CTF writeups · offensive security
CTF player and security researcher
I take things apart, figure out why they broke, and document the whole mess. This site is my lab notebook: the challenges I solved, the dead ends I hit, and the tricks I want to remember next time.
Fresh solves from the archive
The two APKs cooperate to reconstruct an encrypted DEX payload. Each contains a 32,768-byte asset named half.bin. Their native libraries publish their own half through a memory-backed…
It is a stripped, statically linked, 64-bit x86-64 ELF executable. This means there are no helpful function symbols, so the validation logic must be located by inspecting its control…
The challenge provides chall.py and output.json. A trusted setup samples a secret integer tau and builds a structured reference string (SRS) containing successive powers of the secret in…
The archive the_shape_of_silence.zip contains:
Recover the note and its attachment record as they existed immediately after the operation committed for export export-07abca69cd99. The evidence consists of four ASCII strings, in order:
Recover the incident token belonging to the container instance serving dispatch-ac1af5608a at 2026-08-14 10:10:08.555 +05:30. The input archive contains:
Competitions represented in the archive, newest first.
The home-team event: a full slate of pwn, crypto, web, forensics, IoT and mobile challenges.
Crypto, pwn, steganography and network challenges.
Enterprise DFIR.
Forensics and web.
Cloud, forensics, mobile, pwn and reverse engineering.
Web exploitation challenges.
Digital forensics.
Crypto and web challenges.
Beginner-friendly web challenges.
DevSecOps and web security.
Web and miscellaneous challenges.
AI, cloud and Android security challenges.