All Writeups

Comprehensive collection of CTF challenges, solutions, and insights.

2026-03-01 Forensics Insane

DEADROP Forensics 6 - NIGHTJAR AFTERMATH

A ZIP containing six post-incident artifacts, logs, a photo, a config, a README, a binary, and a pcap. Each hides one fragment of the flag using a different technique. The README encodes the final fragment via trailing-space whitespace steganography across 47 lines.

forensics multi-artifact steganography whitespace

2026-03-01 Forensics Hard

DEADROP Forensics 5 - Field Laptop

A disk image with an encrypted hidden partition. The passphrase is GPS coordinates extracted from image EXIF data. The ChaCha20 key derivation parameters and salt are embedded in a self-describing plaintext header in the hidden region, recoverable with strings alone.

forensics disk-image encryption chacha20

2026-03-01 Forensics Medium

DEADROP Forensics 2 - Safehouse

A PNG with a flag hidden in the least significant bits of pixel data. Classic LSB steganography, stegsolve or zsteg extracts it directly.

forensics steganography lsb png