All Writeups

Comprehensive collection of CTF challenges, solutions, and insights.

2026-06-07 Web Easy

Raptor Weekly 6 - 3lectric Igloo - Web

Three flags across a penguin colony web app. Source recon, IDOR enumeration, OS command injection through a diagnostic ping utility, and AES-CBC decryption using keys leaked from the process environment.

recon idor command-injection rce

2026-03-01 Crypto Medium

DEADROP Crypto 3 - oracle_session.py

AES-CBC padding oracle attack against the agency's internal session token system. The oracle reveals one bit per query, valid or invalid PKCS#7 padding, which is enough to recover the full plaintext byte by byte.

aes cbc padding-oracle block-cipher

2026-02-24 Crypto Easy

WHAMazon! Crypto 4 - Sticky Note Security

Identifying a human-readable AES key from challenge lore, then decrypting by recognizing that a rushed engineer reused it as the IV.

aes cbc symmetric key-reuse