All Writeups

Comprehensive collection of CTF challenges, solutions, and insights.


Filter by tag:

DEADROP Crypto 3 - oracle_session.py

AES-CBC padding oracle attack against the agency's internal session token system. The oracle reveals one bit per query, valid or invalid PKCS#7 padding, which is enough to recover the full plaintext byte by byte.

WHAMazon! Crypto 4 - Sticky Note Security

Identifying a human-readable AES key from challenge lore, then decrypting by recognizing that a rushed engineer reused it as the IV.