PicoCTF
PicoCTF
Where I built my CTF fundamentals.
Binary Search
A guessing game whose ten-guess budget is exactly the minimum a thousand candidates allow, which is the hint.
Read writeupRust fixme 1
A program that already knows its own flag and will not build, with three deliberate mistakes that each carry the question their fix answers.
Read writeupRust fixme 2
The same shape as the first, except the compiler is objecting to something that is not a typo.
Read writeupRust fixme 3
The last of the three, where nothing is mistyped and the only fault in the file is a pair of comment markers.
Read writeupSuper SSH
The challenge page hands over every parameter, so the only decision left in the solve is the host key prompt most people click through.
Read writeupEVEN RSA CAN BE BROKEN???
The service rolls a fresh RSA key on every connection, and every modulus it hands out is even, which gives the factorisation away on sight.
Read writeuphashcrack
Three hashes handed over in sequence with the algorithm withheld until after each answer, and three passwords that were in the lookup table long before anyone tried.
Read writeupCookie Monster Secret Recipe
A login form that refuses every credential and hands the flag over anyway, in a cookie wrapped in two layers of encoding.
Read writeupGET aHEAD
The page offers two buttons and the flag is in neither, because it comes back in a response header on the one method that returns no page at all.
Read writeuphead-dump
A Node application publishes its own API documentation, and one of the documented routes serialises the server's live memory to a downloadable file.
Read writeupInsp3ct0r
A page that lists the three files it was built from, and hides a third of the flag in each one.
Read writeupn0s4n1ty 1
A profile picture upload that accepts a PHP file, and a sudoers entry that lets the web server user run anything it likes.
Read writeupSSTI1
An announcement board that renders what you type instead of printing it, and a route from an empty string to every class the process has loaded.
Read writeupWebDecode
A brochure site that asks to be inspected, and keeps the flag in an attribute no browser was ever going to render.
Read writeupDISKO 1
Fifty megabytes of FAT32 and two commands, because a disk image is bytes before it is a filesystem.
Read writeupPh4nt0m 1ntrud3r
The flag was exfiltrated one slice per packet, and the capture was written with its timestamps out of order so that frame order is the wrong order.
Read writeupRED
A 796 byte red square whose metadata contains a poem, and whose poem contains an instruction.
Read writeupScan Surprise
The flag is handed over as a picture of itself, and the only forensics is noticing that the pixels are the payload.
Read writeupVerify
One SHA-256 digest against a directory of anonymous files, and the gap between checking a file's integrity and knowing where it came from.
Read writeupPIE TIME
The program prints its own main address, so the fixed distance to the flag-reading function turns the jump prompt into one subtraction.
Read writeupStonks
A format string bug hands back the stack a word at a time, and the flag arrives in four-byte blocks that are all the wrong way round.
Read writeup