my-ctf-challenges - a repository of all the CTF challenges I've made f

项目说明

my-ctf-challenges

This is the repository of all the CTF challenges I've made / helped develop for public events.

Message me on Discord at strellic if you have any questions.

RaRCTF 2021

| Name | Category | Solves | Difficulty | Keywords |
| --------------------------------------------------- | --------- | ---------- | ---------- | ------------------------------------------------------------ |
| SecureStorage | web | 15 | ★★★☆☆ | xss, postMessage |

corCTF 2021

| Name | Category | Solves | Difficulty | Keywords |
| --------------------------------------------------- | --------- | ---------- | ---------- | ------------------------------------------------------------ |
| babyrev | rev | 203 | ★☆☆☆☆ | simple rev, xor, memfrob |
| smogofwar | misc | 7 | ★★☆☆☆ | chess ai, stockfish, fog of war, sockets |
| flagbot | misc | 23 | ★★☆☆☆ | discord bot, youtube, restricted en, traffic sniffing |
| buyme | web | 110 | ★☆☆☆☆ | unsafe destructuring |
| phpme | web | 64 | ★★☆☆☆ | php, content-type confusion, lax+post |
| readme | web | 46 | ★★☆☆☆ | unsafe js eval, js |
| blogme | web | 2 | ★★★★☆ | xss, cloudflare csp bypass, service workers |
| msgme | web | 1 | ★★★★☆ | xss, websockets, webrtc csp bypass, command chaining |
| saasme | web | 2 | ★★★★☆ | dns rebinding, protocol smuggling, chrome remote debugging protocol |
| styleme | web | 1 | ★★★★★ | chrome extension, prototype pollution, no |

HackTheBox

You can find these challenges on the HackTheBox website.
| Name | Category | Solves / Blood Time | Difficulty | Keywords |
| --------------------------------------------------- | --------- | ---------- | ---------- | ------------------------------------------------------------ |
| AnalyticalEngine | web | 1 solve at CTF end | ★★★★☆ | htb uni ctf, xss, novel dom clobbering, csp bypass |
| OOPArtDB | web | 3d, 22hr for blood | ★★★★☆ | ? (active HTB challenge) |

DiceCTF 2022

| Name | Category | Solves | Difficulty | Keywords |
| --------------------------------------------------- | --------- | ---------- | ---------- | ------------------------------------------------------------ |
| noteKeeper | web | 2 | ★★★★★ | xss, JSONP, service workers, sec-fetch-dest, MediaRecorder |
| | web | 2 | ★★★☆☆ | js trivia, vm2, C |
| denoblog | web | 3 | ★★★★☆ | deno, ejs, nginx temp file buffering, deno sbx escape, pwn |

1337UP LIVE CTF

This was a CTF I wrote challenges for, hosted by Intigriti. I forgot to record sol. I cowrote these challenges with BrunoZero.

| Name | Category | Solves | Difficulty | Keywords |
| --------------------------------------------------- | --------- | ---------- | ---------- | ------------------------------------------------------------ |
| DeadTube | web | many | ★☆☆☆☆ | dns rebinding, ssrf, redirect |
| contact-alex | web | 7? | ★★☆☆☆ | jwt, xss, path tra, ssti |

DiceCTF @ HOPE 2022

| Name | Category | Solves | Difficulty | Keywords |
| --------------------------------------------------- | --------- | ---------- | ---------- | ------------------------------------------------------------ |
| payment-pal | web | 3 | ★★★☆☆ | prototype pollution, caching, xss, history, aes |

corCTF 2022

| Name | Category | Solves | Difficulty | Keywords |
| --------------------------------------------------- | --------- | ---------- | ---------- | ------------------------------------------------------------ |
| jsonquiz | web | 573 | ★☆☆☆☆ | baby, POST request |
| simplewaf | web | 28 | ★★☆☆☆ | WAF bypass, NodeJS source reading |
| rustshop | web | 13 | ★★★☆☆ | Rust, Axum library, deserialization |
| modernblog | web | 1 | ★★★★★ | React, CSS injection, novel DOM clobbering |
| babypwn | pwn | 114 | ★☆☆☆☆ | Rust, unsafe, printf, ret2libc |
| solidarity | pwn | 6 | ★★☆☆☆ | baby solana, account confusion, missing checks |
| sbxcalc | pwn | 11 | ★★★☆☆ | vm2, js calculator, proxy, golf |

SekaiCTF 2022

| Name | Category | Solves | Difficulty | Keywords |
| --------------------------------------------------- | --------- | ---------- | ---------- | ------------------------------------------------------------ |
| Crab Commodities | web | 30 | ★★★☆☆ | Rust, race condition, o |
| Safelist | web | 3 | ★★★★☆ | XS-leak, DOMPurify, connection pool |
| Obligatory Calc | web | 1 | ★★★★★ | XSS, postMessage, DOM clobbering, null origin sandboxing |

Real World CTF 2023

| Name | Category | Solves | Difficulty | Keywords |
| --------------------------------------------------- | --------- | ---------- | ---------- | ------------------------------------------------------------ |
| the cult of 8 bit | web | ?? | ★★★★☆ | XSS, SOME, CSP, iframe allow attribute |

DiceCTF 2023

| Name | Category | Solves | Difficulty | Keywords |
| --------------------------------------------------- | --------- | ---------- | ---------- | ------------------------------------------------------------ |
| recursi | web | 178 | ★☆☆☆☆ | xss, PHP, CSP nonce, crc32 |
| unfinished | web | 14 | ★★★☆☆ | express, mongodb wire protocol, curl, ssrf |
| jwtjail | web | 3 | ★★★★☆ | nodejs, jail, process.binding, |
| chess.rs | pwn | 2 | ★★★★★ | rust, wasm, uaf, unsoundness, no unsafe |

corCTF 2023

| Name | Category | Solves | Difficulty | Keywords |
| --------------------------------------------------- | --------- | ---------- | ---------- | ------------------------------------------------------------ |
| crabspace | web | 4 | ★★★★☆ | rust, xss, WebRTC, side-channel |
| leakynote | web | 3 | ★★★★☆ | xs-leaks, timing attack |
| pdf-pal | web | 2 | ★★★★★ | PDF, dns rebinding |
| baby-wallet | blockchain | 24 | ★☆☆☆☆ | solidity |
| tribunal | blockchain | 10 | ★★★☆☆ | solana, bump seed canonicalization |
| touch-grass | misc | 89 | ★★★★★ | grass, impossible |
| msfrogofwar2 | misc | 5 | ★★★☆☆ | chess, frogs |

SekaiCTF 2023

| Name | Category | Solves | Difficulty | Keywords |
| --------------------------------------------------- | --------- | ---------- | ---------- | ------------------------------------------------------------ |
| Golf Jail | web | 16 | ★★★☆☆ | xss, golf, WebRTC |
| Leakless Note | web | 4 | ★★★★★ | xs-leaks, timing attack, postMessage |

DiceCTF Quals 2024

| Name | Category | Solves | Difficulty | Keywords |
| --------------------------------------------------- | --------- | ---------- | ---------- | ------------------------------------------------------------ |
| funnylogin | web | 269 | ★☆☆☆☆ | sqli, js |
| safestlist | web | 2 | ★★★★★ | xs-leak |
| burnbin | web | 1 | ★★★★★ | xs-leak |

osu!gaming CTF 2024

| Name | Category | Solves | Difficulty | Keywords |
| --------------------------------------------------- | --------- | ---------- | ---------- | ------------------------------------------------------------ |
| profile-page | web | 190 | ★☆☆☆☆ | XSS |
| missanalyzer | pwn | 84 | ★☆☆☆☆ | printf |
| stream-vs | web | 79 | ★★☆☆☆ | websockets |
| pp-ranking | web | 20 | ★★★☆☆ | ja moment |
| profile-page-revenge | web | 10 | ★★★☆☆ | XSS |

DiceCTF Finals 2024

| Name | Category | Solves | Difficulty | Keywords |
| --------------------------------------------------- | --------- | ---------- | ---------- | ------------------------------------------------------------ |
| babyleak | jeopardy web | 0 | ★★★★☆ | xsleak |
| dice-diary | ad web | N/A | ★☆☆☆☆ | nextjs |

corCTF 2024

| Name | Category | Solves | Difficulty | Keywords |
| --------------------------------------------------- | --------- | ---------- | ---------- | ------------------------------------------------------------ |
| touch grass 2 | misc | 60 | ★★★★★ | grass, impossible |
| erm | web | 60 | ★★☆☆☆ | ORM injection |
| cormine | rev | 18 + 8 | ★★★☆☆ | rust, minecraft, bevy |
| msfrogofwar3 | misc | 4 | ★★★☆☆ | stockfish, SSTI, rce |
| iframe-note | web | 2 | ★★★★★ | gunicorn, prototype pollution, XSS |
| repayment-pal | web | 0 | ★★★★★ | nextjs, prototype pollution |

Blue Water CTF 2024

| Name | Category | Solves | Difficulty | Keywords |
| --------------------------------------------------- | --------- | ---------- | ---------- | ------------------------------------------------------------ |
| bluenote | web | 1 | ★★★★★ | xsleak |

ASIS CTF Finals 2024

| Name | Category | Solves | Difficulty | Keywords |
| --------------------------------------------------- | --------- | ---------- | ---------- | ------------------------------------------------------------ |
| leakbin | web | 1 | ★★★★☆ | xsleak |
| more-letters | web | 0 | ★★★★★ | CSRF, origin header |

DiceCTF Quals 2025

| Name | Category | Solves | Difficulty | Keywords |
| --------------------------------------------------- | --------- | ---------- | ---------- | ------------------------------------------------------------ |
| nobin | web | 32 | ★★☆☆☆ | shared storage |
| dicepass | web | 3 | ★★★★★ | chrome extension, dom clobbering |

DiceCTF Finals 2025

| Name | Category | Solves | Difficulty | Keywords |
| --------------------------------------------------- | --------- | ---------- | ---------- | ------------------------------------------------------------ |
| connections | web | 2 | ★★★☆☆ | next.js, ser |
| cuearr | web | 2 | ★★★★☆ | css injection, attr |

项目信息

开发语言：JavaScript

Star 数：63

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕a repository of all the CTF challenges I've made for public events展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。