FortID CTF 2026 – GDB SaaS Challenge Writeup
GDB SaaS is a file disclosure challenge disguised as a free disassembly service. The server accepts a base64-encoded ELF file, copies the flag into a temporary directory beside that file, and returns GNU Debugger (GDB) output for a requested function. The solution does not run the uploaded program, corrupt memory, or inject a shell command.…
Securinets CTF Quals 2026 – Nyoom Challenge Writeup
Nyoom is a web challenge built from an Express application, a Varnish reverse proxy, and an automated administrator browser. Users can create an account, write a profile bio, and report a dashboard URL for the administrator to visit. The administrator’s session cookie is deliberately set to the flag. Solving the challenge therefore means making the…
FortID CTF 2026 – String Peek and Poke Challenge Writeup
String Peek and Poke is a Linux x86-64 pwn challenge built around a small C++ note program. A user can store a word in one of eight std::string slots, retrieve a slot, or exit. Both note commands accept a signed index without checking whether it lies between 0 and 7. That single mistake lets an…
FortID CTF 2026 – DESBox Challenge Writeup
DESBox is a source-aided cryptography challenge presented as a small MS-DOS-like shell. Its KEYB command accepts two 24-byte keys, randomly rearranges the bytes of each key, XORs both with the same secret mask, and then uses the resulting keys for two different 3DES operations: encrypting the hidden flag and decrypting one attacker-supplied ciphertext. The intended…
FortID CTF 2026 – Ultimative PHP Challenge Writeup
Ultimative PHP is a web challenge built around a single PHP 8.3 migration endpoint. A request must claim administrator access, provide two distinct recovery answers with equal fingerprints, satisfy an unusual comparison between MD5 and SHA-256 prefixes, and submit a Base64url-encoded PHP profile. The checks appear independent, but they process the same attacker-controlled query string…
SunshineCTF 2026 – Mad Libs Challenge Writeup
Mad Libs is a 64-bit Linux binary exploitation challenge built around a small program that asks for eight words and prints each answer back. The program passes every answer directly to printf as its format string. That mistake gives an attacker both an information disclosure primitive and a memory write primitive. The supplied executable is…
Hack The Box – pcalc Challenge Writeup
pcalc is a small PHP calculator packaged with its application source, web-server configuration, and Docker startup script provided. A visitor supplies an arithmetic expression through the formula query parameter and sees the calculated value in the page. Source inspection shows that the startup script moves the flag out of the web root and gives it…
SunshineCTF 2026 – Homemaker Challenge Writeup
Homemaker is a Linux binary exploitation challenge built around a small, custom command protocol. The supplied program presents itself as a domestic automaton and waits for a service key card, but the useful behavior is in its binary packet parser. A valid key unlocks commands that update and read back a stack-resident state buffer. The…
H7CTF 2026 Quals – BartBrack Challenge Writeup
BartBrack presents Flux, a business banking interface with a username and password login, a five-digit second factor, and a dashboard for balances, transactions, cards, and statements. The challenge is a black-box web application: no source archive or challenge files were provided at the start. The application exposes enough behavior through its public JavaScript, GraphQL responses,…
WebVerse Pro – Proxy Pursuit Challenge Writeup
Proxy Pursuit is a black-box web challenge set in LoadMesh’s operations console. The console displays connection records for a client IP, but it takes that IP from the HTTP X-Forwarded-For header, which a requester can influence. The challenge begins with supplied console credentials and an exposed web endpoint; the goal is to find how this…
👾 BREAKIN’ Systems WITH Rootrunners
API Application Security Authentication Bypass Binary Analysis Binary Exploitation Buffer Overflow Bypass Crypto curl CyberSecurity Decryption Docker ELF Encoding Encryption Endpoint Eschaton CTF 2026 Ethical Hacking Exploit Flask Forensics Function Ghidra HackTheBox HTML Information Disclosure Input Validation JavaScript JSON JWT Key Misc OWASP OWASP Top 10 Path Traversal payload Penetration Testing PHP PHP security Privilege Escalation Pwn pwntools Python RCE Remote Code Execution Reverse Engineering Reversing secure coding Security Research Server-Side Template Injection Shell SQLi SQL Injection SSTI Stack Buffer Overflow Vulnerability Analysis Web Web Application Security Web Exploitation Web Security XOR