How ctf42 works
ctf42 is an archive of CTF challenges, organized by technique. Most archives list challenges by event; ctf42 also lets you find them by the vulnerability or exploitation technique behind them, so you can study a class of bug, not hunt one writeup at a time.
Why it exists
CTF knowledge is scattered across blogs, repos and dead links. When you want “heap challenges that used tcache poisoning” or “real examples of this CVE class,” no one place answers that. The writeups exist. The index didn’t. That index is the project.
How the tags work
- One canonical name per technique. Separator and case variants are normalized:
use_after_free,Use After FreeandUAFall resolve to one tag, so duplicates don’t fragment the index. - Abbreviation-aware. A technique with a common short form shows as
use-after-free (uaf), and search finds it either way: type the abbreviation or the full name, both land on the same page. - A technique tree, not a flat cloud. Tags roll up into a hierarchy
(
domain → family → technique, e.g.pwn → heap → tcache poisoning), so you can browse from “I want heap pwn” down to a specific bug. - CVEs cross-cut everything. Every CVE tag is also collected under a dedicated CVE view, independent of category, mapping real-world vulns to the challenges that exploited them.
How it’s run
Today the technique index is curated by the project to stay coherent, and the archive grows through contributions: anyone with an account can submit CTF editions, challenges and writeups, which are published after review. Opening tagging itself up to the community, so anyone can tag a challenge from the canonical vocabulary with credit for every contribution, is the direction this is heading.
Who it’s for
- Competitive players: fast, exact lookup to prep and practice by technique.
- Teachers: an organized set of worked examples to teach from.
- Clubs: mine the archive for challenge ideas, and keep your team’s knowledge alive.
- Organizers: a permanent, credited home for your past events.
Free
Free to read. No account needed to browse, no ads. Sign up to contribute →