Proving a stripped validator is secret-independent, re-implementing its integrity VM and XOR keystream, then taking the uncapped base credit path the 40000 bonus cap was there to hide
Separating 50 decoy case-flips from 29 real substitutions by aligning two files on their lowercased form with difflib
Peeling 1000 nested archive layers by magic byte, using the fact that 7-zip leaves its filename table readable to recover each layer password
Carving an SD-card image with debugfs, then pulling a QEMU machine model, an XOR-encoded cloud endpoint, and a hidden debug-exec opcode out of the same IoT firmware
Winning a double-fetch race in a Windows capture driver, where the bump allocator alignment that blocks a single-threaded overflow becomes the thing that guarantees the corruption lands
Chaining a libinjection-evading second-order SQLi into a PostGIS BAG TEMPLATE gopher SSRF, rewriting Patroni config in unauthenticated etcd to get archive_command RCE
Slipping past a single non-recursive ../ strip with a nested ....// sequence to read a file outside the served directory
Three Next.js edge-vs-node desyncs chained: the nxtP query prefix, duplicate-cookie precedence, and a middleware matcher blind to assetPrefix
Escaping a Lua 5.5 bytecode sandbox by writing registers past the end of the stack, hijacking a table array pointer, and swapping global_State.frealloc for system
Sidestepping a capstone control-flow jailer by handing native-compile a filename instead of a lambda, so the byte compiler reads flag.txt as Lisp and names it in an undefined-variable warning
Steering a byte-CNN malware classifier to a benign verdict with an adversarial comment, then escaping a Java SecurityManager through the trusted MethodHandles lookup
Turning a CKKS Chebyshev sign oracle into a 50-bit binary search using ciphertext additions only, with exact rational interval tracking
Declaring an axiom to fabricate false proofs, turning Lean 4 proof-carrying array accessors into arbitrary memory reads, and forging a closure object to call readFile
Cracking 20 rounds of monoalphabetic substitution across ten languages with space-aware quadgram hill-climbing and a dictionary polish pass
When softplus weights make every added byte incriminating, rewriting a Java SecurityManager escape token by token until a byte-CNN calls it benign
Decoding a flag from the red channel of every frame in an mp4
Escaping a space-stripping shell with no PATH using brace expansion and absolute paths
Five git forensics challenges on one repo: hidden commit messages, odd authorship, mistagged releases, deleted blobs, and replace refs
Carving a PNG plus ZIP plus PDF polyglot to reassemble a three-part flag
Beating an event-handler blocklist and a strict CSP with an onfocus payload and a top-level navigation leak
Bypassing a no-lowercase no-symbol bash jail with tilde-plus and question-mark globs to run the flag script
Polluting a Python module global through a recursive merge to flip the give_flag switch and unlock the flag
Writeup for D's Signpost from NDIAS Automotive/IoT CTF 2026. Five overlapping transmissions at 915 MHz hide Morse hints, an FM voice hint, an AX.25/APRS password, and a DQPSK-encoded password-protected ZIP.
Writeup for Gate to the Past from NDIAS Automotive/IoT CTF 2026. Decrypting an old OpenSSH 4.3 session by exploiting CVE-2008-0166, the Debian OpenSSL weak PRNG, to recover the DH private exponent.
Writeup for Map data from NDIAS Automotive/IoT CTF 2026. Streaming a million-tile 7z archive through a fixed-size PNG splitter and using a label-pixel anomaly check to find the one tile whose label starts with FLAG.
Writeup for Weird config updater from NDIAS Automotive/IoT CTF 2026. A ZIP parser-differential between the validation and extraction paths lets a debug config slip through a release-only check.
Writeup for Classic KeeLoq Garage Find the Key from NDIAS Automotive/IoT CTF 2026. Recovering a 64-bit KeeLoq DeviceKey from RF captures using the legacy SEED || (SEED XOR SERIAL) derivation.
Writeup for Classic KeeLoq Garage Next HOP from NDIAS Automotive/IoT CTF 2026. Using the recovered DeviceKey to predict the next valid Classic KeeLoq OPEN frame.
Writeup for Next Counter from NDIAS Automotive/IoT CTF 2026. Manchester-decoding Falcon X1 Unlock frames, recovering the monotone counter, and predicting the next valid frame.
Writeup for Parking Lot Whisper from NDIAS Automotive/IoT CTF 2026. Identifying the carrier frequency, modulation, and chip period of a 433 MHz Falcon X1 keyfob IQ capture.
Writeup for Predict Next UNLOCK from NDIAS Automotive/IoT CTF 2026. Recovering the per-press 16-bit auxiliary delta to predict the next extended Falcon X1 Unlock frame.
Writeup for Read the simple fob from NDIAS Automotive/IoT CTF 2026. Manchester-decoding the Falcon X1 Unlock burst and reading the Device ID out of the wire frame.
Writeup for Real KeeLoq Garage Normal Learn from NDIAS Automotive/IoT CTF 2026. Recovering an HCS301 DeviceKey from a 250 µs Manchester capture using the HCS301 Normal Learn derivation.
Writeup for Real KeeLoq Garage Next HOP from NDIAS Automotive/IoT CTF 2026. Predicting the next valid HCS301 logical OPEN frame using the recovered DeviceKey.
Pwn/Concurrency challenge involving a TOCTOU race condition where input pipelining is used to beat a 1ms thread timer.
Forensics challenge involving PCAP analysis, malware reverse engineering, and XOR decryption to recover exfiltrated files
Crypto challenge involving Mersenne Twister (MT19937) state recovery (untempering) to predict future dice rolls.
Web/Network challenge exploiting eBPF packet-level inspection with TCP segmentation and HTTP Range headers to bypass keyword filtering.
Crypto challenge involving a custom nonlinear filter generator (LFSR) broken via algebraic attack using Z3 solver.
A trilogy of Web Security challenges focusing on WAF bypasses, SQL Injection chains, and SSTI to achieve RCE without using quotes or periods.
Web Security challenge involving XSS, session hijacking, and magic link abuse to steal admin cookies
