file?

3. What should you do after the toolkit works?