hur01

AgilePaste 3

Wed, 30 Sep 2026 00:00:00 GMT

Differential handling of duplicate Erlang ETF map keys — a term that never passed validation reaches the client's JSON encoder

bloatware.js

Wed, 30 Sep 2026 00:00:00 GMT

Next.js resume-data-cache blobs are base64 → inflate → JSON.parse with no integrity check, and the client Flight decoder's synchronous reference walk has no guards at all.

Clean Sweep

Wed, 30 Sep 2026 00:00:00 GMT

ECOVACS DEEBOT T9 firmware 1.4.9 — `reqDo`'s JSON command dispatcher builds a string with `sprintf` and hands it to `popen()`

dont-worry

Wed, 30 Sep 2026 00:00:00 GMT

CSP bypass via path traversal in the Prism autoloader's `data-dependencies`, chained with `No-Vary-Search` cache-key confusion to replay the bot's authenticated response

Count on me!

Wed, 30 Sep 2026 00:00:00 GMT

`vb.htm?checkupdate=` reflects the server-side fetch body verbatim — response-reflected SSRF (the SSID injection and `update.cgi` crash were dead ends)

Dot Matrix

Wed, 30 Sep 2026 00:00:00 GMT

Parse the I2C capture → map registers to LEDs → rebuild frames → fix the row order → recover the true scroll period

Downhill

Wed, 30 Sep 2026 00:00:00 GMT

Hidden-parallelepiped attack on a 2003 signature scheme — recover `f` with covariance plus FFT-augmented 4th-moment gradient descent

dyslexic

Wed, 30 Sep 2026 00:00:00 GMT

`vboxsf` is a client filesystem — the guest trusts the host's SHFL RPC responses without validating them

Embedded encryptor

Wed, 30 Sep 2026 00:00:00 GMT

Locate the encryption in the power trace, align per-block, recover the key with CPA (last two bytes handled separately)

Flag Pointer Register

Wed, 30 Sep 2026 00:00:00 GMT

PE32+ — the decoder always runs, the result pointer just never reaches RDX. Replay the 8-byte-key XOR instead

happy

Wed, 30 Sep 2026 00:00:00 GMT

`--frozen-intrinsics` freezes only the ECMAScript intrinsics — Node core prototypes such as `EventEmitter.prototype` are left alone

1up clank bro

Wed, 30 Sep 2026 00:00:00 GMT

Ladybird LibJS inline-cache type confusion after a GC sweep → unchecked heap OOB R/W → native function table hijack for RCE

File Monster

Wed, 30 Sep 2026 00:00:00 GMT

Uploads are written verbatim to `/tmp/` on the shared MongoDB container → CVE-2026-13078 / SERVER-128832

Ein milljón bjóra

Wed, 30 Sep 2026 00:00:00 GMT

`Exif.ReadLocation()` returns a raw `JsonElement`, giving a zero-byte write; steer the classifier to inflate the approved count

No Strings Attached

Wed, 30 Sep 2026 00:00:00 GMT

Recover the 56 bytes of `secret` (0x404040) XORed against a glibc-style LCG keystream

Min Beste Venn

Wed, 30 Sep 2026 00:00:00 GMT

1,135 HTTP HEAD requests, all 404 — the information is in the shape of the **request paths**, not the responses

Open Secret

Wed, 30 Sep 2026 00:00:00 GMT

Static ELF using raw syscalls only, so there are no libc calls for ltrace to catch

Omniscient

Wed, 30 Sep 2026 00:00:00 GMT

`SetApConfig` base64-wraps every input except the `ts` field added in the X5 → command injection into `popen()`

Patch Tuesday

Wed, 30 Sep 2026 00:00:00 GMT

Runtime opcode patch (`jz` → `jnz`)

Purgatory

Wed, 30 Sep 2026 00:00:00 GMT

Erlang hot code loading — the worker's local calls stay pinned to old.beam, but the fully-qualified `Mod:Fun` call is late-bound and lands in new.beam

jailnet

Wed, 30 Sep 2026 00:00:00 GMT

The Janet compiler runs outside the sandbox it is compiling for, and nothing verifies the bytecode it emits.

perchance

Wed, 30 Sep 2026 00:00:00 GMT

Missing trailing slash in a `startsWith` check (userinfo bypass), then a hardcoded extension UUID and an origin-less postMessage handler to steal `activateOn`

Raymarine Navigation

Wed, 30 Sep 2026 00:00:00 GMT

LightHouse 4.11.133 (0day) — command injection in a CGI binary

Scratch Space

Wed, 30 Sep 2026 00:00:00 GMT

Decoded into an mmap'd scratch page and then wiped — reconstruct the pre-wipe state

silent

Wed, 30 Sep 2026 00:00:00 GMT

pyjail — reach `object` without `__class__`, then build an arbitrary-getattr primitive without spelling a single name

The Builder

Wed, 30 Sep 2026 00:00:00 GMT

The page tag is `sha256(content)[:12]`, so it is predictable, and the registry accepts anonymous pushes → smuggle in `ONBUILD COPY --from=theme /flag.txt`

The Temple

Wed, 30 Sep 2026 00:00:00 GMT

TempleOS — print to the terminal after `MountIDEAuto`, and decode the 8x8 glyphs from the noVNC canvas pixels instead of reading them by eye

Time Lock

Wed, 30 Sep 2026 00:00:00 GMT

Lie to `time()` with `LD_PRELOAD` to pass the time gate

Self-service

Wed, 30 Sep 2026 00:00:00 GMT

Abuse LDAP attribute-driven group "provisioning" → reset `ops`'s password → pivot

Triangle Platform

Wed, 30 Sep 2026 00:00:00 GMT

Start from tenant-a's `console` ServiceAccount and escape through Kyverno's YAML handling

small-guy

Fri, 25 Sep 2026 00:00:00 GMT

All 256 rounds of the checker live in .eh_frame; the C++ unwinder is the VM, and it consumes its key one frame late.

Sleepy CPU

Thu, 24 Sep 2026 00:00:00 GMT

The length of each sleep interval is the flag byte - a power side-channel you can read with a threshold.

NNS International Lounge

Wed, 23 Sep 2026 00:00:00 GMT

A hardcoded HMAC key plus one unvalidated field, compounded by a one-time bonus escape hatch.

littlefs

Tue, 22 Sep 2026 00:00:00 GMT

Driving a discontinued Saleae app headlessly through its socket API to open an undocumented capture format.

Keyboard

Mon, 21 Sep 2026 00:00:00 GMT

Decoding USB Low-Speed off the raw wire, then replaying every keystroke - including the edits that build the real flag.

Hardware accelerated flag checker 2

Sun, 20 Sep 2026 00:00:00 GMT

Extracting a netlist back out of a fabricatable SKY130 layout with no PDK installed.

sea of theft — Flag of Yore

Sat, 19 Sep 2026 00:00:00 GMT

An unused sprite renders to a screenshot of the game in dev mode, and the version string in those pixels names a release the bucket never cleaned up.

ratatouille

Sat, 19 Sep 2026 00:00:00 GMT

A 70-byte .recipe section holds the flag, and the nine anti-analysis environment checks are not a defence — they are the key material.

hollowdex

Sat, 19 Sep 2026 00:00:00 GMT

JNI_OnLoad rewrites verifyFlag's bytecode through /proc/self/mem at load time; the shipped dex is a decoy hiding a 3-round Feistel.

bitdebit2

Sat, 19 Sep 2026 00:00:00 GMT

One bit flip into IO_list_all, a seccomp filter that never checks the arch, and a flag read out through connection-drop timing.

arbitrary-funds-sweep

Sat, 19 Sep 2026 00:00:00 GMT

The vault trusts an un-aliased L1 address that was never deployed on L2, and the same permissionless CREATE2 factory exists on both chains.

legacy

Sat, 19 Sep 2026 00:00:00 GMT

Python 2 parses a 2 MB integer literal in quadratic time, so the backup overruns its timeout and the SIGQUIT trap gcores the root password into /tmp.

aethergate

Sat, 19 Sep 2026 00:00:00 GMT

Endpoints are validated per list element but stored space-joined and split again into argv, so one space injects curl options and file:// reads /dev/vdb as root.

prime calc

Sat, 19 Sep 2026 00:00:00 GMT

Downloading and re-uploading a DMTCP checkpoint is a memory read/write primitive; one 36-byte path swap makes the worker read /flag instead of its config.

big-win

Sat, 19 Sep 2026 00:00:00 GMT

A loop that exits on != and can increment twice per pass never terminates, and its own counter is reachable through the array it bounds.

make-a-wish

Sat, 19 Sep 2026 00:00:00 GMT

A signed modulo on the array index makes free() take a stack pointer, and tcache never checks that a chunk lives on the heap.

huge binary 1

Sat, 19 Sep 2026 00:00:00 GMT

An unchecked stack index leaks libc and printf is called twice, so one GOT overwrite turns the second call into system("/bin/sh").

ihyh

Sat, 19 Sep 2026 00:00:00 GMT

fclose() without NULLing the global FILE * lets a 464-byte note become the FILE struct, turning fflush into write(2) and fwrite into system().

huge binary 2

Sat, 19 Sep 2026 00:00:00 GMT

One byte of leak per run, so the first job is a loop: a single %hhn on a page-aligned libc address makes main call itself forever.

not-json

Sat, 19 Sep 2026 00:00:00 GMT

Two loops sharing one buffer compose: the key loop's overflow breaks the canary and the description loop's terminator repairs it, then one byte of saved RBP pivots the frame.

solstice-9

Sat, 19 Sep 2026 00:00:00 GMT

Three bench captures each hide the real component next to a more attractive decoy; assembling the 96-byte fixture and inverting boarddiag's lane routing yields the Ed25519 private key.

spot

Sat, 19 Sep 2026 00:00:00 GMT

The commitment is counted with FIONREAD but never read until after the reveal, and splice() puts a page reference in the pipe rather than bytes.

waf

Sat, 19 Sep 2026 00:00:00 GMT

The anti-ROP memset zeroes everything after the first NUL — and since we choose both the NUL position and the length, it becomes the tool that writes the chain.

java notes

Sat, 19 Sep 2026 00:00:00 GMT

commons-collections 3.2.1 on the classpath and an unfiltered readObject(), so CC6 gives blind RCE exfiltrated with curl's --data-binary.

Death Ops

Sat, 19 Sep 2026 00:00:00 GMT

96 bytes of alphanumeric loader out of a seccomp jail, then a kernel LPE built on a char device that allows exactly two arbitrary writes.

Gap Gap

Sat, 19 Sep 2026 00:00:00 GMT

p-1 and q-1 share a 600-bit prime, which turns 30 redacted digits of d into a Coppersmith root modulo an unknown divisor of N-1.

Freal World Manipulation

Sat, 19 Sep 2026 00:00:00 GMT

An IEEE754 overflow blows the index limit open, and the mincore() bounds check becomes the oracle that defeats 1 GB of brk randomisation.

peekaboo

Sat, 19 Sep 2026 00:00:00 GMT

seccomp allows 8-byte writes from one page only, so the ciphertext is found by mmap binary search and the 24-bit srand seed does the rest.

pickle

Sat, 19 Sep 2026 00:00:00 GMT

Every string written as \uXXXX slips past a byte-level blocklist, and the check that should have stopped REDUCE throws inside its own try.

ycc

Sat, 19 Sep 2026 00:00:00 GMT

The sandbox flags are airtight; the bug is that emit_dot splices an unescaped key into the generated C, so a map lookup breaks out into system().

Zigerions

Sat, 19 Sep 2026 00:00:00 GMT

A VMProtect-packed dropper chain whose final payload is an unrunnable ELF carrying an AES key next to its own ciphertext.

pwnsec-support

Sat, 19 Sep 2026 00:00:00 GMT

SQLi into a bespoke register VM, then a 4-byte arbitrary write turned into an arbitrary read by type-confusing a Lua table slot.

PHault

Sat, 19 Sep 2026 00:00:00 GMT

Identical responses and padded timing close every usual channel, so the oracle becomes PHP's memory_limit: a 34 MB row makes the page fatal.

Hardware accelerated flag checker 1

Sat, 19 Sep 2026 00:00:00 GMT

Writing a gate-level simulator for an anonymous Yosys netlist and walking its KMP-style automaton.

Cheese

Thu, 17 Sep 2026 00:00:00 GMT

Reproducing a lockdown browser's integrity headers from its config file alone, without ever installing it.

Light-Weight Encryption

Wed, 16 Sep 2026 00:00:00 GMT

Publishing the whole LWE relation lets any kernel vector cancel the secret, reducing the break to a scalar trapdoor.

Impossible

Tue, 15 Sep 2026 00:00:00 GMT

Leaked ceremony toxic waste turns Groth16 into a rubber stamp for any public statement at all.

From Nothing

Mon, 14 Sep 2026 00:00:00 GMT

Recovering a withheld Mumford v-polynomial, then the Jacobian's order via complex multiplication instead of point counting.

Crypto Party 2

Sun, 13 Sep 2026 00:00:00 GMT

A UUID4 used as an ECDSA nonce has ~106 unpredictable bits, recovered with a 168-dimension lattice.

RLP Golf

Sat, 12 Sep 2026 00:00:00 GMT

Hand-written Yul assembling canonical RLP with mstore8 headers and calldatacopy bodies, scored purely on gas.

Void

Fri, 11 Sep 2026 00:00:00 GMT

An off-by-one in Cairo's circuit failure-guarantee lets a STARK prove that an invertible element has no inverse.

Fork

Thu, 10 Sep 2026 00:00:00 GMT

A Move VM module cache that lives outside Block-STM's tracked read-set, raced into a permanent chain fork.

CERN

Wed, 09 Sep 2026 00:00:00 GMT

Two Aztec functions share a 4-byte selector, so redirecting a callback to the contract itself mints its private notes to me.

Block Rehearsal

Tue, 08 Sep 2026 00:00:00 GMT

Crashing a Mina validator through a zip_exn that fires before any proof is ever verified.

Bank of NNS

Mon, 07 Sep 2026 00:00:00 GMT

A permutation-cycle bug in kimchi's connect_64bit leaves a range-check limb entirely unconstrained.

Reverse Grand Prix

Sun, 06 Sep 2026 00:00:00 GMT

Zero-cost AST nodes defeat solc's inliner size heuristic, compressing a 157-second compile bomb into 637 bytes.

Glomma River Trading

Sat, 05 Sep 2026 00:00:00 GMT

A perp market that reads its mark price straight off the thin AMM pool you are free to trade against.

eu261

Fri, 04 Sep 2026 00:00:00 GMT

A textbook checks-effects-interactions violation, reentered 16 times to drain a compensation fund to exactly zero.

basic_heap_overflow

Tue, 18 Aug 2026 00:00:00 GMT

No PIE fixes the address of get_shell, so a 28-byte heap overflow is enough to redirect execution.

Buffer Overflow Practice

Tue, 18 Aug 2026 00:00:00 GMT

Working through a full stack-overflow methodology on VulnServer: spiking, fuzzing, offset, bad characters, module, shellcode.

Launching Calculator with a Buffer Overflow

Tue, 18 Aug 2026 00:00:00 GMT

Reproducing a Windows buffer overflow end to end, using mona.py to find the offset and land a payload.

awesome-basics

Tue, 18 Aug 2026 00:00:00 GMT

A textbook stack overflow: an 80-byte buffer read with 0x80, overwriting RIP to jump into shellcode.

Sigreturn-Oriented Programming (SROP)

Tue, 18 Aug 2026 00:00:00 GMT

Notes on SROP: forging a sigcontext frame so a single sigreturn sets every register at once.

cherry

Tue, 18 Aug 2026 00:00:00 GMT

strncmp only checks the first six bytes, so the rest of the overflow is free to reach the return address.

mmapped

Tue, 18 Aug 2026 00:00:00 GMT

Overflow the length argument to mprotect so the real flag page is never protected before it is written out.

validator

Tue, 18 Aug 2026 00:00:00 GMT

NX disabled and a writable GOT, so the shellcode is written directly into the GOT and jumped to.

off_by_one_000

Tue, 18 Aug 2026 00:00:00 GMT

A single byte past the end of the buffer is enough to shift the saved frame pointer and take control.

ssp_000

Tue, 18 Aug 2026 00:00:00 GMT

Stack canary present, so the exploit reads it out first and writes it back in place during the overflow.

memory_leakage

Tue, 18 Aug 2026 00:00:00 GMT

A struct read back without clearing it first leaks adjacent heap memory field by field.

basic_exploitation_003

Tue, 18 Aug 2026 00:00:00 GMT

A 32-bit binary with no canary and no PIE, exploited by overflowing into the return address.

Exploit Tech: __environ

Tue, 18 Aug 2026 00:00:00 GMT

Full RELRO and PIE, so the stack address is leaked through the environ pointer in libc instead.

hook

Tue, 18 Aug 2026 00:00:00 GMT

The binary is linked with -z norelro, leaving the init/fini arrays writable and hijackable.

sint

Tue, 18 Aug 2026 00:00:00 GMT

A signed comparison lets a negative length through, which then becomes a huge unsigned size in the copy.

Return to Library (RTL)

Tue, 18 Aug 2026 00:00:00 GMT

NX blocks shellcode, so the return address goes to a libc function instead. PIE is off, so the offsets hold.

Return to Shellcode

Tue, 18 Aug 2026 00:00:00 GMT

A canary blocks a direct return overwrite, but the stack is executable, so the shellcode goes there.

oneshot

Tue, 18 Aug 2026 00:00:00 GMT

46 bytes into a 16-byte buffer, with a leaked stdout address turning a one-gadget into a working shell.

Reversing Basic Challenge #6

Tue, 18 Aug 2026 00:00:00 GMT

Static analysis in IDA of a routine that checks user input character by character.

send_sig

Tue, 18 Aug 2026 00:00:00 GMT

The program forwards a signal number straight to the kernel; the exploit is choosing the right one.

cmd_center

Tue, 18 Aug 2026 00:00:00 GMT

A 24-byte name buffer read with 100 bytes, overflowing into the command string passed to system().

basic_exploitation_002

Tue, 18 Aug 2026 00:00:00 GMT

printf(buf) instead of printf("%s", buf) - a format string bug turned into a GOT overwrite.

mistake

Tue, 18 Aug 2026 00:00:00 GMT

Operator precedence: the result of the comparison lands in fd instead of the file descriptor from open().

random

Tue, 18 Aug 2026 00:00:00 GMT

rand() is never seeded, so it returns the same value every run and the password is a fixed constant.

bof

Tue, 18 Aug 2026 00:00:00 GMT

A stack canary blocks the naive overflow, so the write has to be placed around it rather than through it.

collision

Tue, 18 Aug 2026 00:00:00 GMT

Twenty input bytes are read as five ints and summed; any five values adding to 0x21DD09EC pass the check.

fd

Tue, 18 Aug 2026 00:00:00 GMT

atoi(argv[1]) - 0x1234 becomes a file descriptor, so passing 4660 makes the program read from stdin.

PEPassword

Tue, 18 Aug 2026 00:00:00 GMT

A packed PE unpacked first, then the password-check and decryption paths traced in the original binary.

SimpleVM

Tue, 18 Aug 2026 00:00:00 GMT

A tiny bytecode VM validating the key; solving it means understanding the instruction set and running it backwards.

Direct3D FPS

Tue, 18 Aug 2026 00:00:00 GMT

A Direct3D game where the win condition is reached by patching the check rather than playing it.

WindowKernel

Tue, 18 Aug 2026 00:00:00 GMT

A Windows kernel driver reading the keyboard port directly, communicating over IOCTL rather than user-mode input.

AutoHotkey2

Tue, 18 Aug 2026 00:00:00 GMT

UPX-packed and reporting "exe corrupt"; the CRC routine has to be debugged in the original, not the unpacked, file.

x64 Lotto

Tue, 18 Aug 2026 00:00:00 GMT

A lottery check decompiled in IDA, where the comparison can be satisfied without guessing the numbers.

AutoHotkey1

Tue, 18 Aug 2026 00:00:00 GMT

An AutoHotkey-compiled binary: recovering the DecryptKey and the EXE key, then combining them into the AuthKey.

HateIntel

Tue, 18 Aug 2026 00:00:00 GMT

The binary is for a non-Intel architecture and will not run, so the whole solve is static analysis in IDA.

Flash Encrypt

Tue, 18 Aug 2026 00:00:00 GMT

A SWF file observed dynamically by embedding it in a page, rather than decompiling the ActionScript.

Easy Unpack

Tue, 18 Aug 2026 00:00:00 GMT

Finding the original entry point of a packed binary and dumping it once the unpacking stub has run.

ImagePcr

Tue, 18 Aug 2026 00:00:00 GMT

The program compares a drawing against a bitmap held in its resources; the flag is the image it expects.

Multiplication

Tue, 18 Aug 2026 00:00:00 GMT

A Java jar with an anti-decompiler trick that breaks JD-GUI, read with CFR instead. The bug is a long overflow.

CSHOP

Tue, 18 Aug 2026 00:00:00 GMT

A .NET binary that no debugger would open, read instead as IL through a .NET decompiler.

Ransomware

Tue, 18 Aug 2026 00:00:00 GMT

Broken output until the code page is fixed, then recovering the key the sample uses to encrypt and restore files.

Easy ELF

Tue, 18 Aug 2026 00:00:00 GMT

A small Linux ELF that XORs input against a fixed table before comparing it to the stored password.

Replace

Tue, 18 Aug 2026 00:00:00 GMT

Patching the compare instruction so any input is accepted, which reveals the stored password.

Position

Tue, 18 Aug 2026 00:00:00 GMT

The serial depends on the position of each character of the name, so the keygen has to invert that mapping.

Music Player

Tue, 18 Aug 2026 00:00:00 GMT

Timing check in a media player: the program has to believe the track played to the end.

Easy Keygen

Tue, 18 Aug 2026 00:00:00 GMT

Reversing the serial routine and reimplementing it as a keygen that produces a valid serial for any name.

Easy Crack Me

Tue, 18 Aug 2026 00:00:00 GMT

Breakpointing the comparison in x32dbg and reading the expected password out one character at a time.

Crypto/Oops

Tue, 18 Aug 2026 00:00:00 GMT

I am from the future! I accidentally forgot to link chall.zip!

Bonus 1, 2 & 3

Tue, 18 Aug 2026 00:00:00 GMT

All three challenges were solved through passive investigation of public profiles and repositories connected to the fictional “newbie” character.

misc golf

Tue, 18 Aug 2026 00:00:00 GMT

Produce a number spiral while staying within a strict rendered pixel-width limit.

FaaS 1.5

Tue, 18 Aug 2026 00:00:00 GMT

The service fetched a user-supplied host with curl and displayed the page title.

pwn faas 2

Tue, 18 Aug 2026 00:00:00 GMT

The service takes a host, validates it, and passes it to curl.

Leaks

Tue, 18 Aug 2026 00:00:00 GMT

The service passed user input directly to printf, creating a format-string vulnerability.

Diabolical

Tue, 18 Aug 2026 00:00:00 GMT

The challenge presented a large, statically linked, stripped Go executable.

web wpm game2

Tue, 18 Aug 2026 00:00:00 GMT

Recover the flag through a constrained server-side expression.

Rev/MeowvelousShop

Tue, 18 Aug 2026 00:00:00 GMT

Analyze a custom virtual machine and uncover the hidden flag path.

tcache_dup

Fri, 17 Jul 2026 00:00:00 GMT

A double free puts the same chunk in the tcache list twice, so a later malloc hands back a pointer we control.