Posts
Articles and guides of various topics, techniques, and so on in relation to CTF challenges.
How to Start Playing CTFs: A Complete Beginner's Guide
How to start CTFs: what capture the flag is, the competition formats, the six categories, choosing a first event, and a 30 day plan that actually works.
July 30, 2026
Modular Arithmetic for CTF Crypto: The Math Behind RSA, DH, and ECC
Modular arithmetic for CTF: congruence, modular inverses, Euler and Fermat, fast exponentiation, the Chinese Remainder Theorem, and discrete logs in Python.
July 28, 2026
Setting Up a CTF Environment: WSL, Linux, Docker, and the Core Toolkit
Build a CTF machine that works: choosing WSL2, a VM, or native Linux, the toolkit worth installing per category, Python setup, and safe binary handling.
July 26, 2026
The picoCTF General Skills Roadmap: The Category Everything Else Rests On
General Skills roadmap for picoCTF: a tiered path through the shell, file inspection, encodings, scripting, remote services, git, and permissions.
July 24, 2026
HTTP for CTF: Requests, Headers, Status Codes, and DevTools
HTTP fundamentals for web CTF: read a request and response, forge headers with curl, use the DevTools Network tab, and solve the header and redirect challenge class.
July 22, 2026
XOR for CTF: Breaking XOR Encryption Without the Key
XOR encryption in CTF: single-byte brute force, repeating-key recovery with Hamming distance, known-plaintext key extraction, and spotting XOR loops in disassembly.
July 20, 2026
Reversing Custom Ciphers for CTF: Breaking Homebrew Encryption
Break homebrew CTF encryption with a three-probe chosen-plaintext test: classify the cipher as byte-independent, arithmetic, or stateful, then invert it.
July 18, 2026
JavaScript Deobfuscation for CTF: Hook the Sink, Not the Source
Deobfuscate CTF JavaScript by hooking eval, Function, and atob instead of reading minified code. Includes WebAssembly reversing and a DevTools workflow.
July 18, 2026
The picoCTF Forensics Roadmap: file, strings, and Everything After
CTF forensics roadmap: start with file, strings, and a hex view, then branch by type across images, audio, captures, disk, and memory. Ordered and linked.
July 14, 2026
All posts
Every article on the site, listed alphabetically.
- AES for CTF: Read the Ciphertext, Not the Math
- Android APK Reverse Engineering for CTF: From .apk to Flag
- angr from First Principles: A picoCTF Tutorial for Beginners Tired of Magic
- Archive and Zip Password Cracking for CTF
- ARM Assembly for CTF: The ARMssembly Series
- Audio Steganography and Spectrograms for CTF Forensics
- Authentication Bypass and IDOR for CTF: The Broken Access Control Playbook
- Base64, Hex, and Common CTF Encodings Explained
- Bash Scripting for CTF Automation: Loops, Pipes, and Brute-Force Harnesses
- Beginner's Guide to Netcat for CTFs
- Buffer Overflow and Binary Exploitation for CTF
- Burp Suite for picoCTF: From Proxy Setup to Repeater Tricks
- Bypassing ASLR and PIE in CTF Binary Exploitation (picoCTF Guide)
- Classical Ciphers for CTF: Caesar, Vigenère, and Substitution
- Command Injection for CTF: From Ping Boxes to Blind Exfil
- Cookie and JWT Attacks for CTF Web Challenges (picoCTF Guide)
- CSRF for CTF: Forging Requests and Bypassing Tokens
- CTF Disk Forensics: What to Do When Strings Returns Nothing
- Diffie-Hellman and Discrete Log for CTF: Breaking Weak Key Exchanges
- Elliptic Curves for CTF: The Discrete Log Is the Whole Game
- File Carving and Magic Bytes: Repairing Corrupted Files for CTF
- File Upload Exploitation
- Format String Vulnerabilities for CTF Binary Exploitation
- Frida and Binary Instrumentation for CTFs: A Beginner's Path
- Git Forensics for CTF: What to Do When git log Returns Nothing
- Go and Rust Binary Reversing for CTF: Taming the Fat Binary
- GraphQL Exploitation for CTF: From /graphql to the Flag
- Hash Cracking for CTF: MD5, SHA-1, SHA-256 and Beyond (picoCTF 2025)
- Hash Length Extension Attacks for CTF: Forging a MAC Without the Secret
- Heap Exploitation for CTF: From heap Overflow to tcache Poisoning
- How to Read and Analyze Hex Dumps
- How to Start Playing CTFs: A Complete Beginner's Guide
- How to Use Ghidra for Reverse Engineering CTF Challenges
- HTTP for CTF: Requests, Headers, Status Codes, and DevTools
- Image Metadata and EXIF Forensics for CTF
- Insecure Deserialization for CTF: Pickle, __reduce__, and RCE
- Insecure Randomness for CTF: Predicting PRNGs and the Mersenne Twister
- Introduction to Steganography Tools for CTF
- Java Reverse Engineering for CTF: Decompiling JARs and the Vault Door Series
- JavaScript Deobfuscation for CTF: Hook the Sink, Not the Source
- LFI for CTF: From /etc/passwd to RCE
- Linux Command Line Basics for CTF Competitions
- Linux Privilege Escalation for CTF
- Modular Arithmetic for CTF Crypto: The Math Behind RSA, DH, and ECC
- Networking Tools for CTF Challenges
- NoSQL Injection for CTF: Bypassing Login Without SQL
- Padding Oracle and CBC Bit-Flipping Attacks for CTF
- pwntools for CTF: A Foundational Guide from import to Shell
- Python for CTF: Essential Scripting Techniques
- Python Reversing for CTF: Bytecode, Frozen Binaries, and Obfuscated Scripts
- Python Sandbox Bypass for CTF: The Filter-Breaker Playbook
- radare2 and rizin for CTF: A Beginner's Workflow
- Recipe Chain: Decode Multi-Layer CTF Encodings Without CyberChef
- ret2libc for CTF: Leaking libc and Returning to system()
- Reversing Custom Ciphers for CTF: Breaking Homebrew Encryption
- ROP Beyond ret2libc: The Gadget Ladder for CTF Exploitation
- RSA Attacks for CTF Cryptography
- Server-Side Template Injection for CTF: Detection, Gadgets, and Filter Bypass
- Setting Up a CTF Environment: WSL, Linux, Docker, and the Core Toolkit
- Smart Contract CTF: Four Bugs That Already Drained Mainnet
- SQL Injection for CTF: From Authentication Bypass to Data Extraction
- SROP and ret2dlresolve: Advanced ROP Without a libc Leak
- SSRF for CTF: From localhost Pivots to Cloud Metadata
- Stack Canary Bypass for CTF: Leak It, Brute It, or Walk Around It
- Steganography Techniques for CTF Competitions
- Stream Ciphers in CTFs: LFSR, Vigenere, and Keystream Reuse
- The Complete picoCTF Beginner's Guide: Learning Path, Tools & Every Category
- The picoCTF Binary Exploitation Roadmap: Stack to Heap to ROP
- The picoCTF Cryptography Roadmap: From Caesar to Elliptic Curves
- The picoCTF Forensics Roadmap: file, strings, and Everything After
- The picoCTF General Skills Roadmap: The Category Everything Else Rests On
- The picoCTF Reverse Engineering Roadmap: From Disassembly to Decompiler
- The picoCTF Web Exploitation Roadmap: Recon to RCE
- USB and HID PCAP Forensics for CTF: Reconstructing Keystrokes
- Use-After-Free for CTF: Dangling Pointers and tcache
- Using GDB for CTF Reverse Engineering
- Web Recon for CTF: robots.txt, Page Source, DevTools, and Hidden Endpoints
- What picoCTF Web Challenges Teach You About Real Bugs in Production
- When strings Won't Cut It: Volatility 3 for CTF Memory Forensics
- Wireshark and pcap Analysis for CTF Forensics
- Writing x86-64 Shellcode for CTF: From Syscall to Shell
- x86-64 Assembly for CTF: Reading Disassembly From Scratch
- XOR for CTF: Breaking XOR Encryption Without the Key
- XSS for CTF: A Ladder from alert(1) to CSP Bypass
- XXE for CTF: XML External Entity Attacks
- z3 for CTF: Constraint Solving from Keychecks to Crypto