CTF SOLUTIONS & SECURITY NOTES
Writeups
Challenge walkthroughs, investigation notes, and lessons from each solve.
26 writeups
Aurora Patient Portal — Deadface CTF Writeup
Investigate mobile artifacts, a patient portal, and trial databases to reconstruct an attack chain across six DEADFACE challenges.
Read writeup ↗De Monne Financial — Hidden Activity — Writeup
The De Monne Financial banking app ships an internal Diagnostics activity that is accidentally marked android:exported="true" in AndroidManifest.xml. Any app or adb user on the device…
Read writeup ↗DEADFACE 2026 — Uninvited Guest: NTLMv2 NTProofStr
Follow a poisoned LLMNR reply through an SMB session and extract the NTLMv2 proof from packet evidence with tshark.
Read writeup ↗DEADFACE CTF — Aurora Health: Veltrexa Data-Lock Tampering
Find the subject whose primary efficacy result was modified after the Veltrexa study's official data-lock date. The result must have measure = 'primaryefficacydelta', and the lock date…
Read writeup ↗DEADFACE CTF — Hard Kept Secrets: De Monne Financial IDOR
The app exposes an insecure direct object reference (IDOR): an authenticated audit user who owns no accounts can still request records for another account by changing the numeric account…
Read writeup ↗DEADFACE CTF — Reptilians / Lizard People
The password and decoded flag both match the MD5 values embedded in the executable. This solution uses static analysis and a reconstruction of the decoder. The Windows executable was not…
Read writeup ↗DEADFACE CTF — Writeup
We intercepted a DEADFACE hacker's laptop and determined he had stolen a man named Daniel's entire identity. Identify which DEADFACE member is responsible.
Read writeup ↗Grave Encounters — Jerry's Leaks — Writeup
A static movie board on port 8080 leaks its own backend source code (/server.py), which contains a privileged session cookie. Replaying that cookie in a WebSocket handshake to the…
Read writeup ↗PCAP03 — Sneaky HTTP Exfiltration — Writeup
A workstation (10.20.30.40) browses a stream of harmless-looking websites — BBC, NYT, Reddit, YouTube, GitHub, weather APIs — with equally boring POSTs (comment=nice+post,…
Read writeup ↗Skeleton Key — Writeup
Sequel to The Crypt. The binary greets you with "Well, deep in that old crypt, you found your key... but do you know how to use it?" — this time the win function takes an argument:…
Read writeup ↗Spooky Cereals 02 — Nordics
An encrypted 7z (password KlippyAI) holds two sibling binaries (Linux x86 ELF + Windows x86 PE) that XOR a 256-byte "One Time Pad" against 256 bytes of data and search the output for the…
Read writeup ↗The Crypt — Writeup
A 513 MiB "mystery" file is 99.996% random padding — the real artifact is a tiny non-PIE x86-64 ELF glued to the front. Stage 1 hides a secret code in .data (XOR 0x13, cheekily named…
Read writeup ↗Uninvited Guest — Writeup
The companion pcap to Who Goes There? captures the initial access: LLMNR poisoning of the file-server name, the NTLMv2 credential leak it triggers, the attacker relaying into the real…
Read writeup ↗Who Goes There? — Telemetry Script Source
Recover the source of a telemetry script from a Windows memory image and connect its transfer command to the persistence investigation.
Read writeup ↗Who Goes There? — Writeup
A rogue Kali device landed on De Monne Financial's network and someone used a legitimate employee account to reach the file share. The workstation memory holds the whole story: the…
Read writeup ↗Crypto Filter Maze
Explore a graph-based cryptography challenge where leaked LWE error magnitudes reveal a route to recovering the hidden secret.
Read writeup ↗GeoINT CTF Write-ups
This index covers the four photo-geolocation challenges investigated in the current task. Every coordinate marked verified produced status: correct on the challenge platform.
Read writeup ↗GeoINT CTF — Never
Identify the exact camera position represented by the challenge photograph and submit its latitude and longitude to the platform.
Read writeup ↗GeoINT CTF — Reflection
Geolocate a photograph showing swans and gulls beside a broad river, then identify the precise point accepted by the challenge verifier.
Read writeup ↗GeoSINT CTF — First Capital
Given a photo of a residential street, identify the exact location where it was taken and submit precise coordinates on the challenge's Leaflet map. The platform's /api/verifylocation…
Read writeup ↗GeoSINT CTF — Long Way
Identify the exact road position from a desert photograph containing power lines and almost no conventional landmarks.
Read writeup ↗GeoSINT — We Have
Identify the precise location shown in wehavegeosint.jpg and submit it to the GeoSINT challenge.
Read writeup ↗Oops — CTF Writeup
The archive contained a Python project and its .git directory. Someone had deleted a configuration file and an encrypted secret, but both files were still available in earlier commits.…
Read writeup ↗picoCTF — Heap Overflow (ctfaa)
strcpy into i1->name (a malloc(8)) has no bounds check. Heap chunks are allocated sequentially, so a long argv[1] walks straight out of the name chunk and into the i2 struct that sits…
Read writeup ↗World Cup 2026 Final — Penalty Shootout
The service presents a World Cup final that finished 0–0. The winner is decided by a penalty shootout. For every Uzbekistan penalty, the player must choose one of three directions:
Read writeup ↗World Cup 2026 Penalty Shootout — Concise Solution
Uzbekistan reaches the 2026 World Cup final. The match is tied and the user controls Uzbekistan's penalty directions: LEFT, CENTER, or RIGHT. Brazil (and, on a later connection,…
Read writeup ↗No writeups match. Try another search or category.