项目说明
CTFs-writeups
Writeups for CTFs competitions.
On this page you can find links to writeups for the following categories:
BlockchainCryptographyForensicsCheating in gamesMiscellaneousOSINTPwnBrute-forcing passwordsQuantum cryptographyReverse engineeringWebYou can also find a list of useful CTF tools.
Example of writeups
Blockchain
Eth
Blockchain transactions are public (ETH)Reentrancy exploitSet up of en, underflow and reentrancyBitcoin
Bitcoin transaction Cryptography
Easy crypto
OTP reuseMorse from audioEnigmaEnigma avec ICLot of guessy ciphertexts without knowledge of cipherHill cipherGeneral crypto
Double DESAES
Malleability of the first block in AES-CBCPadding oracle attack on AES-CBCI with partially known plaintext, ciphertext and key in AES-CBCExploiting predictable IV in AES-CBCDifferential Power Analysis on first round of AESRSA
RSA with ciphertext super smallAttacks on RSA: Wiener, sexy primes, LSB oracle, partial private key leakedMulti-primes RSAFixed point in RSARSA full oracleHashes
Hash length extension attackFind a preimage for the Python hash functionCryptography in subgroups of Z or Z*
DLP, order of N has small factorsElGamal signature scheme without hash existential forgeryBreak DH key exchange with Pohlig-Hellman attack for DLPOracle for finding secret exponentShamir polynomial with linked coefficientsElliptic curves
CRT on EC pointsNonce reuse in ECDSA signatureBad randomness
Retrie of java.util.Random PRNGSol of integer inequalities - java.util.Random callsEsoteric
Custom VHDL cipher on FPGAHardware AES key, CRT, Galois fieldsEncryption oracle with plaintext compressedExample in RUSTForensics
Images
Broken JPEG headerBroken PNG imageBroken BMP headerFlag hidden in bit plane of imageImage manipulation with PILHidden flag in PNG (zsteg)Hidden flag in scanline filter of PNGCode128PietAudio
binwalk and flag hidden in spectrogram of audio fileUARTSSTVSome signal analysis (Winlink)WAV file is an oscilloscope inputPDF
PDF reco and CMapNetwork files
Scapy to read pcapExtract TFTP filesDump files
Android dump position historyArduinoAnalyse dump file with Analyse Windows file with Windows recurring taskRepair RAID filesBackdoor in service (systemd)ELF Core dumpSignal in a wire
Keypad snifferEEPROM Arduino eletrical circuit VCD file8b10bNon Return to Zero InEsoteric
Polyglotte filesHidden flag in RSA parameterDetect falsified data with Benford's lawAutomating decompression with password crackingRead sparse filesColor hex Sound keyloggerElastic searchLog4ShellGames
Cheat in WASM gamesModify client of Godot scripts MMORPG game to cheatMisc
Bypass float comparison in PythonRead QR code with PythonPython bytecodeCreate Signal with a giHomoglyphesReverse gzdeflateCaptcha brute forceBecome root in VMOSINT
Github older commitOld of pip libraryFind password of an employee in social networkOld of websitePWN
Buffer o
Simple buffer o32 bits ROP chain buffer oNX disabledWrite shellcodes with restrictionsGet a shell using dup2 and execv with ROPSimple format string
Format string to bypass canary and PIE for buffer oGOT o with format string (no PIE)ret2lib
32 bit ret2lib with buffer o64 bit ret2lib with buffer oret2lib with ASLR and PIE with only format string File Struct Oriented Programming
FSOP par heap oGuide FSOPAutre guideBreak PRNG
Guess randomness of rand with srand(time)Pri escalation
Pri escalation on Linux machine, exit rbashOpen tty shell to exploit less for pri escalationRead file in restricted bashRead execute-only binary with LD_PRELOADHeap exploitation
Reallocate chosen freed block from tcacheUse-after-freePython
Python 2 inputPython string equal bypass before intJava
log4shellPassword cracking
Simple johnSalted hashCustom ListKDBXZIPKDBX with key fileSimilar passwordQuantum
Quantum key distributionRe
Java and Android
JaPython
Python bytecode reversePYC reverseAssembly
Assembly reARMv8 assembly rePortable executable compiled with CosmopolitainIn-memory loading technique hookMicro-controllers and circuits
Arduino Intel HEX formatLogic gatesOther static analysis
Extract data from ELFPacked malwareStatic analysis
Use angr to crack passwordUse claripy to solve a set of constraintsDynamic analysis
Use gdb to debug child after forkReverse OS launched with qemuExample of re using OllyDbg and GhidraBrute force password on Android appWeb
Language
PHP injection with eval usedExploit ja equality check to bypass hash collisionPHP deserializeAnother PHP deserialize.Net core C# getters and setters exploitsPHP extractSQL attacks
Blind SQLi, path transAnother blind SQLiSQL union attack, weak new password procedureBlind SQLi: guessing tables and finding flagMySQL UNION attack with some filtersSession tokens
disable JWT signingJWT with RS256 and weak RSA keyFlask cookiesexploit redirect parameter in OAuth to steal access tokenRCE with SSTI
Jinja2 SSTIXSS
Reflected XSSReflected XSS with older of browser (SameSite=None)Bypass WAF for reflected XSSUse ja: URL scheme to provoke XSSXXE
Custom Wordpress Proxy stuff
Bypass nginx deny-all when nginx is a proxy before GunicornExploit SSRF to access intranetWASM
Disassemble WASMCVE
Apache CGitlab CLaravel (PHP) LFI leading to RCE due to CVE in dependencyRCE on CoTools for CTF
Here is a list to useful tools for CTF competitions.
Network
Wireshark to analyze network connectionsWeb
Postman to make HTTP requestsOWASP ZAP for analysing website security. Features include requests analysis and forgery, fuzzing, etc...sqlmap for automatic SQL injectionwebhook for receiving requests. See Internal Support for an example of XSS attack.See UpCredit for an example of CSRF attack (without csrf token).flask-unsign for decoding, cracking and forging Flask cookies.Reverse engineering
Ghidra to decompile c code.Jagdb a C debugger and its additional functionalities gefOllyDbg a debugger for Windows programsAndroid studio to edit and analyse APK files and emulate APKApktool for re APK filesangr for symbolic execution. See writeup.PWN
pwntools a Python library for PWNpwninit for automatically starting pwn challenges.ROPGadget search for gadget and ROP chain generationlib search database for ret2lib. See also writeup 32 bits and writeup 64 bits.shellcodesSteganography
file to determine file typestrings to print all ASCII strings in filebinwalk to find embedded filesStegSolve an image solverSteg online for imagesMorse decoderMMSSTV for HAM transmissionsDigital In Ink Toolkit for imagesDeepSound for sound filesRaw Pixels an online RAW image Hexed.it to edit the bytes of a filezsteg for imagesForensics
Autopsy for device analysisAcoustic keyloggerSigidwiki a signal identification guideCryptography
It knows a lot of common cypher methods and does automatic uncypheringhlextend a Python library for length extension attacks on Merkle-Damgård hash functionsFactorize big integers with Reverse seeds gi constraints for Ja: JaSol inequalities with CSPPassword cracking
JohntheRipperOSINT
Sherlock to scrap information on social mediaWayback MachineWebpage archiveMisc
If you know the format of the flag, you can use flag_con.py to quickly have the most common encoding of the flag, so you know what to look for during the competition ;) For quick con between ASCII, decimal, base64, binary, hexadecimal and URL Same as asciitohex but more complete, with magic wand. An Ascci to decimal, hexadecimal, binary and octal tableDeal with images in Python using PIL. See example writeupCheat in WASM games: CetusDecompiler for GDScripts项目信息
开发语言：Python
Star 数：108
技术要点
该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Writeups for various CTFs competitions展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。
从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。
使用与学习建议
1. 下载源码压缩包，解压到本地环境。
2. 根据项目类型准备对应的运行环境与依赖。
3. 按照 README 中的步骤完成配置与部署。
4. 在隔离的测试环境中运行验证，避免影响生产系统。
免责声明
本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。