Habtemariam
ChuchuLet’s talk
Navigation menu
Back to portfolio

CTF FIELD NOTES

Follow the evidence.
Understand the weakness.

Challenge write-ups across web security, cryptography, binary exploitation, reverse engineering, forensics and more. A record of the approach, the details that mattered and the lessons to carry forward.

Tibeb / QIYAS CTF

CTF write-up collection

All 30 write-ups are shown below. Use your browser’s Find option to search by challenge or topic.

Showing 30 of 30 write-ups

Web100 pts

Old Paper

Follow an HTML comment and a robots.txt clue to uncover a retired archive note.

  • Reconnaissance
  • HTML source
  • robots.txt
Web200 pts

Catalogue of Secrets

Trace a one-column SQLite search into a UNION-based SQL injection and recover the hidden record.

  • SQL injection
  • SQLite
  • UNION SELECT
Web150 pts

Someone Else’s Receipt

Use a leaked invoice reference to examine a missing object-level authorization check.

  • IDOR
  • Access control
  • Authorization
Web300 pts

Pass Office

Read the JWT verification routine and identify a signature bypass through an unverified algorithm.

  • JWT
  • Authentication
  • alg=none
Web400 pts

The Template Loom

Investigate Jinja2 template injection and compare the access forms accepted by the challenge.

  • SSTI
  • Jinja2
  • Input filtering
Cryptography

Shift Change

Recover a Caesar shift from the known flag prefix while leaving punctuation and digits intact.

  • Caesar cipher
  • Known plaintext
  • Python
Cryptography

One Pad, Two Letters

Recover a reused one-time-pad keystream from a known dispatch and decode a second message.

  • One-time pad
  • XOR
  • Keystream reuse
Cryptography

Shared Workshop

Factor two RSA moduli with a shared prime using a greatest-common-divisor calculation.

  • RSA
  • Shared prime
  • GCD
Cryptography

Correction Window

Use a zero-plaintext edit to recover the keystream of an AES-CTR encrypted memo.

  • AES-CTR
  • Edit oracle
  • XOR
Cryptography

Nonce Echo

Recover a DSA private key from reused-nonce signatures, verify it, and decode the sealed message.

  • DSA
  • Nonce reuse
  • Modular arithmetic
Binary exploitation

Narrow Counter

Turn a 16-bit ticket-total truncation into a modular inverse problem.

  • Integer truncation
  • C
  • Modular inverse
Binary exploitation250 pts

Printf Post

Recover flag bytes from variadic arguments exposed by an uncontrolled printf format string.

  • Format string
  • printf
  • Stack inspection
Binary exploitation300 pts

Night Return

Analyze the challenge’s stack layout and redirect a saved return address to the reward function.

  • Buffer overflow
  • ret2win
  • x86-64
Binary exploitation400 pts

Borrowed Badge

Follow a dangling heap pointer and the observed allocation reuse to replace a badge’s fields.

  • Use-after-free
  • Heap allocation
  • Struct layout
Binary exploitation500 pts

Two Seals

Build a small ROP chain that supplies two arguments to the vault function.

  • ROP
  • Calling convention
  • Stack alignment
Reverse engineering

XOR Gate

Read an ELF checker’s disassembly and invert its bytewise XOR comparison.

  • ELF
  • Disassembly
  • XOR
Reverse engineering250 pts

Tiny Rotor

Reverse a byte transformation that combines a rotation, an XOR, and an index-dependent value.

  • Bit rotation
  • Checker analysis
  • Python
Reverse engineering

Museum Machine

Decode a custom virtual machine’s instruction set and reconstruct the input checked by its bytecode.

  • Virtual machine
  • Bytecode
  • Instruction decoding
Reverse engineering

Pocket WebAssembly

Inspect a WebAssembly module’s data and check routine to recover its expected input.

  • WebAssembly
  • WASM
  • Static analysis
Reverse engineering

Sixteen Brass Dials

Model the checker as modular linear equations and reconstruct its 37-byte input.

  • Linear equations
  • Modular arithmetic
  • Checker analysis
Forensics100 pts

After the Last Pixel

Find a ZIP archive appended after a PNG’s IEND chunk, carve it, and decode its message.

  • PNG
  • File carving
  • Appended archive
Forensics250 pts

The Logbook

Filter a transfer from noisy logs and reassemble its Base64 chunks by sequence number.

  • Log analysis
  • Sequence reconstruction
  • Base64
Forensics

Postcards in DNS

Reassemble numbered DNS query labels after removing retries and background traffic.

  • DNS
  • PCAP
  • Base32
Forensics300 pts

Pixel Weave

Recover a hidden message from an image’s red-channel bits and a four-byte length header.

  • Steganography
  • LSB
  • Image analysis
Forensics400 pts

Erased Ledger

Inspect SQLite free pages and recover a deleted dispatch envelope from the database bytes.

  • SQLite
  • Deleted data
  • Freelist recovery
Miscellaneous150 pts

Campus Footprints

Filter a fictional campus archive by room and time, then select the latest revision for each seal.

  • JSON
  • Archive filtering
  • Revision selection
Miscellaneous

Matryoshka Parcel

Follow magic bytes through gzip, Base64, bzip2, and ZIP layers to reach the final dispatch.

  • Magic bytes
  • Compression
  • Nested encoding
Miscellaneous300 pts

Midnight Signal

Inspect an audio signal, decode its Morse timing, and recover the Base32 message it spells.

  • Audio analysis
  • Morse code
  • Signal timing
Miscellaneous300 pts

Repair Shop

Correct single-bit errors in Hamming(7,4) codewords and reconstruct the transmitted bytes.

  • Hamming code
  • Error correction
  • Bit layout
Miscellaneous

Caravan Routes

Find the cheapest directed route with Dijkstra’s algorithm and join its edge labels.

  • Dijkstra
  • Graph algorithms
  • Shortest path