My-CTF-Challenges - 🏴 🏴 🏴

项目说明

My CTF Challenges

HITCON CTF

2023 Quals

write-up

| Challenge | Category | Description |
| --------- | --------- | ------------------------------------------------------------ |
| Sharer | web | XSS and CSRF with Signed Exchange (SXG) feature. |
| AMF | web, misc | Find an RCE gadget in Py3AMF |

2022 Quals

write-up

| Name | Category | Description |
| -------------------------------------------------- | -------- | ------------------------------------------------------------ |
| 🎲 RCE | web | Warmup Challenge |
| 💣 Self Destruct Message | web | XSS |
| 🎧 S0undCl0ud | web | Python generator, mimetypes library |
| 📃 web2pdf | web | mpdf 0-day |
| V O I D | misc | Using OOB bytecodes to escape PyJail |
| 🥒 Picklection | misc | Pickle Jail |

Balsn CTF

2023

| Name | Category | Description |
| ----- | -------- | -------------------------- |
| Memes | web | imagepng + FTP PASV SSRF |

TSJ CTF 2022

| Name | Category | Description |
| --------------------------------------------------- | -------------- | ------------------------------------------------------------ |
| Genie | Web, Crypto | Genie.jl 0-day, Julia deserialization, Bit flipping |
| Avatar | Web | Redis SSRF, CRLF injection, POP chain |
| Welcome to TSJ CTF | Web, Misc, CSC | .DS_Store, Guessing |

AIS3 EOF CTF

2023 Final

| Name | Category | Description |
| ---- | -------- | ------------------------------- |
| WoW | KoH | Web-based 2D battle royale game |

2023 Quals

| Name | Category | Description |
| ----------------- | -------- | ----------------------------------- |
| Monsieur de Paris | Misc | Python multiprocessing RPC (pickle) |

2022 Final

| Name | Category | Description |
| ------------ | -------- | ---------------------------------------------------------- |
| npy | Web | 0-day in jpickle |
| Imgura Final | Web, A&D | PHP A&D challenge |

2022 Quals

| Name | Category | Description |
| ------------------------------------------------------------ | -------- | ------------------------------------------------------------ |
| SSRF challenge or not? | Web | file://, signed pickle cookie, Bottle |
| Happy Metaverse Year | Web | Union+blind based SQLi |
| babyphp | Web | .htaccess, php://filters chain |
| GistMD | Web | JSONP, DOM clobbering |
| Imgura album | Web | Path tra, PHP session , POP chain in Flight framework |
| PM | Web | FPM SSRF |
| LeetCall | Misc | Write Python with only Call, Name and Constant nodes |
| babyheap | Misc | argument injection (wget, zip) |

2021 Quals

| Name | Category | Keywords |
| ------------------------------------------------------- | -------- | ------------------------------------------------------------ |
| WTF | Web | php wrapper, file command |
| CYBERPUNK 1977 | Web | SQL injection, quine, python format string |
| CTF Note | Web | prototype pollution (gadget in markdown-js), DOM clobbering, RPO |
| 3DUSH3LL | Misc | Pyjail |

2021 Final

> All of my challenges in this CTF are related to Python XD

| Name | Category | Keywords |
| ---------------------------------------------------- | -------- | --------------------- |
| Pikora | Misc | PPC but use pickle |
| Cat Translator | Misc | Troll, PyJail |
| Cat Slayer | Reverse | Python bytecode (pvc) |

AIS3 Pre-Exam

2022

| Name | Category | Description |
| ------------- | -------- | ----------------------------------------- |
| Double AES | Crypto | OFB(ECB(data)), cut & paste, JSON |
| ASTJail | Misc | PyJail |
| TariTari | Web | Warmup, path tra, command injection |
| Best Login UI | Web | NoSQL injection |
| Emoji DB | Web | SQL Server SQL injection |
| Gallery | Web | Upload SVG to XSS, default-src 'self' |

2021

Web | Reverse | Misc

| Name | Category | Keywords |
| ---------------------------- | -------- | ------------------------------------- |
| 🐰 Peekora 🥒 | Reverse | Pickle Bytecode |
| ⲩⲉⲧ ⲁⲛⲟⲧⲏⲉꞅ 𝓵ⲟ𝓰ⲓⲛ ⲣⲁ𝓰ⲉ | Web | JSON injection |
| 【5/22 重要公告】 | Web | LFI, SQL injection, Command injection |
| XSS Me | Web | XSS with length limit |
| Cat Slayerᴵⁿᵛᵉʳˢᵉ | Web | Ja, Reflection |
| Cat Slayer \| Cloud Edition | Misc | Pickle, ECB Cut&Paste |
| Cat Slayer \| Online Edition | Misc | Game, Python Sandbox |

项目信息

开发语言：Python

Star 数：110

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕🏴 🏴 🏴展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。