All Writeups

Comprehensive collection of CTF challenges, solutions, and insights.

2026-05-10 JWT Easy

Raptor Weekly 2 - ECHELON JWT 1 - 1.2 ; NOISE FLOOR

Intercepting a JWT delivered in a non-standard HTTP response header, decoding the payload to recover the flag hidden in a custom claim, and recognizing the truncated signing key that will matter again two challenges later.

web crypto jwt ECHELON

2026-05-10 JWT Medium

Raptor Weekly 2 - ECHELON JWT 2 - 2.3 ; SIGNED

Reconstructing a JWT signing secret from two hex fragments recovered across prior challenges, forging an HS256 token with elevated role claims, and submitting it to a verification endpoint to gain SECRET tier access.

web crypto jwt ECHELON

2026-02-28 JWT Medium

WHAMazon! JWT 3 - RSA Revenge

Using provided RSA private key components to manually implement PKCS#1 v1.5 signing and forge a valid RS256 JWT admin token.

jwt rs256 rsa pkcs1-v15

2026-02-28 JWT Easy

WHAMazon! JWT 2 - Forge

Exploiting the JWT 'none' algorithm vulnerability to forge an unsigned admin token without knowing the signing secret.

jwt none-algorithm algorithm-confusion token-forgery

2026-02-28 JWT Easy

WHAMazon! JWT 1 - WHAM Token

Extracting a JWT signing key from a netcat service, forging an admin token with jwt.io, and submitting it to gain elevated access and retrieve the flag.

jwt hs256 token-forgery privilege-escalation