category

Challenge

318 posts
crypto

Signing Factory

PRNG+1

Signing Factory: reconstruct the PRNG state from the leak, replay it, and recover the flag.

forensics

An unusual sighting

An unusual sighting: isolate the relevant artifact, decode the evidence, and extract the flag.

web

ApacheBlaze

ApacheBlaze: identify the broken request handling, prove control, and use it to recover the flag.

rev

FlagCasino

ELF+1

FlagCasino: trace the binary, isolate the validation routine, and invert it to recover the flag.

pwn

Getting Started

BOF+1

Getting Started: calculate the overflow offset, redirect control flow, and land a reliable flag read.

rev

Hunting License

ELF+2

Hunting License: trace the binary, isolate the validation routine, and invert it to recover the flag.

rev

LinkHands

Linux

LinkHands: reverse the validation logic, model the transform, and recover the accepted input.

web

No Threshold

No Threshold: identify the broken request handling, prove control, and use it to recover the flag.

web

ProxyAsAService

ProxyAsAService: identify the broken request handling, prove control, and use it to recover the flag.

forensics

Pursue the Tracks

Pursue the Tracks: isolate the relevant artifact, decode the evidence, and extract the flag.

pwn

Questionnaire

BOF+3

Questionnaire: use the format-string bug for a leak or write, then redirect execution to the flag path.