All Writeups

Comprehensive collection of CTF challenges, solutions, and insights.

2026-08-17 Forensics medium

Raptor Weekly 13 - Night Traffic

Night Traffic: layer-2 MITM in a noisy office capture; flag is XOR-encrypted under a SHA-256 of the attackers identity chain. Flag recovered.

exfil forensics pcap arp-spoofing

2026-03-01 Forensics Medium

DEADROP Forensics 3 - svchost_1337

An ELF core dump with a flag encoded through four layers, ROT13, base64, hex, and XOR 0x7d, hidden in the NT_PRPSINFO note section. readelf -n and working backwards through each encoding layer recovers it.

forensics core-dump elf readelf

2026-03-01 Reverse Engineering Medium

DEADROP Rev 3 - asset_tracker

A Windows PE with two anti-debug gates, IsDebuggerPresent and PEB NtGlobalFlag, protecting XOR-encoded flag fragments in .rodata. Patch or bypass the checks, then decode the three fragments with their respective keys.

rev windows pe anti-debug

2026-03-01 Reverse Engineering Easy

DEADROP Rev 1 - agent_verify

A Linux ELF binary that XOR-encodes the correct passphrase in .rodata. The flag is the passphrase itself, ltrace -s 200 hands it to you directly via strcmp interception.

rev xor ltrace elf

2026-02-24 Crypto Hard

WHAMazon! Crypto 6 - Manifest Collision

Exploiting XOR keystream reuse across two ciphertexts, cancelling the key, identifying newline-heavy P2 via single-byte XOR brute force, then recovering the full key via known-plaintext crib drag to extract the flag.

xor two-time-pad crib-drag known-plaintext

2026-02-23 Crypto Easy

WHAMazon! Crypto 1 - Workers are Exhausted

Identifying hex-encoded XOR ciphertext and brute-forcing the single-byte key using a known-plaintext crib from the flag format.

xor hex brute-force known-plaintext