Reading a bot username through a CSS :has() oracle that drives window.length across origins, under a CSP with no subresource holes and COOP disabled on plain http
DNS-rebinding an admin bot onto a loopback listener through a PNA-exempt popup to steal the signing key, forge a seller session, then re-run the window.length oracle
Escaping a parenthesis-, quote-, and digit-free Python eval jail using a comprehension setattr as a call primitive and object.__reduce__ to reach the real builtins
Fitting a general DELEGATECALL forwarder into a 36-byte jump-free bytecode whitelist, then abusing a validated arbitrary storage write in a reversed vault
Stacking a Move market-key confusion, a caller-controlled price, and a primitive-type witness to drain an incentive vault on Sui
Chaining an arbitrary file write, a Sage/PPL segfault, and cysignals unsafe gdb auto-load into a CAP_SYS_PTRACE read of a setgid-only flag
Draining a meta-transaction vault through a relayer credit-transfer with no signature check, plus the intended ECDSA malleability and cross-function reentrancy chain
Draining a lending pool through a proxy storage collision that aliases pendingAdmin onto the oracle price, reachable via an unpermissioned multicall self-call
Proving a stripped validator is secret-independent, re-implementing its integrity VM and XOR keystream, then taking the uncapped base credit path the 40000 bonus cap was there to hide
Separating 50 decoy case-flips from 29 real substitutions by aligning two files on their lowercased form with difflib
Peeling 1000 nested archive layers by magic byte, using the fact that 7-zip leaves its filename table readable to recover each layer password
Carving an SD-card image with debugfs, then pulling a QEMU machine model, an XOR-encoded cloud endpoint, and a hidden debug-exec opcode out of the same IoT firmware
Winning a double-fetch race in a Windows capture driver, where the bump allocator alignment that blocks a single-threaded overflow becomes the thing that guarantees the corruption lands
Chaining a libinjection-evading second-order SQLi into a PostGIS BAG TEMPLATE gopher SSRF, rewriting Patroni config in unauthenticated etcd to get archive_command RCE
Three Next.js edge-vs-node desyncs chained: the nxtP query prefix, duplicate-cookie precedence, and a middleware matcher blind to assetPrefix
Slipping past a single non-recursive ../ strip with a nested ....// sequence to read a file outside the served directory
Sidestepping a capstone control-flow jailer by handing native-compile a filename instead of a lambda, so the byte compiler reads flag.txt as Lisp and names it in an undefined-variable warning
Escaping a Lua 5.5 bytecode sandbox by writing registers past the end of the stack, hijacking a table array pointer, and swapping global_State.frealloc for system
Steering a byte-CNN malware classifier to a benign verdict with an adversarial comment, then escaping a Java SecurityManager through the trusted MethodHandles lookup
Turning a CKKS Chebyshev sign oracle into a 50-bit binary search using ciphertext additions only, with exact rational interval tracking
Declaring an axiom to fabricate false proofs, turning Lean 4 proof-carrying array accessors into arbitrary memory reads, and forging a closure object to call readFile
Cracking 20 rounds of monoalphabetic substitution across ten languages with space-aware quadgram hill-climbing and a dictionary polish pass
When softplus weights make every added byte incriminating, rewriting a Java SecurityManager escape token by token until a byte-CNN calls it benign
Decoding a flag from the red channel of every frame in an mp4
Escaping a space-stripping shell with no PATH using brace expansion and absolute paths
Carving a PNG plus ZIP plus PDF polyglot to reassemble a three-part flag
Polluting a Python module global through a recursive merge to flip the give_flag switch and unlock the flag
Beating an event-handler blocklist and a strict CSP with an onfocus payload and a top-level navigation leak
Five git forensics challenges on one repo: hidden commit messages, odd authorship, mistagged releases, deleted blobs, and replace refs
Bypassing a no-lowercase no-symbol bash jail with tilde-plus and question-mark globs to run the flag script
Writeup for D's Signpost from NDIAS Automotive/IoT CTF 2026. Five overlapping transmissions at 915 MHz hide Morse hints, an FM voice hint, an AX.25/APRS password, and a DQPSK-encoded password-protected ZIP.
Writeup for Gate to the Past from NDIAS Automotive/IoT CTF 2026. Decrypting an old OpenSSH 4.3 session by exploiting CVE-2008-0166, the Debian OpenSSL weak PRNG, to recover the DH private exponent.
Writeup for Map data from NDIAS Automotive/IoT CTF 2026. Streaming a million-tile 7z archive through a fixed-size PNG splitter and using a label-pixel anomaly check to find the one tile whose label starts with FLAG.
Writeup for Weird config updater from NDIAS Automotive/IoT CTF 2026. A ZIP parser-differential between the validation and extraction paths lets a debug config slip through a release-only check.
Writeup for Classic KeeLoq Garage Next HOP from NDIAS Automotive/IoT CTF 2026. Using the recovered DeviceKey to predict the next valid Classic KeeLoq OPEN frame.
Writeup for Classic KeeLoq Garage Find the Key from NDIAS Automotive/IoT CTF 2026. Recovering a 64-bit KeeLoq DeviceKey from RF captures using the legacy SEED || (SEED XOR SERIAL) derivation.
Writeup for Next Counter from NDIAS Automotive/IoT CTF 2026. Manchester-decoding Falcon X1 Unlock frames, recovering the monotone counter, and predicting the next valid frame.
Writeup for Parking Lot Whisper from NDIAS Automotive/IoT CTF 2026. Identifying the carrier frequency, modulation, and chip period of a 433 MHz Falcon X1 keyfob IQ capture.
Writeup for Predict Next UNLOCK from NDIAS Automotive/IoT CTF 2026. Recovering the per-press 16-bit auxiliary delta to predict the next extended Falcon X1 Unlock frame.
Writeup for Read the simple fob from NDIAS Automotive/IoT CTF 2026. Manchester-decoding the Falcon X1 Unlock burst and reading the Device ID out of the wire frame.
Writeup for Real KeeLoq Garage Next HOP from NDIAS Automotive/IoT CTF 2026. Predicting the next valid HCS301 logical OPEN frame using the recovered DeviceKey.
Writeup for Real KeeLoq Garage Normal Learn from NDIAS Automotive/IoT CTF 2026. Recovering an HCS301 DeviceKey from a 250 µs Manchester capture using the HCS301 Normal Learn derivation.
Pwn/Concurrency challenge involving a TOCTOU race condition where input pipelining is used to beat a 1ms thread timer.
Web/Network challenge exploiting eBPF packet-level inspection with TCP segmentation and HTTP Range headers to bypass keyword filtering.
Forensics challenge involving PCAP analysis, malware reverse engineering, and XOR decryption to recover exfiltrated files
Crypto challenge involving Mersenne Twister (MT19937) state recovery (untempering) to predict future dice rolls.
Crypto challenge involving a custom nonlinear filter generator (LFSR) broken via algebraic attack using Z3 solver.
A trilogy of Web Security challenges focusing on WAF bypasses, SQL Injection chains, and SSTI to achieve RCE without using quotes or periods.
Web Security challenge involving XSS, session hijacking, and magic link abuse to steal admin cookies
