All Writeups
Comprehensive collection of CTF challenges, solutions, and insights.
WHAMazon! CTF - Event Overview & Retrospective
A full retrospective on the WHAMazon! CTF - 22 challenges across 6 categories, the cross-challenge recon chain that tied the web category together, and how this event sparked the CTF Toolkit.
WHAMazon! Rev 2 - Armor
Identifying a PyArmor v9.x protected Python script, generating the correct runtime to execute it, and extracting a base64-encoded flag from the crash dump it writes to disk.
WHAMazon! Network 4 - What's UDP with you?
Extracting multiple base64-encoded keys hidden across different protocols in a packet capture, then running a UDP listener to receive an exfiltrated flag after submitting the correct credential.
WHAMazon! Rev 1 - Stage ?
Peeling back two layers of PowerShell obfuscation, a base64-encoded outer script and a string-split encoded flag inside, to recover the plaintext flag.
WHAMazon! JWT 3 - RSA Revenge
Using provided RSA private key components to manually implement PKCS#1 v1.5 signing and forge a valid RS256 JWT admin token.
WHAMazon! Network 3 - It wasn't me
Extracting a PowerShell hex-decoding payload from a DNS C2 packet capture using strings, then decoding the embedded hex string to recover the flag.
WHAMazon! Misc 1 - James Smith
Extracting a flag hidden inside a JavaScript obfuscated string array by identifying flag-shaped fragments and manually reassembling them from context.
WHAMazon! JWT 2 - Forge
Exploiting the JWT 'none' algorithm vulnerability to forge an unsigned admin token without knowing the signing secret.
WHAMazon! Network 2 - The AI gets mixed up when you rev it
Decrypting TLS traffic in Wireshark using a provided pre-master secret log, then following the TLS stream to find a base64-encoded flag in captured shell session output.
WHAMazon! JWT 1 - WHAM Token
Extracting a JWT signing key from a netcat service, forging an admin token with jwt.io, and submitting it to gain elevated access and retrieve the flag.
WHAMazon! Network 1 - It's on the wires
Extracting a plaintext flag from a packet capture by running strings, no Wireshark required!
WHAMazon! Crypto 6 - Manifest Collision
Exploiting XOR keystream reuse across two ciphertexts, cancelling the key, identifying newline-heavy P2 via single-byte XOR brute force, then recovering the full key via known-plaintext crib drag to extract the flag.
WHAMazon! Crypto 5 - Signature Residue
Exploiting a weak (low) DSA nonce k to brute-force the signing secret, recover the private key x, and derive the flag via SHA-256.
WHAMazon! Crypto 4 - Sticky Note Security
Identifying a human-readable AES key from challenge lore, then decrypting by recognizing that a rushed engineer reused it as the IV.
WHAMazon! Crypto 3 - Quarantine Key Dump
Reconstructing n from p and q, diagnosing OAEP padding from garbled raw-RSA output, and decrypting with PyCryptodome's PKCS1_OAEP cipher.
WHAMazon! Crypto 2 - You got the key to this room?
Reconstructing a truncated RSA private exponent via brute force over the missing 4 hex digits, then using it to decrypt a raw RSA ciphertext.
WHAMazon! Crypto 1 - Workers are Exhausted
Identifying hex-encoded XOR ciphertext and brute-forcing the single-byte key using a known-plaintext crib from the flag format.
WHAMazon! Web 6 - Health & Safety
Exploiting an unsanitized target parameter in an admin health-check endpoint to achieve remote code execution and traverse the filesystem for a hidden flag.
WHAMazon! Web 5 - Neural Backdoor
Chaining GitHub source code OSINT to discover a hidden SSRF endpoint, then using it to proxy requests to an internally-restricted AI core API.
WHAMazon! Web 4 - The Archives
Chaining prior recon from robots.txt with API endpoint fuzzing and a missing-result anomaly to discover a path traversal vulnerability in an image file server.
WHAMazon! Web 3 - The Review Queue
Exploiting a stored XSS vulnerability in a seller product submission form via an unsanitized image field to steal an admin review token.
WHAMazon! Web 2 - Employee of the Month
Combining GitHub OSINT with API endpoint discovery to find hardcoded admin credentials left in a public seed script.
WHAMazon! Web 1 - The Forgotten Protocol
Leveraging a publicly accessible robots.txt to discover exposed internal API endpoints and retrieve a leaked maintenance key.