Every challenge I've solved and documented. Search by name, filter by discipline or event — no login, no gatekeeping.
146 writeups
The TCTF 2026 challenge behind this folder presents a shell-like service on a remote host (TCP port 23, banner included) that ships with a very restricted command vocabulary. Without any…
This TCTF 2026 crypto service ("Feed the BOX") encrypts every supplied 16-byte block with a custom AES variant under a fixed secret key, handshakes a checksum cryptogram (the key…
An incident-response-flavoured networking challenge: a TCP stream crosses the 32-bit sequence-number boundary, and an attacker injects ghost duplicate segments on the wrapped sequence…
This challenge's binary is dispatch; the banner inside it is what names it. H7CTF 2026's pwn track artifacts for the challenge are titled dispatch.zip, and the feedback terminal's prompt…
For H7CTF 2026 the AI-category target here is a toy Solana SPL swap program. A raw-socket harness drives a self-contained re-implementation of the program loader, and solving it is:…
A Diffie-Hellman instance with p = 1870283325551092163712001 — suspiciously small, and, as it turns out, with a fully smooth p - 1. The private exponent is recovered from the public key…
An RSA key with a deliberately tiny private exponent d — small enough that Wiener's attack recovers it from the public key alone. The modulus, exponent and ciphertext are all that's needed.
A looping loading animation left running on a harbour crane control panel — a GIF that never finishes. The hidden message is carried in the least-significant bits of the red channel,…
Lunar CTF's SHATTERED ORACLE is a multi-stage crypto chain. The handout publishes 12 secp256k1 signatures whose nonces leak 40 bits (MSB- or LSB-truncated), a transcript of…
An insane-tier core-backbone incident: BGP route flapping between two peers on a transit edge gateway, with a hidden exfiltration target. The core trick is reconstructing route flap…
Franklin-Reiter related-message attack: two plaintexts encrypted with the same RSA key (N, e = 3), where m₂ = m₁ + α for a known constant α. Two polynomial relations mod N with a known…
pset1 is an introductory stack overflow NNS CTF pwn challenge. The handout/solve.py captures the whole exploit in 12 lines: the target binary's input handler overflows a stack buffer,…
The phantom_eclipse forensics challenge ships an evidence bundle (evidence/): a .ECL container (artifact.dat) of fourteen sec_NNNN sections, a notes.jpg, a suspicious_image.png carrying…
For H7CTF 2026 this Solana challenge ("perp_guard", target program perp_guard_solve) is about draining a transaction's compute budget through a crafted cross-program invocation, on a…
RSA where the most significant bits of one prime are leaked — enough that p splits into a known high part and an unknown low part of manageable size. Coppersmith / Howgrave-Graham…
A palette-swap stego challenge: an ordinary PNG whose hidden content lives in the PLTE chunk. The provided palet.py rewrites the palette so exactly one palette index is white and the…
crypto_nostalgia is a brute-force-the-seed crypto challenge. The handout chall.py generates the AES-256 key from an LCG run 1337 times over a "nanosecond precision" time seed — but since…
Neve (ISFCR CTF 2026) is a noisy-channel statistical inference challenge against the SHARD-24's NEVE sounding head: you hand it symbols 0–15 and it answers with a single biased bit, the…
Monodromy (ISFCR CTF 2026) hands you a MONOVM3 capsule, two 8x8 matrices, and a stripped ELF that demands "the lost rotation index" before it will say anything useful. The rotation index…
mirror is a pwn challenge shipped as a PIE x86-64 ELF served over socat (handout/mirror/ Dockerfile EXPOSE 1337). The binary stores records in a global session structure with two record…
Mirage (ISFCR CTF 2026) was a remote binary at 0.cloud.chals.io:23023 that accepted input with an obvious format-string sink. Since only short, one-shot interactions were reliable over…
forensics_min-beste-venn hides a chat conversation inside a capture.pcap of requests to a Cloudflare-fronted web app. Every asset the pair of participants fetches goes through…
RSA lifted from scalars to 2×2 matrices over Z/nZ: C = M^e mod n, with the public constants trace(M) = T and det(M) = D. The matrix analogue of RSA still leaks the plaintext because the…
For H7CTF 2026's pwn1 challenge, the target binary is literally called manifest (its debug info says manifest.c), and its whole attack surface is a feedback terminal that echoes what you…
Nothing matches that.
Try a different search term or category.