my-ctf-challenges - 我创建的CTF挑战 🚩

项目说明

My CTF Challenges

A repository for CTF challenges I created. Have fun playing CTFs :sunglasses:

ToC

SECCON CTF 14 Finals

Links: CTFtime (International) / CTFtime (Domestic)

|Challenge|Category|Solved / 9<br>(International)|Solved / 9<br>(Domestic)|Difficulty|Keywords|
|:-:|:-:|:-:|:-:|:-:|:-:|
|Warpup|web|9|9|★|stream|
|DOMDOMDOMPurify|web|9|9|★|DOMPurify, mXSS|
|Shadow CSS|web|1|0|★★★|Firefox, Link|
|Slay the Note|web|0|0|★★★|cookie parser|
|increasing|jail|4|4|★★|pyjail|

SECCON CTF 14 Quals

Links: CTFtime

|Challenge|Category|Sol|Writeup|Keywords|
|:-:|:-:|:-:|:-:|:-:|:-:|
|framed-xss|web|7|★★★★|-|Chrome, request initiator|
|impossible-leak|web|1|★★★★★|link|XSLeak, ETag|
|broken-json|jail|166|★|-|jsjail|
|excepython|jail|69|★★|-|pyjail|
|proxy-chain|jail|3|★★★★|-|jsjail, Proxy|

ICC TOKYO 2025

Links: Website / Official Repository

|Challenge|Category|Solved / 8|Difficulty|Writeup|Keywords|
|:-:|:-:|:-:|:-:|:-:|:-:|
|XSP-Leak|web|4|★★★|link|XSLeak|

ASIS CTF Quals 2025

Links: CTFtime

|Challenge|Category|Sol|Writeup|Keywords|
|:-:|:-:|:-:|:-:|:-:|:-:|
|pure-leak|web|2|★★★★|link|quirks mode, CSS injection|

IERAE CTF 2025

Links: CTFtime

|Challenge|Category|Sol|Writeup|Keywords|
|:-:|:-:|:-:|:-:|:-:|:-:|
|Warmdown|web|135|★|link (ja)|XSS|
|can|web|16|★★★|link (ja)|DOM, sandbox|

AlpacaHack Round 11 (Web)

An indi competition in 6 hours.

Links: CTFtime / Website

|Challenge|Category|Sol|Keywords|
|:-:|:-:|:-:|:-:|:-:|
|Jackpot|web|63|-|Python, Unicode|
|Redirector|web|6|-|XSS, Ja|
|Tiny Note|web|4|-|pickle|
|AlpacaMark|web|3|link|DOM Clobbering, PP, iframe|
|AlpacaMark Revenge|web|(Published after the CTF)|link|DOM Clobbering, PP, iframe|

SECCON CTF 13 Finals

Links: CTFtime (International) / CTFtime (Domestic)

|Challenge|Category|Solved / 9<br>(International)|Solved / 9<br>(Domestic)|Difficulty|Keywords|
|:-:|:-:|:-:|:-:|:-:|:-:|
|purexss|web|4|1|★★|XSS, ISO-2022-JP|
|twisty-xss|web|3|0|★★★|XSS, puzzle|
|witchnote|web|1|0|★★★|XSS, disk cache|
|pp3|jail|0|0|★★★|jsf**k, prototype pollution|

ASIS CTF Finals 2024

Links: CTFtime

|Challenge|Category|Sol|Writeup|Keywords|
|:-:|:-:|:-:|:-:|:-:|:-:|
|fetch-box|web, misc|19|★★|link|fetch, sandbox|
|fire-leak|web|1|★★★★|link|XSLeak, ReDoS|

AlpacaHack Round 7 (Web)

An indi competition in 6 hours.

Links: CTFtime / Website

|Challenge|Category|Sol|Keywords|
|:-:|:-:|:-:|:-:|:-:|
|Treasure Hunt|web|71|link (ja)|URL encoding|
|minimal-waf|web|4|link (ja)|XSS|
|disconnection|web|5|TODO|browser behavior|
|disconnection-revenge|web|1|TODO|browser behavior|

SECCON CTF 13 Quals

Links: CTFtime

|Challenge|Category|Sol|Keywords|Co-Author|
|:-:|:-:|:-:|:-:|:-:|:-:|
|Trillion Bank|web|84|★|MySQL||
|self-ssrf|web|23|★★|URL parser, Bun||
|double-parser|web|17|★★|HTML parser, XSS||
|pp4|jail|41|★|jsf**k, prototype pollution||
|1linepyjail|jail|15|★★|pyjail||
|Go to Jail|jail|6|★★★|Go, polyglot, code golf||
||jail|3|★★★★|Ja, sandbox escape|Satoooon|

IERAE CTF 2024

Links: CTFtime

|Challenge|Category|Sol|writeup|Keywords|
|:-:|:-:|:-:|:-:|:-:|:-:|
|5|misc|8|★|-|Bun|
|Leak! Leak! Leak!|web|3|★★★★|link (ja)|XS-Leak, CSP|

AlpacaHack Round 2 (Web)

An indi competition in 6 hours.

Links: CTFtime / Website

|Challenge|Category|Sol|Keywords|
|:-:|:-:|:-:|:-:|:-:|
|Simple Login|web|84|link (ja)|SQL injection|
|Pico Note 1|web|10|link (ja)|CSP bypass, Ja|
|CaaS|web|13|link (ja)|RCE, Perl|
|Pico Note 2|web|3|link (ja)|Import Maps|

SECCON CTF 2023 Finals

Links: CTFtime (International) / CTFtime (Domestic)

|Challenge|Category|Solved / 12<br>(International)|Solved / 12<br>(Domestic)|Difficulty|Writeup|Keywords|
|:-:|:-:|:-:|:-:|:-:|:-:|:-:|
|babywaf|web|8|4|★|link|WAF bypass|
|cgi-2023|web|5|2|★★★|link|XS-Leak, subresource integrity|
|LemonMD|web|2|1|★★★|link|Fresh, Islands Architecture|
|DOMLeakify|web|1|0|★★★★★|link|CSS injection on style attributes|
|whitespace.js|misc|2|2|★★|link|Ja sandbox|

IERAE DAYS CTF 2023

An onsite local event: Thu, 7 Dec. 2023

Links: Repository

|Challenge|Category|Keywords|
|:-:|:-:|:-:|
|simple-proxy|web|request target|

SECCON CTF 2023 Quals

Links: CTFtime

|Challenge|Category|Solved / 653|Difficulty|Writeup|Keywords|
|:-:|:-:|:-:|:-:|:-:|:-:|
|blink|web|14|★★|link|DOM clobbering|
|eeeeejs|web|12|★★★|link|ejs, XSS puzzle|
|hidden-note|web|1|★★★★★|link|XS-Leak, unstable sort|
|crabox|sandbox|53|★|link|Rust sandbox|
|node-ppjail|sandbox|5|★★★|link|prototype pollution|
|deno-ppjail|sandbox|2|★★★★|link|prototype pollution|

SECCON CTF 2022 Finals

Links: CTFtime (International) / CTFtime (Domestic)

|Challenge|Category|Solved / 10<br>(International)|Solved / 12<br>(Domestic)|Difficulty|Writeup|Keywords|
|:-:|:-:|:-:|:-:|:-:|:-:|:-:|
|babybox|web|6|4|★|link|prototype pollution|
|easylfi2|web|10|8|★|link|LFI, curl|
|MaaS|web|3|1|★★★|link|newline normalization, CSP bypass|
|light-note|web|0|0|★★★|link|DOM clobbering, Sanitizer API|
|dark-note|web|0|0|★★★★|link|time-based oracle|

SECCON CTF 2022 Quals

Links: CTFtime

|Challenge|Category|Solved / 726|Difficulty|Writeup|Keywords|
|:-:|:-:|:-:|:-:|:-:|:-:|
|skipinx|web|102|★|link|query parser|
|easylfi|web|62|★|link|LFI, curl|
|bffcalc|web|41|★★|link|HTTP request splitting|
|piyosay|web|19|★★★|link|Trusted Types, DOMPurify, RegExp|
|denobox|web|1|★★★★|link|prototype pollution, import maps |
|spanote|web|1|★★★★★|link|Chrome, disk cache, bfcache|
|latexipy|misc|8|★★|link|pyjail, magic comment|
|txtchecker|misc|23|★★|link|magic file, ReDoS|
|noiseccon|misc|22|★★|link|Perlin noise|

SECCON CTF 2021

Links: CTFtime

|Challenge|Category|Solved / 506|Difficulty|Writeup|Keywords|
|:-:|:-:|:-:|:-:|:-:|:-:|
|Sequence as a Service 1|web|20|★★|link|Ja sandbox|
|Sequence as a Service 2|web|19|★|link|Ja sandbox|
|Cookie Spinner|web|7|★★★|link|DOM clobbering|
|x-note|web|3|★★★★|link|XS-Search|

项目信息

开发语言：JavaScript

Star 数：87

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕CTF challenges I created 🚩展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。