CTF (Capture the Flag)

Writeups

#

I’ve posted most of my writeups on GitHub, but they’re poorly organized and split across two languages. From 2026 onward, I’ll post them here in a consistent format.

I rewrite older favourites when I have enough context to make them useful. I would rather show one finished solve than build a graveyard of “coming soon” headings.

2024

#

1753CTF

#

Unbreakable — predictable random / broken OTP implementation

Novacare, July 2024

#

I’m kind of proud of this one. It was a simple race-style CTF: the challenge was released at exactly 00:00, and I submitted my answer 50.3 seconds later. Can you beat that? There is no context, and the timer starts as soon as you reveal the text:

CTF tools

#

Some challenges are solved with standard tools. Others become much easier if you write something small yourself.
Below are some of the tools, scripts, and approaches I’ve used in CTFs, including a few things I’ve made myself.

General skills

#

• Quick Python scripts (or any scripting language)
• Bash
• Regex
• PowerShell
• C and assembly knowledge
• Web and frameworks
• Linux/Windows/Mac familiarity

Steganography

#

• AperiSolve - hidden bits and color analysis
• zsteg - useful for PNG/BMP LSB-style challenges
• StegSolve - channel inspection and quick visual analysis
• Foremost - CLI tool for file-signature-based extraction
• binwalk - extracting embedded content
• Sonic Visualiser - spectrogram analysis
• Audacity - waveform and spectrogram inspection
• ImageMagick - comprehensive CLI tool for images
• GIMP - image repair, contrast tweaks, QR cleanup
• Custom chunk and byte inspection scripts

Examples

#

BEEB-BEEEEEP (Norwegian writeup) - fun and easy task involving DTMF decoding and ASCII conversion.

The sound of..? (Norwegian writeup) is another simple steganography task involving image extraction from audio files. You can pretty much immediately tell when an audio file sounds like an image, as strange as that sounds.

ImageProcessing2 (Norwegian writeup) - I used a Fourier transform and high-pass filter to remove low frequencies, then brightened the result until the hidden text became visible. Tools: Python, NumPy, Pillow, and FFT.

Dots (Norwegian writeup) is a simple task I solved with ImageMagick by splitting a GIF into 4,000 frames, filtering out certain colors, and combining the frames into a single image containing the flag.

Reverse engineering

#

• Ghidra
• strings
• x64dbg
• pwndbg / gdb
• Cutter / radare2
• Small helper scripts for decoding constants, lookup tables, and custom encodings

Examples

Debug_RAT (Norwegian writeup) - Basic static analysis with Ghidra and strings to find hidden checks and commands, leading to retrieving the flag from a remote server.

OceanLocust is one of my favourite examples of practical reverse engineering. Instead of trying to fully understand the binary at once, I treated it like an encoder oracle. By generating my own encoded PNGs, extracting the custom biTx chunks, and comparing byte patterns across different inputs, I could slowly reconstruct the hidden flag from the challenge image.

Reversing script logic

#

• Python itself
• Throwaway Python scripts
• ChatGPT for quickly translating weird logic into readable pseudocode

Examples

Firewood (Norwegian writeup) is a nice introductory challenge for reversing script logic.

Binary exploitation

#

• pwndbg
• gdb
• pwntools
• Python exploit scripts
• checksec
• cyclic / pattern create-find
• Basic fuzzing and crash analysis

Web exploitation

#

• Burp Suite
• Browser dev tools
• curl
• ffuf / gobuster / feroxbuster
• Postman sometimes, but usually Burp or curl is enough
• Custom request scripts
• Small brute-force and enumeration scripts

Examples

Trickster was a classic insecure file upload challenge. After checking robots.txt, I found hidden implementation notes that revealed the upload validation was weak. That made it possible to upload a .png.php webshell with valid-looking PNG bytes and execute code server-side.

No SQL Injection was a simple but nice auth bypass. I used a Mongo-style operator payload instead of normal credentials, which caused the backend query to match successfully. Burp then showed the returned user object, including a base64-encoded token containing the flag.

Network analysis

#

• Wireshark
• tshark
• Ncat / netcat
• tcpdump
• Scapy
• CyberChef for quick packet payload decoding
• Custom parsers for extracted traffic and challenge-specific data

Examples

Echo Chamber was labeled as scripting, but I first solved it manually in Wireshark by filtering for ICMP echo packets and inspecting the payloads. After that, it was easy to turn the process into a short tshark pipeline that extracted the flag automatically.

Cryptography / ciphers

#

• CyberChef
• dcode.fr - Great for quick identification and solving of classical ciphers

Examples

RSA_Oracle is a great example of why understanding the cryptosystem matters more than memorizing tools. I used pwntools to interact with the oracle, exploited RSA’s multiplicative property to recover the encrypted password indirectly, and then decrypted the final file with OpenSSL.

Password guessing / cracking

#

• ZipCrack - an old ZIP password brute-force tool I made
• fcrackzip
• Hashcat (offline)
• John the Ripper (offline)
• Hydra (web)
• Wordlists
• Custom brute-force scripts where the format is partially known

Forensics

#

• exiftool
• CLI tools: file, strings, xxd, hexdump
• CLI: binwalk
• CLI: 7z / unzip / foremost / scalpel
• HxD
• PDF and archive inspection

Examples

Bombzip2 (Norwegian writeup) - a tiny compressed file that expands to an enormous size. For example, "A" * 10^100000000000000 > file.txt would produce a huge file that compresses to very little because the pattern repeats. I found where the filler ended in HxD, copied the useful footer, and rebuilt a smaller valid BZ2 file that decompressed to the flag.

Secret of the Polyglot was a nice file-carving challenge. The PDF visibly contained half the flag, and the title hinted that the file was actually multiple formats at once. Running foremost against it extracted the embedded PNG, which contained the missing half.

Mob psycho is a good example of quick APK triage. Instead of digging manually through the entire package, I listed the APK contents with aapt, searched for likely flag-related filenames, extracted the matching file, and decoded the hex string inside.

OSINT

#

• Google dorks
• Google Maps / Street View / satellite view
• Overpass Turbo - very useful for map-based filtering and location scripting
• ShadeMap - matching shadows to estimate time of day
• Wayback Machine / Internet Archive
• ExifTool - extract coordinates, time, device, and much more from media
• Sherlock - username reuse
• Reverse image search
• PimEyes - reverse face search
• GIMP - repairing or extracting clues from images
• Text and image pivoting
• Searching mirrors, reposts, and alternate hosts

Examples

1753CTF Fixed Mistake, or is it really fixed? Historical data can often still be found in the Internet Archive.

Mullvarpjakt is a great example of using Overpass Turbo, a query tool for geographic data, to find an exact location from only a few words.

Chronolocation (Norwegian writeup) was a fun task where shadow maps helped determine exactly when an image was taken, even without metadata.

OSINT (Norwegian writeup) is another example of using Overpass Turbo.

Terminal jail

#

Bash

#

Basically, just know Bash and the Linux environment. These tasks are about creatively applying your knowledge of the system and language.

Examples

SansAlpha - A shell challenge where alphabetic characters were mostly unavailable, so the solution had to rely on wildcards, variable tricks, and shell expansion. I used globbing to locate both the flag and a useful binary, then selected the correct expanded path and used it to print the flag.

Tools / techniques: Bash globbing, shell variables, array indexing, command discovery, base64

Python

#

• Great pyjail resource by a fellow Norwegian CTF-er

Not cipher (Norwegian writeup) - A Python jail where only 13 characters were allowed: not+cipher(*). That meant I could not directly write the target path, so I had to build it character by character using chr(...). To generate numbers, I abused expressions like int(not()), then wrote a helper script that generated a huge payload which reconstructed the full path and opened the flag file.

Tools / techniques: Python jail escaping, chr(), int(not()), payload generation, URL encoding, curl

Short not cipher (Norwegian writeup) - A harder version of the same Python jail, except now the payload also had to stay below 5000 characters. Instead of relying mostly on addition, I compressed the payload by combining multiplication, exponentiation, and later repr() tricks to generate shorter numeric expressions. This turned the challenge into both a jail escape and a code-golf style optimization problem.

Tools / techniques: Python jail escaping, payload minimization, chr(), repr(), arithmetic expression compression, custom generator scripts