CTF write-ups

Capture-the-flag challenge write-ups: crypto, reversing, web and forensics puzzles, explained step by step.

2015

Nov 2015•CTF write-ups

A look at an RCTF cryptography challenge that hid its answer inside the padding bits Base64 normally discards.

Nov 2015•Reverse engineering

Notes on a crack-me that stacked packing, anti-disassembly tricks and a multi-step encoding scheme before the real check.

Nov 2015•Web security

A filename-based SQL injection bypassing keyword filters, plus a four-stage privilege escalation chain ending in a filtered file upload.

Jun 2014•Web security

Four 2014 CySCA web challenges, covering trust-the-client access control, markdown XSS, CSRF-protected SQL injection, and hash length extension.

Oct 2012•CTF write-ups

A tour of the anti-debugging tricks in Hack.lu's mealtime CTF binary: PEB-flag checks, deferred VEH registration, and injection across two processes.

Jun 2012•CTF write-ups

A firmware-analysis CTF challenge solved by identifying the device, extracting its filesystem, and locating a flag file inside it.

Jun 2012•Reverse engineering

A CTF binary challenge shipped a packet capture plus an executable for an unfamiliar architecture, solved mainly through protocol-flow reasoning.

Nov 2011•CTF write-ups

A look at the typical structure and skills behind 2011-era network-forensics CTF challenges, built around reading a packet capture end to end.