Writeups
CTF solutions and notes from reverse engineering, web, and malware analysis.
2026
Bridge Troll
The same `HCFG` config format from Nimble, but cranked up to **22 language runtimes / 264 answer fields**.
Django Dispatch
A tiny Django app with one authz boundary.
Double Spent
A two-route app: `POST /execute-bdb3f6` spends one credit (read balance → check `> 0` → decrement, and that's **not atomic**), and `GET /audit-ad790f` hands over the flag once the balance goes negative.
Error Courtesy
An ASP.NET Core app whose own clue states the intended behavior: *"deny access when the policy service is unavailable."* The bug is that it does the opposite.
Exported Trust (Day 01)
A small, unobfuscated APK (`com.huntress.mobile.d01...`).
If a Breach Falls in a Log
A PHP Slim app built around an export flow.
Lost in Translation
A monster — **75 obfuscated scripts, 615 answer fields** — across PowerShell, JScript, VBScript, Batch, Python, Bash, Node and PHP.
Nimble
A 9-sample static-analysis set (zip password `infected`, AES — so 7z or pyzipper) spanning C/C++ ELFs, a .NET PE, JARs, a Swift binary and a Nim binary.
Protocol Reconstruction (Day 28)
Same Huntress Mobile Arena setup as Day 01, but the answer is wrapped in a little binary protocol.
Query Me This
A search box backed by an `articles` table that only shows rows where `visibility='public'`.
Search Mirror
A reflected-XSS box: `/execute-4d56c5?q=` drops your input straight into `#preview` via `innerHTML`, so `<img src=x onerror=...>` gives full JS execution.
Serialized Offender
"Your session is just a blob of misplaced trust.
Trust the Build
A Go (Fiber) update-manifest activator.
Trust Transit
A Kotlin (Ktor) app, and the server even names the vuln class in its response: SSRF → object authorization.
2023
Backdoored Splunk
For this challenge, participants are provided with a zip file containing some files used for Splunk Add-on for Windows.
Batchfuscation
Participants are provided with a file `batchfuscation` and upon inspection, it's a batch script.
Hot Off The Press
Participants are provided with a file `hot_off_the_press`.
PRESS PLAY ON TAPE
This challenge is one of my personal favorites simply because of how unique it is.
RAT
Participants are provided with a 7zip archive named `rat.7z`.
Rock, Paper, Psychic
Participants are provided with a 7zip archive which contains an exe file.
Speakfriend
Participants are provided with a 7zip archive named `main.7z`.
Texas Chainsaw Massacre: Tokyo Drift
This challenge is difficult and therefore one of my favorites.
Traffic
After extracting the file, reveals a bunch of gzip files
Tragedy Redux
Participants are provided with a 7zip file containing a file `tragedy_redux`.
Zerion
For this challenge, participants are provided with a file named `zerion`.