Crypto, pwn, steganography and network challenges.
A hardened Merkle-Hellman knapsack: 96 public weights generated as a_i = r·b_i mod q from a tight superincreasing sequence, at density ≈ 0.91 — deliberately just under the 0.9408 CJLOS…
A stego challenge built on visual secret sharing: two images (share1.png, share2.png) from a lighthouse keeper's apprentices. Individually they look like noise; XOR them back together…
A stream cipher built on an LCG, leaking only the high 16 bits of each 64-bit state. The flag is XORed with the low bytes of the state sequence — so recovering the hidden low bits…
An incident-response-flavoured networking challenge: a TCP stream crosses the 32-bit sequence-number boundary, and an attacker injects ghost duplicate segments on the wrapped sequence…
A Diffie-Hellman instance with p = 1870283325551092163712001 — suspiciously small, and, as it turns out, with a fully smooth p - 1. The private exponent is recovered from the public key…
An RSA key with a deliberately tiny private exponent d — small enough that Wiener's attack recovers it from the public key alone. The modulus, exponent and ciphertext are all that's needed.
A looping loading animation left running on a harbour crane control panel — a GIF that never finishes. The hidden message is carried in the least-significant bits of the red channel,…
An insane-tier core-backbone incident: BGP route flapping between two peers on a transit edge gateway, with a hidden exfiltration target. The core trick is reconstructing route flap…
Franklin-Reiter related-message attack: two plaintexts encrypted with the same RSA key (N, e = 3), where m₂ = m₁ + α for a known constant α. Two polynomial relations mod N with a known…
RSA where the most significant bits of one prime are leaked — enough that p splits into a known high part and an unknown low part of manageable size. Coppersmith / Howgrave-Graham…
A palette-swap stego challenge: an ordinary PNG whose hidden content lives in the PLTE chunk. The provided palet.py rewrites the palette so exactly one palette index is white and the…
RSA lifted from scalars to 2×2 matrices over Z/nZ: C = M^e mod n, with the public constants trace(M) = T and det(M) = D. The matrix analogue of RSA still leaks the plaintext because the…
An LCG with unknown a, c and known modulus m = 2³² leaks consecutive outputs, then uses the same generator as a keystream to XOR the flag. Recover a and c from three outputs, then…
A pwn challenge around kairothd, an "adaptive instruction classification engine": it learns how your program behaves, decides it is trustworthy, and stops double-checking. The binary…
A network-forensics challenge whose answer is hidden in plain sight as a Base85 string in the incident artefacts. Decode it and the flag falls out.
A custom "elliptic curve" cryptosystem with a = 0, b = 0 — the curve is
The same plaintext encrypted twice under one RSA modulus with two different public exponents, e₁ = 65537 and e₂ = 65539. Since gcd(e₁, e₂) = 1, Bézout coefficients give the plaintext by…
Håstad's broadcast attack with a twist: the same message is RSA-encrypted under three moduli with e = 3, but the plaintext is first mapped through a known linear padding m' = a·m + b.…
A small-private-exponent RSA challenge placed just beyond Wiener's bound, so continued fractions alone fail. The private exponent is small enough for the Boneh-Durfee lattice attack…
Two RSA-CRT signatures over the same message, with a hardware glitch flipping a single bit in one signature's computation modulo q. That's the textbook setup for the Bellcore fault…
A core-network forensics challenge: an IXP border router's BGP session is captured, and the exfiltrated flag is smuggled inside BGP COMMUNITY attributes of eight UPDATE messages. Each…
Unzipping the archive gives a second zip with four logs. Three of them (auth.log, network.log, system.log) each have a flag-looking string, but they're all decoys.
redacted/XploitX_Stego03_Participants/extractions/NIGHTINGALE_memo_RESTRICTED.docx.extracted/0/word/document.xml 1. Zero-width chars in the RE: line → key. Map \u200b=10, \u200c=00,…
We are given a set of ECDSA-style signatures over the secp256k1 curve whose nonces were generated with a bias: the top 8 bits of each nonce are zero, i.e. every nonce k satisfies
Nothing matches that.
Try a different search term or category.