CTF Challenges

• Agent Jailbreak: misc/hard
• Encoding Leak: misc/medium
• Document Trap: misc/hard
• AES-ECB Postcard: crypto/medium
• Base64 Inception: crypto/easy
• Bleichenbacher Oracle: crypto/hard
• Caesar's Greeting: crypto/easy
• CBC Bit-Flip: crypto/hard
• ChaCha20 Nonce Reuse: crypto/medium
• AES-CTR IV Reuse: crypto/medium
• AES-GCM Nonce Reuse: crypto/hard
• Hastad Broadcast: crypto/hard
• HMAC Timing Oracle: crypto/hard
• Hash Length Extension: crypto/hard
• Deceptive Manifest: crypto/easy
• Many-Time Pad: crypto/medium
• Padding Oracle: crypto/hard
• RSA Common Modulus: crypto/hard
• Predictable Tokens: crypto/medium
• XOR Frequency: crypto/medium
• Linux auditd: forensics/medium
• Browser History: forensics/easy
• Disk Image Carve: forensics/medium
• Phishing Email: forensics/easy
• Windows Event Log: forensics/easy
• Hidden in Plain Sight: forensics/medium
• Memory Dump: forensics/easy
• Captured Login (PCAP): forensics/easy
• USN Journal: forensics/easy
• VBA Macro Malware: forensics/medium
• Memory Image: forensics/medium
• ZIP of Shame: forensics/easy
• UART Trace: misc/medium
• Cloud Kill Chain: misc/insane
• ECDSA Nonce Reuse: misc/insane
• Note Manager (Heap UAF): misc/insane
• HTTP Smuggling (CL.TE): misc/insane
• DAO Reentrancy: misc/insane
• The Heist: misc/insane
• VM Bytecode Reverse: misc/insane
• Brainfuck: misc/easy
• Polyglot Postcard: misc/medium
• Acme Ledger APK: misc/easy
• Acme Mobile (iOS): misc/easy
• ARP Spoofing: misc/medium
• Recon Lab: misc/easy
• Vacation Photo (EXIF): misc/easy
• Echo Service (Fmt Str): pwn/medium
• Echo Service (ret2libc): pwn/hard
• Stack Classic: pwn/medium
• Protected Binary: rev/hard
• .NET Keygen: rev/medium
• Keygen Me: rev/medium
• Packed Secret: rev/hard
• Acme WASM: rev/medium
• Acme Search (Cache Poison): web/hard
• NetTools Ping (CmdI): web/medium
• Cookie Monster: web/easy
• Acme Account (CORS): web/medium
• Bookmarks (CRLF): web/medium
• Acme Bank (CSRF): web/medium
• Acme Card (DOM XSS): web/medium
• Image Hosting (Upload): web/hard
• Acme Session (Flask Cookie): web/medium
• GraphQL Batch (Rate Bypass): web/medium
• GraphQL Playground: web/medium
• Acme Notes (IDOR): web/easy
• JWT Key Confusion: web/hard
• JWT kid Injection: web/hard
• JWT alg=none: web/hard
• Acme Directory (LDAP): web/medium
• Acme News (LFI): web/easy
• Template Loader (LFI Wrapper): web/hard
• Acme Signup (Mass Assign): web/medium
• JSON Login (NoSQL): web/medium
• OAuth Confused Deputy: web/hard
• Session Restore (Pickle): web/hard
• Settings Merge (Proto Pollution): web/hard
• Wallet (Race Condition): web/hard
• SAML XSW: web/hard
• Acme Lookup (Blind SQLi): web/hard
• SQLi Lite: web/medium
• Acme Pages (SSI): web/medium
• URL Inspector (Gopher SSRF): web/hard
• URL Preview (SSRF): web/medium
• Greeting Card (SSTI): web/hard
• Subdomain Takeover: web/medium
• WS Console (auth): web/medium
• Guestbook (Stored XSS): web/medium
• RSS Importer (XXE): web/medium