CTF Challenges

• Agent Jailbreak — misc/hard
• Encoding Leak — misc/medium
• Document Trap — misc/hard
• AES-ECB Postcard — crypto/medium
• Base64 Inception — crypto/easy
• Bleichenbacher Oracle — crypto/hard
• Caesar's Greeting — crypto/easy
• CBC Bit-Flip — crypto/hard
• ChaCha20 Nonce Reuse — crypto/medium
• AES-CTR IV Reuse — crypto/medium
• AES-GCM Nonce Reuse — crypto/hard
• Hastad Broadcast — crypto/hard
• HMAC Timing Oracle — crypto/hard
• Hash Length Extension — crypto/hard
• Deceptive Manifest — crypto/easy
• Many-Time Pad — crypto/medium
• Padding Oracle — crypto/hard
• RSA Common Modulus — crypto/hard
• Predictable Tokens — crypto/medium
• XOR Frequency — crypto/medium
• Linux auditd — forensics/medium
• Browser History — forensics/easy
• Disk Image Carve — forensics/medium
• Phishing Email — forensics/easy
• Windows Event Log — forensics/easy
• Hidden in Plain Sight — forensics/medium
• Memory Dump — forensics/easy
• Captured Login (PCAP) — forensics/easy
• USN Journal — forensics/easy
• VBA Macro Malware — forensics/medium
• Memory Image — forensics/medium
• ZIP of Shame — forensics/easy
• UART Trace — misc/medium
• Cloud Kill Chain — misc/insane
• ECDSA Nonce Reuse — misc/insane
• Note Manager (Heap UAF) — misc/insane
• HTTP Smuggling (CL.TE) — misc/insane
• DAO Reentrancy — misc/insane
• The Heist — misc/insane
• VM Bytecode Reverse — misc/insane
• Brainfuck — misc/easy
• Polyglot Postcard — misc/medium
• Acme Ledger APK — misc/easy
• Acme Mobile (iOS) — misc/easy
• ARP Spoofing — misc/medium
• Recon Lab — misc/easy
• Vacation Photo (EXIF) — misc/easy
• Echo Service (Fmt Str) — pwn/medium
• Echo Service (ret2libc) — pwn/hard
• Stack Classic — pwn/medium
• Protected Binary — rev/hard
• .NET Keygen — rev/medium
• Keygen Me — rev/medium
• Packed Secret — rev/hard
• Acme WASM — rev/medium
• Acme Search (Cache Poison) — web/hard
• NetTools Ping (CmdI) — web/medium
• Cookie Monster — web/easy
• Acme Account (CORS) — web/medium
• Bookmarks (CRLF) — web/medium
• Acme Bank (CSRF) — web/medium
• Acme Card (DOM XSS) — web/medium
• Image Hosting (Upload) — web/hard
• Acme Session (Flask Cookie) — web/medium
• GraphQL Batch (Rate Bypass) — web/medium
• GraphQL Playground — web/medium
• Acme Notes (IDOR) — web/easy
• JWT Key Confusion — web/hard
• JWT kid Injection — web/hard
• JWT alg=none — web/hard
• Acme Directory (LDAP) — web/medium
• Acme News (LFI) — web/easy
• Template Loader (LFI Wrapper) — web/hard
• Acme Signup (Mass Assign) — web/medium
• JSON Login (NoSQL) — web/medium
• OAuth Confused Deputy — web/hard
• Session Restore (Pickle) — web/hard
• Settings Merge (Proto Pollution) — web/hard
• Wallet (Race Condition) — web/hard
• SAML XSW — web/hard
• Acme Lookup (Blind SQLi) — web/hard
• SQLi Lite — web/medium
• Acme Pages (SSI) — web/medium
• URL Inspector (Gopher SSRF) — web/hard
• URL Preview (SSRF) — web/medium
• Greeting Card (SSTI) — web/hard
• Subdomain Takeover — web/medium
• WS Console (auth) — web/medium
• Guestbook (Stored XSS) — web/medium
• RSS Importer (XXE) — web/medium