A curated collection of hands-on Capture the Flag writeups documenting my approach to web exploitation, binary exploitation, cryptography, forensics, scripting, Linux, Git, and general security problem solving.
Published writeups in this repository: 48
These notes were originally written for self-revision. They are kept public as a record of practical learning and to help others understand the reasoning process behind each challenge.
| Challenge | Area | Why it is useful |
|---|---|---|
| Format String 0 | Binary exploitation | Introductory format-string exploitation |
| Heap 0 | Binary exploitation | Heap memory corruption fundamentals |
| PIE Time | Binary exploitation | Address randomization / PIE reasoning |
| SSTI 1 | Web exploitation | Server-side template injection |
| Intro to Burp | Web exploitation | Web request interception and manipulation |
| Even RSA Can Be Broken | Cryptography | RSA weakness / cryptographic reasoning |
| Ph4nt0m1ntrud3r | Forensics | Forensic investigation |
| Secret of the Polyglot | Forensics | File-format / forensic analysis |
The grouping below reflects the primary skill demonstrated by each challenge; some challenges naturally span more than one category.
- Ascii
- Based
- Binhexa
- Evenrsacanbebroken
- Hashcrack
- Interendec
- Lacifrade
- Morse Code
- Readmycert
- Repetitions
- Rotation
- Safe Encoder
- Tapping
- Vigenere
- Binarysearch
- Blamegame
- Collaborativedevelopment
- Commitmentissues
- Endianness
- Fantasy
- Fixme1
- Fixme2
- Flaghunters
- Magikarpgroundmission
- Rustfixme1
- Rustfixme2
- Rustfixme3
- Serpentine
- Superssh
Each writeup is intended to preserve the key reasoning, commands, tools, and lesson from the challenge rather than simply record a flag. The collection is useful for revisiting techniques and tracking growth across different areas of cybersecurity.
Most writeups currently come from picoCTF, with additional notes from other hands-on security practice where relevant.
These writeups document intentionally vulnerable CTF environments and educational security exercises. Techniques should only be used against systems you own or are explicitly authorized to test.
- Challenge names and materials remain the property of their respective platforms and authors.
- Some older writeups are intentionally concise because they began as personal revision notes.
- The repository is periodically curated as new challenges and techniques are added.