Welcome
The only input is one string, with the hint "The truth is hidden in the alphabets, not in the words."
hotwater / research archive
Sea of Secrets CTF 2026
Cryptography, digital forensics, mobile security, OSINT, reverse engineering and web exploitation.
25 writeups
Webhack Solutions
The challenge links only to the Instagram account @webhackacademy. Most of its posters carry a QR code, but every scannable one just points to https://academy.webhacksolutions.com/, a…
The Vandoria Leak — "Operation Nexus Gate"
x-powered-by gives Next.js 14.1.0. /robots.txt disallows /admin/, /classified/, /internal/, /api/debug/, /api/v1/legacy/, /api/internal/ — basically a map of what to hit.…
The Triangle of the Lost Treasure
The stated task is to script a client that finds the maximum-area triangle among up to 60 3D points across 5 rounds, each with a 5-second limit, talking to a local judge process…
The Phantom Application
The APK (com.phantom.navigator) has a vault activity that decrypts an AES ledger once you pass an officer/passcode check. Both the check and the key derivation are in the code, so none…
The Forgotten Vault
We get challenge.py, output.txt (a 64-byte hex ciphertext) and wordlist.txt (5,460 words). The vault is AES-128-ECB, and the key is MD5(password) where the password is a wordlist word,…
The Cursed Syscall
The binary is a stripped 16 KB x86-64 PIE. main at 0x11d0 reads a line with fgets, strips the newline, and requires strlen(input) == 0x34 (52). The 52 bytes are copied to the stack and…
The Cursed Encryption Oracle
The challenge is a web oracle at https://cursed-encryption-oracle.vercel.app. /info says it encrypts user_input || secret_flag with AES-128-ECB and PKCS#7 padding, hex-encoded, with at…
The Cursed APK
The challenge pushes you towards Frida and an emulator-hiding setup, but the root/emulator checks aren't a gate. They change a number that goes into the key, so on a "wrong" device you…
The Captain's Last Log
The only file is captain_disk.E01. There are no EWF tools on my box, so I read it directly. The volume section gives 64 sectors per chunk at 512 bytes, and the table section lists…
Tetrix Secrets
Hack!tUp{A9xK2LmP0QrT7vW4YzB8cD1eF6gH3J5N0U2X9s}
SocialSync: Vice City Underground
The challenge description hints at "dynamic object attribute mapping during profile credential updates" and "elevating authority to administrative clearance" — a fairly direct pointer at…
Project Black Pearl: The Cursed Engine of Elias Blackthorn
black_pearl.exe is a stripped PE32+ console binary (MinGW GCC 14.1.0), objdump -d -M intel is enough, no packing tricks. sea_chart_fragment.txt is flavor text that explicitly admits it…
Poison
We get chall.py (and a Sage port, chall.sage) and out.txt. The challenge is ElGamal over P-192 (secp192r1) where the flag, read as a big integer, is the private key d, and Q = dG. A…
Pirate's Last Algorithm
blackthorn_vault.exe is a 32-bit MinGW console PE (SHA-256 27b3ae11c55316152af02e38629d2028ad1ff77bb20f0233ab5b31e1b1cb2198) that asks for a "Captain's authorization key". It still has…
Operation Zero-Trust — DSI Joint Operations Center
The public portal at https://operation.hackitupnow.tech/ said that internal tools remained available through fallback routes. Its news page specifically mentioned a department…
Map Beneath the Ink
The zip holds five images and a checksum file: old_map.jpg (1718 survey chart), treasure_map.png (Captain Vance's annotated copy), captain_portrait.jpg, ship_photograph.png and…
Ghost Ship Unloaded
The files are Remittance_Manifest.jar, captains_log.enc, and ship_manifest.json. The jar contains three encrypted blobs under assets/ and no QaZagne class, which is loaded at runtime.…
Ghost in the Storage
The zip holds an evidence tree from a Pixel 6a (Android 13) running org.blackflag.keeper: the app's databases, shared_prefs, an image cache, logcat/dmesg, and an…
Ghost Coordinates
The S/V Obsidian Siren's GPS track, AIS log, deck logbook, photo EXIF, a sqlite navigation backup, and a scanned map were all recovered. The captain deliberately salted the record with…
Chronos in the Octet Cage
chall.py defines a 4-dimensional algebra over Z_N with a structure tensor GAMMA[k][a][b], product mix(X, Y)_k = sum GAMMA[k][a][b] X[a] Y[b] mod N, and N = p*q with 512-bit primes. The…
Captain's Last Assembly: Sector 7 Protocol
This is a Unity Mono build, so all game logic is plain IL in CaptainsLastAssembly_Data/Managed/Assembly-CSharp.dll. The gates (a million credits at one per minute, a barrier in the…
Captain's Keygen: The Cursed Treasure Lock
vault_lock is a stripped Linux x86-64 PIE ELF taking two inputs: a name and a 32-hex-char (16-byte) master key. Unusually for this kind of challenge, compass_chart.txt hands over almost…
ARGON: The Silent Vault
We get challenge.py (a format spec), public.json (curve, public key Q, salts, Argon2 params, channel map), signatures.jsonl (96 ECDSA signatures over secp256k1), diagnostics.bin (384…
Ananya's Shadow
The challenge links a blog (webapp-ten-fawn.vercel.app, "Shadow Notes") by av_shadow01. Its Instagram, Twitter and GitHub pages are all mock pages inside the same app, so the real GitHub…
No matching writeups
Try another event, category or search term.