Techniques

2309 technique / vulnerability / CVE tags across the archive. Read from writeups.

Browse by domain expand a family to see its tags; the roll-up link filters challenges

▦ pwn 936 all 936 challenges →

control-flow 273

#ret2win 58 #ret2libc 50 #ret2dlresolve 12 #ret2shellcode 7 #ret2syscall 5 #ret2system 3 #ret2csu 3 #ret2plt 1 #ret2plt-system 1 #ret2libc-one-gadget 1 #ret2usr 1 #rop 64 #srop 17 #sigreturn 2 #sigreturn-oriented-programming 2 #rop-chain 2 #rop-ret2libc 2 #orw-rop 1 #ropchain 1 #rop-syscall-chain 1 #blind-rop 1 #static-rop 1 #kernel-rop 1 #syscall-rop 1 #sigreturn-chain 1 #arm-rop 1 #rop-obfuscation 1 #got-overwrite 38 #got-leak 10 #partial-got-overwrite 1 #add-gadget-got-rewrite 1 #one-gadget 24 #stack-pivot 24

stack 252

→ all 252 stack challenges

#stack-buffer-overflow 93 #buffer-overflow 31 #stack-overflow 28 #off-by-one 21 #bof 9 #function-pointer-overwrite 8 #alloca 4 #return-address-overwrite 4 #null-byte-poisoning 4 #pointer-overwrite 3 #off-by-one-null 3 #cred-overwrite 3 #partial-overwrite 3 #environ-leak 2 #saved-rbp-overwrite 1 #proc-self-environ 1 #kernel-stack-overflow 1 #linked-list-overflow 1 #null-byte-off-by-one 1 #off-by-one-null-byte 1 #counting-sort-buffer-overflow 1 #saved-rbp-pivot 1 #v8-off-by-one 1 #sscanf-stack-overflow 1 #custom-allocator-exploitation 1 #off-by-one-stack-overflow 1 #custom-allocator 1 #null-byte-overflow 1 #wasm-buffer-overflow 1 #gets 18 #transaction-input-data-disclosure 1 #input-constraint-cracking 1 #scanf-overflow 1 #reverse-input-validation 1 #bcrypt-72-byte-input-truncation 1 #regexp-input-leak 1 #canary-leak 8 #canary-bypass 5 #stack-canary 2 #stack-canary-bypass 1 #tcbhead-canary-bypass 1 #canary-preserve 1 #canary 1 #canary-bruteforce 1 #kernel-canary-leak 1 #master-canary-bypass 1 #stack-leak 7 #stack-variable-overwrite 5 #vm-stack-pointer-corruption 2 #stack-read-write 1 #stack-memory-disclosure 1 #shadow-stack-overwrite 1 #null-byte-stack-leak 1 #uninitialized-stack-variable 1 #stack-pointer-chaining 1

heap 223

→ all 223 heap challenges

#heap-overflow 28 #heap 26 #heap-exploitation 11 #overlapping-chunks 9 #poison-null-byte 6 #heap-overlap 5 #heap-leak 2 #heap-off-by-one 2 #windows-heap-exploitation 1 #macos-heap-exploitation 1 #oob-heap-leak 1 #chunk-overlap 1 #top-chunk-overwrite 1 #mmap-chunk 1 #heap-fake-chunk 1 #kernel-heap-overflow 1 #macos-heap-overflow 1 #pointer-chunk-overwrite 1 #zig-heap-exploitation 1 #per-chunk-check 1 #png-chunk-crafting 1 #custom-chunk 1 #use-after-free (uaf) 58 #double-free 20 #kernel-uaf 4 #heap-uaf 2 #rust-double-free 1 #double-fput-uaf 1 #page-level-uaf 1 #rust-use-after-free 1 #cross-cache-uaf 1 #tcache-poisoning 42 #tcache 22 #tcache-dup 5 #tcache-double-free 2 #tcache-perthread-corruption 2 #tcache-stash-unlink 1 #tcache-grooming 1 #tcache-stashing-unlink 1 #tcache-perthread-struct 1 #tcache-corruption 1 #malloc-hook 8 #free-hook 7 #malloc-hook-overwrite 6 #free-hook-overwrite 3 #realloc-hook-malloc-hook-overwrite 1 #free-hook-one-gadget 1 #hook-overwrite 1 #fastbin-attack 8 #fastbin-dup 6 #fastbin 5 #fastbin-fd-overwrite 1 #house-of-force 3 #house-of-orange 3 #house-of-storm 2 #house-of-einherjar 2 #house-of-spirit 2 #house-of-rust 2 #house-of-husk 1 #house-of 1 #house-of-apple 1 #house-of-botcake 1 #unsorted-bin-leak 5 #unsorted-bin-attack 3 #unlink 2 #unsafe-unlink 2 #unsorted-bin 2 #largebin-attack 2

memory-primitive 112

→ all 112 memory-primitive challenges

#arbitrary-write 15 #variable-overwrite 10 #negative-index 10 #oob-write 10 #out-of-bounds (oob) 9 #arbitrary-read-write 8 #write-what-where 6 #oob-index 5 #oob-read 5 #arbitrary-read 4 #out-of-bounds-write 3 #uninitialized-variable 3 #oob-index-write 2 #local-variable-overwrite 2 #function-pointer-jump 1 #2d-memory-oob 1 #global-variable-overwrite 1 #uninitialized 1 #out-of-bounds-read 1 #oob-tape 1 #uninitialized-stack 1 #uninitialized-rand 1 #python-negative-index 1 #privilege-variable-overwrite 1 #negative-array-index 1 #function-pointer-hijack 1 #typedarray-oob 1 #oob-read-write 1 #php-ffi-oob 1 #stack-oob 1 #bytecode-interpreter-oob 1 #uninitialized-leak 1 #out-of-bounds-array-index 1 #array-oob 1 #uninitialized-heap-memory 1 #q3vm-oob 1 #note-oob 1 #shader-oob 1 #uninitialized-memory 1 #qemu-oob 1

format-string 97

→ all 97 format-string challenges

#format-string 88 #format-string-leak 3 #format-string-overflow 1 #snprintf-overflow 1 #snprintf 1 #snprintf-return-oob 1 #format-string-got-overwrite 1 #format-string-stack-rop 1 #blind-format-string 1 #python-format-string-injection 1

shellcode 83

→ all 83 shellcode challenges

#shellcode 45 #orw 12 #shellcode-injection 6 #restricted-charset 3 #ascii-shellcode 2 #restricted-shellcode 2 #printable-shellcode 1 #shellcode-stager 1 #orw-shellcode 1 #tiny-shellcode 1 #rwx-shellcode 1 #shellcode-filter-bypass 1 #wasm-shellcode 1 #float-encoding-shellcode 1 #seccomp-orw-shellcode 1 #badchars-bypass 1 #split-shellcode 1 #arm-ret2shellcode 1 #arm-shellcode 1 #ascending-byte-shellcode 1 #alphanumeric-shellcode 1 #seccomp-shellcode 1 #staged-shellcode 1 #mprotect-shellcode 1 #reverse-shell-shellcode 1 #mov-only-shellcode 1 #seccomp-orw 1 #self-modifying-shellcode 1 #jit-shellcode 1

leak 73

→ all 73 leak challenges

#info-leak 10 #libc-leak 9 #xs-leak 7 #pie-leak 4 #libc-2.27 3 #aslr-bypass 2 #no-aslr 2 #p-mod-r-leak 1 #bit-by-bit-leak 1 #unbounded-modulus-leak 1 #bitwise-leak 1 #oracle-set-membership-leak 1 #token-leak 1 #pie-brute-force 1 #dynelf-leak 1 #stdout-file-leak 1 #slab-leak 1 #adjacent-buffer-leak 1 #pie-bypass 1 #libc-2.32 1 #uclibc-heap 1 #calloc-mmap-bit-leak 1 #glibc-2.31 1 #srand-seed-leak 1 #arbitrary-libc-call 1 #leak 1 #glibc-2.34 1 #glibc-bug 1 #glibc-2.27 1 #infoleak 1 #memcmp-leak 1 #sqlite-libc-load 1 #libc-2.35 1 #pie-bruteforce 1 #libc-2.33 1 #firebase-firestore-leak 1 #glibc-rand-prediction 1 #laravel-debug-mode-leak 1 #web-push-leak 1 #error-based-leak 1 #git-leak 1 #iframe-leak 1 #thread-local-state-leak 1 #css-leak 1 #scroll-to-text-fragment-leak 1

sandbox 51

→ all 51 sandbox challenges

#seccomp 11 #seccomp-bypass 7 #sandbox-escape 7 #python-sandbox-escape 3 #vim-jail-escape 3 #python-jail-escape 2 #pyjail-escape 2 #pyjail 2 #js-sandbox-escape 2 #python-jail 1 #ocaml-jail-escape 1 #ruby-sandbox-escape 1 #jail 1 #chroot-escape 1 #ocaml-sandbox-escape 1 #seccomp-notify-escape 1 #chroot-sandbox 1 #chromium-sandbox-escape 1 #v8-sandbox-escape 1 #lua-sandbox-escape 1 #ptrace-sandbox-escape 1 #ptrace-anti-debug 1 #jsdom-sandbox-escape 1

kernel 37

→ all 37 kernel challenges

#kernel-exploitation 6 #kernel 4 #kernel-exploit 4 #linux-kernel-exploitation 3 #privilege-escalation 3 #syscall 2 #fg-kaslr-bypass 2 #userfaultfd 2 #32bit-syscall-bypass 1 #execve-syscall 1 #kernel-ret2usr 1 #windows-kernel 1 #kernel-boot 1 #syscall-filter 1 #syscall-blacklist-bypass 1 #arbitrary-syscall 1 #kernel-module-lpe 1 #windows-kernel-oob 1 #kernel-dos 1 #modprobe-path-overwrite 1 #kernel-race-condition 1 #kpti-bypass 1 #ioctl 1 #rust-kernel-driver 1 #custom-syscall 1

integer 27

→ all 27 integer challenges

#integer-overflow 15 #off-by-null 4 #integer-underflow 3 #signed-integer-overflow 2 #integer-signedness 2 #signed-arithmetic 1 #refcount-underflow 1 #signed-exchange 1

race-condition 20

→ all 20 race-condition challenges

#race-condition 17 #jit-toctou 1 #toctou-race 1 #ssrf-toctou 1

file-struct 19

→ all 19 file-struct challenges

#fsop 10 #file-vtable-hijack 3 #file-structure 3 #file-structure-exploitation 2 #file-structure-attack 2 #stdout-vtable 1 #vtable-hijack 1 #vtable 1

side-channel 14

→ all 14 side-channel challenges

#side-channel 5 #speculative-execution 3 #timing-side-channel 3 #cache-side-channel 2 #spectre 1 #cache-timing-side-channel 1 #shellcode-side-channel 1 #flush-reload 1 #side-channel-leak 1 #spectre-v1 1

browser 10

→ all 10 browser challenges

#v8-exploitation 3 #browser-pwn 2 #v8-xorshift 1 #spidermonkey-jit 1 #v8 1 #spidermonkey-exploitation 1 #v8-sandbox 1 #v8-exploit 1 #wasm-pwn 1

loader 6

→ all 6 loader challenges

#audit-hook-bypass 3 #ld-preload 3

general 1

→ all 1 general challenges

#pwn 1

other 132

→ all 132 other challenges

#strcmp-null-byte-bypass 2 #labview-reversing 2 #jit-spray 2 #memory-editing 2 #call-gate 2 #msg-msg 2 #gameboy 2 #custom-compression 2 #rwx-page 2 #musl-heap 2 #meta-corruption 2 #cpp 2 #ncurses 2 #instruction-whitelist-bypass 1 #jemalloc-corruption 1 #js-engine 1 #bypass-check 1 #fork-ipc 1 #glob-tilde-overflow 1 #jop 1 #vi-block-diagram 1 #loongarch64 1 #cross-cache-overflow 1 #arp-spoofing 1 #container-escape 1 #fini-array-overwrite 1 #fd-hijack 1 #elf-format-crafting 1 #leaked-buffer-address 1 #cross-cache 1 #fee-on-transfer 1 #erc20 1 #large-bin-attack 1 #dispatcher-gadget 1 #cross-chain-bridge 1 #transfer-root-spoofing 1 #pie 1 #x86-64 1 #null-pointer-write 1 #multithreading 1 #cve-2023-21688 1 #log4shell 1 #jmp-into-literal 1 #blind-pwn 1 #executable-stack 1 #getdents 1 #leaked-address 1 #uint64-wraparound 1 #refcount-mismatch 1 #role-forgery 1 #stack-depth-alias-primitive 1 #null-byte-bypass 1 #telegram-api 1 #afl-fuzzing 1 #callback-register 1 #token-stealing 1 #rwx 1 #mmap-page-cache 1 #glibc 1 #pyjnius 1 #struct-confusion 1 #libcob 1 #custom-heap 1 #op-tee 1 #trustlet 1 #strlen-overflow 1 #mach-o-pie 1 #stack-reorder 1 #memcmp-bypass 1 #io-obstack-jumps 1 #rwx-segment 1 #netscape 1 #browser-exploitation 1 #integer-truncation 1 #brop 1 #stack-overwrite 1 #disable-functions-bypass 1 #chankro 1 #torque-builtin-bug 1 #mojo-ipc 1 #c++-decompression 1 #small-string-optimization 1 #missing-null-terminator 1 #adjacent-memory-disclosure 1 #dangling-pointer 1 #stack-use-after-return 1 #fd-overwrite 1 #hypervisor 1 #mimalloc 1 #bootsector-pwn 1 #fputws-closed-stderr 1 #alignment-overflow 1 #function-whitelist-bypass 1 #import-alias 1 #x87-mmx-register-aliasing 1 #float-encoded-address 1 #net-scheduler 1 #qdisc 1 #iago-attack 1 #entrybleed 1 #struct-overwrite 1 #heap-reuse 1 #cve-2021-31439 1 #ffi-pointer-abuse 1 #map-fixed 1 #dl-fini 1 #commit-creds 1 #open-read-write 1 #dirtypipe 1 #swap-tampering 1 #vim9script 1 #risc-v 1 #macos-xpc-exploitation 1 #valgrind-escape 1 #stack-buffer 1 #restricted-shell-escape 1 #c-extension 1 #cet-bypass 1 #jmpbuf-hijack 1 #shared-ptr 1 #smm-exploit 1 #smram-overwrite 1 #linked-list 1 #argument-count-mismatch 1 #missing-signer-check 1 #stack-manipulation 1 #cpp-object-corruption 1 #pointer-guard-bypass 1 #cve-2014-4699 1 #sysret 1 #prefetch-attack 1 #tile-gx-architecture 1 #exotic-architecture 1 #jit 1 #nested-vmx 1 #page-cache 1 #stack-hijack 1 #stdvariant 1 #iterator-invalidation 1 #iopl 1 #retbleed 1

▦ crypto 873 all 873 challenges →

rsa 151

→ all 151 rsa challenges

#rsa 112 #crt 14 #hastad-broadcast 7 #factordb 7 #factorization 7 #wiener-attack 7 #coppersmith 6 #low-exponent 5 #fermat-factorization 5 #cube-root 4 #common-modulus-attack 4 #franklin-reiter 4 #common-factor 3 #multiprime 3 #low-public-exponent 2 #nth-root 2 #rsa-signature-forgery 2 #ecm-factorization 2 #common-modulus 2 #non-squarefree-rsa 2 #hastad-broadcast-attack 2 #multi-prime 2 #smooth-modulus-factorization 1 #safe-prime-factorization 1 #rsa-blinding-forgery 1 #rsa-factordb 1 #rsa-factoring 1 #rsa-shared-prime 1 #rsa-common-modulus-attack 1 #rsa-variant 1 #multiprime-rsa 1 #cube-root-attack 1 #common-factor-gcd 1 #multi-prime-rsa 1 #rsa-cube-root-attack 1 #rsa-common-modulus 1 #rsa-low-exponent 1 #rsa-related-primes 1 #d-to-factorization 1 #rsa-factorization 1 #factordb-factorization 1 #rsa-malleability 1 #known-factorization 1 #rsa-cm-factorization 1 #digit-sum-crt 1 #crt-reconstruction 1 #coppersmith-short-pad 1 #nth-roots-of-unity 1 #rsa-group 1 #factorization-from-hint 1 #prime-power-modulus-factorization 1 #small-modulus-factorization 1 #integer-factorization 1

classical 134

→ all 134 classical challenges

#xor 41 #substitution-cipher 15 #rot13 7 #vigenere 6 #vigenere-cipher 6 #xor-cipher 6 #repeating-key-xor 4 #xor-decryption 4 #hill-cipher 3 #classical-cipher 3 #known-plaintext-xor 3 #repeating-key 3 #custom-cipher 3 #xor-keystream 3 #xor-decode 3 #affine-sbox 2 #baconian-cipher 2 #single-byte-xor 2 #substitution-permutation-network 1 #atbash-cipher 1 #bigram-substitution 1 #substitution 1 #bacon-cipher 1 #rail-fence-cipher 1 #dictionary-substitution 1 #atbash 1 #transposition-cipher 1 #otp-key-reuse 1 #xor-keystream-reversal 1 #homophonic-substitution 1 #affine-cipher 1 #book-cipher 1 #xor-bruteforce 1 #otp-bruteforce 1 #custom-cipher-reversing 1 #shift-xor-cipher-inversion 1 #shift-add-xor-cipher 1 #xor-decryption-reversing 1 #stateful-xor-cipher 1 #substitution-recovery 1 #bit-transposition 1 #xor-decrypted-self-modifying-code 1

encoding 105

→ all 105 encoding challenges

#base64 9 #morse-code 7 #binary-patching 7 #encoding 6 #crc 6 #multi-layer-encoding 4 #run-length-encoding 4 #mprotect 4 #binary-encoding 3 #custom-encoding 3 #rot47 2 #nested-encoding 2 #encoding-chain 2 #nested-base64 2 #base-conversion 2 #morse 2 #unicode-normalization 2 #bit-rotation 2 #double-encoding 2 #groth16-proof-forgery 1 #protected-zip-extraction 1 #binary-search-factoring 1 #octal-to-ascii-decoding 1 #multi-encoding 1 #filesystempreferences-encoding 1 #hex-to-ascii 1 #no-key-encoding 1 #base64-decoding 1 #multi-layer-base64 1 #base-b-coefficient-recovery 1 #dictionary-encoding 1 #base64-encoding 1 #combinatorial-encoding 1 #card-trick-protocol 1 #encoding-decoding 1 #protocol-decoding 1 #custom-base64 1 #byte-pair-encoding 1 #protocol-parsing 1 #ascii-value-stego 1 #base32 1 #binary-to-ascii-decoding 1 #t9-multitap-encoding 1 #xor-encoding 1 #custom-encoding-reversal 1 #binary-search 1 #base64-custom-alphabet 1 #network-protocol 1 #unicode-overflow 1 #mitm-protocol-tampering 1 #unicode-constraint 1 #binary-diffing 1 #xor-rotating-key 1 #network-protocol-reversing 1 #protocol-analysis 1 #dna-encoding 1 #static-binary-patching 1 #nuitka-binary-reversing 1 #go-binary-reversing 1 #byte-rotation 1 #url-encoding 1 #negabinary-fft 1 #unicode-case-expansion 1 #unicode-case-mapping-bypass 1 #unicode-int-bypass 1 #gopher-protocol 1 #lfi-double-encoding 1

block-cipher 94

→ all 94 block-cipher challenges

#caesar-cipher 13 #aes 10 #padding-oracle 9 #aes-cbc 8 #aes-ctr 7 #aes-ecb 6 #bit-flip 4 #key-reuse 4 #block-cipher 3 #ecb 3 #mac-forgery 3 #aes-gcm 3 #cbc-mac-forgery 2 #bit-flipping 2 #ecb-oracle 2 #cbc-bit-flipping 2 #cbc-iv-bit-flip 2 #aes-ctr-nonce-reuse 1 #reduced-round-aes 1 #ecb-penguin 1 #bit-flip-recovery 1 #des 1 #block-reordering 1 #3des 1 #aes-cfb 1 #iv-reuse 1 #iv-leaks-password 1 #cbc-mac 1 #cbc-padding-oracle 1 #bit-flipping-attack 1 #aes-decryption-oracle 1 #aes-cbc-malleability 1 #cbc-mode 1 #cbc 1 #length-extension 1 #block-cipher-cryptanalysis 1 #static-key-reuse 1 #ofb 1 #gcm 1 #iv-recovery 1 #aes-ctr-keystream-recovery 1 #aes-ctr-fixed-key 1 #pbkdf2-aes 1 #aes-ni 1 #aes-decryption 1 #hmac-forgery 1 #aes-gcm-nonce-reuse 1

number-theory 88

→ all 88 number-theory challenges

#linear-algebra 8 #hash-collision 6 #hash-length-extension 6 #custom-hash 5 #modular-arithmetic 5 #subset-sum 4 #lagrange-interpolation 4 #polynomial 3 #polynomial-factorization 3 #secret-sharing 3 #quadratic-residue 3 #modular-square-root 3 #hash-cracking 2 #custom-hash-collision 2 #modular-inverse 2 #matrix 2 #legendre-symbol 2 #finite-field 2 #shamir-secret-sharing 2 #lattice-reduction 2 #modular-addition 1 #wiener-lattice-attack 1 #password-hash-cracking 1 #hash-length-extension-attack 1 #linear-algebra-cryptanalysis 1 #modular-oracle 1 #sum-of-squares-rsa 1 #polynomial-ring-rsa 1 #gf(2)-polynomial-factorization 1 #polynomial-inversion 1 #symmetric-polynomial 1 #lll-lattice-attack 1 #polynomial-leak 1 #lcg-lattice-recovery 1 #python-hash-collision 1 #matrix-trace 1 #fiat-shamir-forgery 1 #gf2-linear-algebra 1 #rsa-polynomial-root-recovery 1 #quadratic-residue-distinguisher 1 #modular-roots 1 #matrix-inversion 1 #hash-reversal 1 #lattice-signature 1 #xor-secret-sharing 1 #hash-based-signature 1 #dickson-polynomial 1 #permutation-polynomial 1 #quadratic-residue-mapping 1 #matrix-algebra-gf-p 1 #modular-linear-scheme 1 #hash-byte-reversal 1 #matrix-inversion-reversing 1 #modular-exponentiation 1 #hash-precomputation 1

bruteforce-solve 87

→ all 87 bruteforce-solve challenges

#z3 21 #meet-in-the-middle (mitm) 13 #bruteforce 13 #constraint-solving 12 #brute-force 11 #z3-solver 3 #password-bruteforce 2 #public-exponent-bruteforce 1 #small-key-bruteforce 1 #permutation-bruteforce 1 #shift-cipher-bruteforce 1 #byte-by-byte-bruteforce 1 #zipcode-bruteforce 1 #passphrase-bruteforce 1 #brute-force-permutation 1 #zip-crc32-bruteforce 1 #small-keyspace-bruteforce 1 #per-column-bruteforce 1 #pin-bruteforce 1 #bruteforce-reversing 1 #z3-constraint-solving 1 #exhaustive-brute-force 1 #per-byte-bruteforce 1 #byte-at-a-time-bruteforce 1 #gdb-bruteforce 1

prng 75

→ all 75 prng challenges

#prng 6 #lcg 6 #prng-prediction 6 #mt19937 5 #mt19937-prediction 3 #prng-seed-bruteforce 3 #seed-bruteforce 3 #seeded-prng 3 #predictable-rng 3 #weak-prng 2 #mersenne-twister 2 #lcg-nonce 2 #seed-recovery 2 #predictable-prng 2 #srand-time-seed 2 #predictable-rng-seed 1 #time-seeded-prng 1 #lcg-prng-prediction 1 #weak-randomness 1 #truncated-lcg 1 #ec-lcg 1 #time-based-seed 1 #mersenne-prime 1 #python-random-prediction 1 #legendre-prng 1 #unseeded-rand-prng 1 #predictable-prng-key 1 #prng-seed-rsa 1 #mt19937-seed-bruteforce 1 #prng-seed 1 #paillier-predictable-randomness 1 #prng-seed-recovery 1 #python-mersenne-twister 1 #predictable-on-chain-randomness 1 #keccak-prng 1 #weak-seed 1 #numpy-mt19937 1 #lcg-recovery 1 #mersenne-twister-untemper 1 #java-random 1 #mersenne-modulus 1 #prng-seed-collision 1 #time-seeded-canary-bypass 1 #prng-seed-overwrite 1 #dotnet-random 1 #srand-seed-overwrite 1 #srand-seed-prediction 1 #weak-seeding 1 #srand-time-seed-bruteforce 1 #xorshift-table-regeneration 1 #prng-reconstruction 1 #fixed-seed-prng 1 #rand-seed 1 #date-seeded-key 1 #fixed-srand-seed 1 #securerandom-prediction 1

signature-pubkey 39

→ all 39 signature-pubkey challenges

#signature-forgery 8 #nonce-reuse 7 #signature-oracle 2 #elgamal 2 #rabin-cryptosystem 2 #biased-nonce 2 #signature-malleability 2 #schnorr 2 #csp-nonce-bypass 2 #file-signature 1 #elgamal-signature 1 #dsa 1 #signature 1 #file-signature-repair 1 #bls-signature 1 #weak-nonce 1 #nonce-bruteforce 1 #paillier 1 #file-signature-fix 1 #short-nonce-bruteforce 1 #signature-bypass 1 #elgamal-variant 1 #jar-signature-forgery 1 #file-signature-spoofing 1 #php-signature-forgery 1 #predictable-nonce 1

key-recovery 38

→ all 38 key-recovery challenges

#state-recovery 5 #key-recovery 4 #small-private-exponent 4 #partial-key-exposure 3 #rlwe-key-recovery 2 #phi-leak-factorization 1 #partial-key-recovery 1 #corrupted-private-key 1 #xor-state-recovery 1 #private-key-recovery 1 #leaked-private-key 1 #partial-private-key-recovery 1 #phi-factorization 1 #private-key-disclosure 1 #e-and-phi-not-coprime 1 #phi-multiple-leak 1 #adaptive-key-recovery 1 #lcg-state-recovery 1 #predictable-private-exponent 1 #phi-multiple 1 #masked-key-recovery 1 #partial-key-bruteforce 1 #drm-key-recovery 1 #prng-state-recovery 1 #ptr-guard-key-recovery 1

ecc 37

→ all 37 ecc challenges

#ecdsa 9 #isogeny 6 #ecdlp 4 #csidh 3 #sidh 3 #smart-attack 3 #ecc 2 #hyperelliptic-curve 2 #elliptic-curve-over-ring 1 #supersingular-elliptic-curve 1 #ecdsa-nonce-reuse 1 #mov-attack 1 #elliptic-curve-recovery 1 #invalid-curve 1 #elliptic-curve 1 #twisted-edwards-curve 1 #edwards-to-weierstrass 1 #ecdsa-signature-forgery 1 #ecc-over-zmod-n 1 #ecc-over-composite-modulus 1 #ecdsa-nonce-bias 1

lattice 31

→ all 31 lattice challenges

#lattice 17 #lll (lll-lattice-reduction) 12 #knapsack 4 #lwe 3 #hidden-number-problem 2 #greedy-knapsack 1 #lwe-cvp 1 #cvp 1 #orthogonal-lattice 1 #superincreasing-knapsack 1

stream-cipher 31

→ all 31 stream-cipher challenges

#lfsr 8 #rc4 5 #keystream-reuse 5 #keystream-recovery 4 #stream-cipher 3 #lcg-keystream 2 #chacha20-poly1305 2 #reversible-stream-cipher 1 #cellular-automata-keystream 1 #rc4-fms 1 #filtered-lfsr 1 #stream-cipher-cryptanalysis 1 #keystream 1 #stream-cipher-bitflip 1

attack-model 30

→ all 30 attack-model challenges

#known-plaintext 14 #chosen-plaintext 3 #parser-differential 3 #differential-cryptanalysis 2 #linear-cryptanalysis 2 #related-message 2 #franklin-reiter-related-message 1 #chosen-ciphertext-attack 1 #xor-known-plaintext 1 #known-plaintext-endbr64 1

discrete-log 28

→ all 28 discrete-log challenges

#discrete-log 10 #diffie-hellman 9 #pohlig-hellman 8 #p-adic-discrete-log 1 #diffie-hellman-key-exchange 1 #matrix-discrete-logarithm 1 #discrete-log-bruteforce 1 #discrete-log-oracle 1 #2-adic 1 #discrete-logarithm 1 #custom-group-dlp 1 #weak-diffie-hellman 1

oracle-sidechannel 23

→ all 23 oracle-sidechannel challenges

#timing-attack 3 #lsb-oracle 2 #decryption-oracle 2 #padding 1 #digit-oracle 1 #hamming-distance-oracle 1 #modulus-recovery-oracle 1 #character-oracle 1 #compression-oracle 1 #signing-oracle 1 #pkcs7-padding 1 #base64-padding-position 1 #oracle-attack 1 #binary-search-oracle 1 #oracle 1 #strncmp-oracle 1 #fault-injection-oracle 1 #search-filter-oracle 1 #signing-oracle-forgery 1

hash 14

→ all 14 hash challenges

#merkle-hellman 4 #md5 2 #sha1 2 #merkle-proof 1 #storage-collision 1 #hmac-key-length-collision 1 #truncation-collision 1 #md5-collision 1 #unsalted-md5 1

protocols 10

→ all 10 protocols challenges

#graph-encryption 3 #homomorphic 2 #oblivious-transfer 2 #oblivious-transfer-attack 1 #commitment-scheme 1 #garbled-circuits 1

other 199

→ all 199 other challenges

#gf3 2 #maritime-signal-flags 2 #binary 2 #xortool 2 #boneh-durfee 2 #murmurhash3 2 #keyboard-shift-cipher 2 #shift-cipher 2 #continued-fractions 2 #close-primes 2 #rockyou 2 #rsactftool 2 #known-prime 2 #uncompyle6 2 #visual-cryptography 2 #many-time-pad 2 #gcd 2 #correlation-attack 2 #leakage-abuse 2 #small-e 2 #ckks 2 #modulus-recovery 2 #gf2-linear-system 2 #color-to-binary 1 #cantor-pairing 1 #recursive 1 #inverse-pairing 1 #custom-block-chaining 1 #hardcoded-password 1 #visual-decoding 1 #rlwe-error-reuse 1 #hex 1 #self-shifted-xor 1 #whitebox-rsa 1 #key-extraction 1 #ftp-credential-sniffing 1 #predictable-rand 1 #cryptogram 1 #gf2-linearization 1 #decoding 1 #nibble-swap 1 #mirdek-cipher 1 #dancing-men-cipher 1 #embedded-key 1 #cyberchef 1 #weak-ssh-key 1 #salted-sha256 1 #dictionary-attack 1 #custom-sbox 1 #eth-root 1 #prime-reconstruction 1 #bloom-filter 1 #solfa-cipher 1 #music-cipher 1 #degenerate-generator 1 #textbook-decryption 1 #small-subgroup-attack 1 #keyboard-trace 1 #existential-forgery 1 #unhashed-message 1 #mask-bypass 1 #layer-extraction 1 #leaked-ssh-key 1 #futurama-alphabet 1 #gif-frame-extraction 1 #bit-truncation 1 #oaep 1 #acrostic-cipher 1 #oil-and-vinegar 1 #frequency-analysis 1 #linear-system 1 #time-based-key 1 #small-primes 1 #reversible-arithmetic-cipher 1 #superincreasing-sequence 1 #word-search 1 #multiplicative-cipher 1 #small-exponent-e=3 1 #cows-and-bulls 1 #small-parameters 1 #multivariate-crypto 1 #linear-part-recovery 1 #groebner-basis 1 #linear-system-solving 1 #birthday-attack 1 #24-letter-alphabet 1 #residue-recovery 1 #malleability 1 #gps-coordinates 1 #zlib 1 #weak-key-derivation 1 #fermat-little-theorem 1 #png-bit-transform 1 #visual-recovery 1 #linear-congruence-recovery 1 #two-time-pad 1 #dsa-malicious-generator 1 #fcsr 1 #cyberchef-magic 1 #ocr 1 #fermat-pseudoprime 1 #sqisign 1 #cycle-length-attack 1 #vieta 1 #small-factor 1 #prime-combination 1 #wilsons-theorem 1 #primes-near-power-of-two 1 #textbook-rsa 1 #cycling-attack 1 #spn 1 #logic-gates 1 #oulipo 1 #n+7 1 #castryck-decru 1 #torsion-point 1 #substitute-mix-shift 1 #signal-flag-decoding 1 #simulated-annealing 1 #permutation-cipher 1 #special-primes 1 #convolution 1 #a1z26 1 #geo-coordinates 1 #country-lookup 1 #scytale-cipher 1 #multiplicative-hash 1 #implicit-factoring 1 #tree-search 1 #vimcrypt 1 #vietas-formulas 1 #enigma-machine 1 #divisor-arithmetic 1 #burrows-wheeler-transform 1 #crime 1 #chained-xor 1 #cipher-feedback 1 #zodiac-cipher 1 #leaked-prime 1 #common-prime 1 #word-frequency-analysis 1 #known-sum 1 #bit-complement 1 #byte-at-a-time 1 #higher-power-residue 1 #partial-prime-recovery 1 #bb84 1 #radix-conversion 1 #benaloh-cryptosystem 1 #higher-residuosity 1 #negative-value 1 #slide-attack 1 #feistel 1 #token-decryption 1 #query-recovery 1 #cipher-cycle-detection 1 #xor-cancellation 1 #blum-blum-shub 1 #msb-recovery 1 #bit-by-bit-dfs-factoring 1 #ecm-factoring 1 #ehnp 1 #factoring 1 #weil-pairing 1 #interlock-mitm 1 #small-modulus-factoring 1 #x509-certificate 1 #chosen-exponent 1 #greedy 1 #small-multiplicative-order 1 #rlwe 1 #unicoll 1 #hashclash 1 #lz4 1 #linear-recurrence 1 #composite-modulus 1 #winternitz-ots-forgery 1 #resultant 1 #point-recovery 1 #operation-inversion 1 #duplicate-parameter 1 #vdf 1 #repeated-squaring 1 #fujisaki-okamoto 1 #kem 1 #float-prediction 1 #rejection-sampling 1 #pdf-encryption 1 #pigpen-cipher 1 #blinding 1 #on-chain-secret-exposure 1 #permutation 1 #mask-recovery 1 #shared-prime-factor 1 #block-shuffling 1 #feistel-cipher 1 #algebraic-cryptanalysis 1 #css-cipher 1 #trigonometric-reconstruction 1 #untwist 1 #related-primes 1 #torsion-point-attack 1 #winternitz 1 #forgery 1 #xor-leak-factoring 1 #bit-by-bit-factoring 1 #bsgs 1 #nist-p256 1 #pairing-attack 1 #dotsies-cipher 1 #stereotyped-message 1 #shared-modulus 1 #factor-n-via-d 1 #low-density-attack 1

▦ web 355 all 355 challenges →

xss 76

→ all 76 xss challenges

#xss 40 #css-injection 8 #dom-clobbering 7 #stored-xss 7 #dompurify-bypass 4 #html-injection 2 #dom-xss 2 #css-injection-leak 1 #mxss 1 #dns-txt-record-xss 1 #svg-xss 1 #xss-event-handler 1 #xss-filter-bypass 1 #xss-cookie-httponly-bypass 1 #postmessage-xss 1 #xss-csrf-chain 1 #xss-sanitizer-bypass 1 #mutation-xss 1 #dom-based-xss 1

auth 46

→ all 46 auth challenges

#jwt 6 #auth-bypass 6 #cookie-theft 5 #authentication-bypass 4 #access-control-bypass 4 #broken-access-control 4 #idor 3 #flask-session-forgery 2 #cookie-injection 2 #move-access-control 1 #pointer-authentication 1 #jwt-algorithm-confusion 1 #login-link-forgery 1 #php-session-upload-progress 1 #password-reset 1 #cookie-tossing 1 #cookie-path-bypass 1 #mqtt-authorization-bypass 1 #jwt-none-algorithm 1 #java-cookie-parsing 1 #jwt-secret-cracking 1 #cookie-tampering 1

injection 44

→ all 44 injection challenges

#command-injection 17 #rce 8 #argument-injection 5 #php-code-injection 2 #crlf-injection 2 #php-eval-injection 1 #python-eval-injection 1 #inter-process-code-injection 1 #rce-gadget 1 #ftp-crlf-injection 1 #php-session-lfi-rce 1 #git-submodule-hook-rce 1 #exiftool-rce 1 #php-rce 1 #http-header-injection 1 #sed-command-injection 1 #war-deploy-rce 1 #curl-argument-injection 1 #dc-rce 1

sql-injection 41

→ all 41 sql-injection challenges

#sql-injection 26 #nosql-injection 3 #sqlite-injection 2 #error-based-sqli 2 #sqlite-fts3-tokenizer 1 #sqlite-load-extension 1 #union-sql-injection 1 #blind-sql-injection 1 #order-by-sql-injection 1 #sql-injection-into-outfile 1 #second-order-sqli 1 #sqlite 1 #sqlite-rce 1

path-traversal 37

→ all 37 path-traversal challenges

#path-traversal 17 #lfi (local-file-inclusion) 10 #local-file-read 2 #arbitrary-file-write 1 #arbitrary-file-read 1 #jsonnet-file-read 1 #html-to-pdf-lfi 1 #double-url-encode-path-traversal 1 #arbitrary-file-upload 1 #client-side-path-traversal 1 #caddy-path-traversal 1 #jwt-kid-path-traversal 1 #path-traversal-lfi 1

framework-specific 32

→ all 32 framework-specific challenges

#nodejs 5 #flask 3 #php-filter-bypass 2 #php-object-injection 2 #nginx-misconfiguration 2 #apache 1 #apache-module 1 #websocket 1 #nginx-gunicorn-path-bypass 1 #php-wrappers 1 #nginx-server-name-bypass 1 #php-fpm 1 #nginx-path-normalization-bypass 1 #php-eval-filter-bypass 1 #express 1 #graphql-batching-attack 1 #graphql-batching-bypass 1 #nodejs-vm-escape 1 #nextjs-source-api-disclosure 1 #php-disable-functions-bypass 1 #php-file-upload-bypass 1 #nginx-path-normalization 1 #nodejs-vm 1

client-side 27

→ all 27 client-side challenges

#csp-bypass 19 #csrf 3 #cors-misconfiguration 1 #cors-bypass 1 #dangling-markup 1 #no-csp 1 #csp-bypass-navigation 1 #csp-img-exfiltration 1

logic 25

→ all 25 logic challenges

#dns-rebinding 4 #mass-assignment 4 #admin-bot 4 #business-logic-flaw 3 #os-path-join 3 #logic-flaw 3 #token-economy-logic-flaw 1 #http-parameter-pollution 1 #admin-bot-token-theft 1 #puppeteer-admin-bot 1 #parameter-pollution 1

ssti 22

→ all 22 ssti challenges

#ssti 15 #jinja2 4 #jinja2-ssti 2 #ejs-ssti 2 #pug 1 #ssti-via-filename 1 #airspeed-ssti 1 #velocity-template 1 #go-template-ssti 1

ssrf 22

→ all 22 ssrf challenges

#ssrf 19 #ssrf-file-scheme 1 #ssrf-host-header 1 #fastcgi-ssrf 1 #gopher 1

general 22

→ all 22 general challenges

#web 22

deserialization 12

→ all 12 deserialization challenges

#insecure-deserialization 3 #deserialization 2 #php-session-deserialization 2 #marshal-bytecode 1 #ruby-deserialization 1 #gadget-chain 1 #pickle-deserialization 1 #phar-deserialization 1 #unsafe-deserialization 1

filter-bypass 12

→ all 12 filter-bypass challenges

#filter-bypass 7 #waf-bypass 3 #blacklist-bypass 2

redirect 4

→ all 4 redirect challenges

#open-redirect 2 #meta-redirect 1 #x-accel-redirect 1

smuggling-cache 3

→ all 3 smuggling-cache challenges

#cache-poisoning 2 #request-smuggling 1 #http-request-smuggling 1

xxe 2

→ all 2 xxe challenges

#xxe 1 #xpath-injection 1

other 123

→ all 123 other challenges

#php 3 #browser-extension 2 #file-upload 2 #algorithm-confusion 2 #x-forwarded-for 2 #data-exfiltration 2 #curl 2 #bfcache 2 #ast-injection 2 #pop-chain 2 #eval 2 #trusted-types 2 #ja3-tls-fingerprint-spoofing 1 #python 1 #jndi 1 #jolokia-exploitation 1 #suid 1 #http3 1 #quic 1 #htmx-injection 1 #awk-cgi 1 #patch-diffing 1 #header-ip-spoofing 1 #bun-shell-injection 1 #bbcode-parser 1 #jwks-spoofing 1 #proxy-bypass 1 #rabbitmq 1 #nodemailer-attachment 1 #http-pipelining 1 #cve-2021-40346 1 #missing-return 1 #go 1 #glob-expansion 1 #url-decode-discrepancy 1 #insecure-role-assignment 1 #touppercase-tolowercase-normalization 1 #excel-formula-injection 1 #csv-injection 1 #libreoffice 1 #host-header-path-injection 1 #webhook 1 #ftp-passive-mode 1 #http-request-splitting 1 #yafu 1 #url-parsing-bypass 1 #cache-probing 1 #http-header-manipulation 1 #esi-injection 1 #union-based 1 #cve-2024-34351 1 #cross-subdomain 1 #regex-injection 1 #float-unboxing 1 #nested-keyword-bypass 1 #caddy-admin-api 1 #log-injection 1 #lighttpd-proxy-bypass 1 #info-disclosure 1 #referer-bypass 1 #json-scientific-notation 1 #json-schema-ajv-exploitation 1 #cspt 1 #nmap 1 #xs-search 1 #postmessage 1 #iframe-injection 1 #cypher-injection 1 #tar-symlink 1 #mime-sniffing 1 #redos 1 #service-workers 1 #charset-bypass 1 #null-byte-injection 1 #captcha-bypass 1 #x-forwarded-for-spoof 1 #mceliece 1 #hamming-code 1 #service-worker 1 #object-spread-injection 1 #typescript 1 #class-pollution 1 #extension-exploitation 1 #webrtc 1 #proc-memory-read 1 #cve-2022-23632 1 #mtls-bypass 1 #cloudflare-bypass 1 #path-normalization 1 #rate-limit-bypass 1 #path-normalization-bypass 1 #parseint-coercion-bug 1 #file-scheme 1 #password-spraying 1 #charset-confusion 1 #rs256-key-confusion 1 #wildfly-undertow-temp-file-upload 1 #cve-2022-21449 1 #json-interoperability 1 #rs256-to-hs256 1 #jupyter-notebook 1 #toprimitive 1 #predictable-secret 1 #mysql 1 #newline-injection 1 #ffi 1 #angularjs-csti 1 #cve-2022-21824 1 #strtok-filename-truncation 1 #client-side-trust 1 #sql-truncation 1 #ftp 1 #user-agent-spoofing 1 #exiftool 1 #cve-2021-22204 1 #djvu 1 #deno-file-scheme 1 #form-state-restoration 1 #memcache-injection 1 #parameter-object-injection 1 #file-url-bypass 1 #uuid-prediction 1 #ejs 1 #proxy 1 #json-injection 1 #tcp-sequence-prediction 1 #subdomain-takeover 1 #bcrypt-truncation 1 #error-based-info-disclosure 1 #duplicate-registration 1

▦ rev 461 all 461 challenges →

managed-runtime 84

→ all 84 managed-runtime challenges

#android 21 #dotnet-reversing 6 #pyc-decompilation 5 #pyinstaller 5 #apk-reversing 5 #jni 4 #jadx 4 #java-reversing 4 #rust 3 #frida 3 #wasm 3 #android-native-reversing 3 #java 3 #golang-reversing 2 #apk-hardcoded-credentials 2 #android-apk-reversing 2 #rust-reversing 2 #java-decompilation 2 #pyc-decompile 2 #wasm-exploitation 2 #java-reflection 1 #golang 1 #android-reversing 1 #golang-pwn 1 #frida-native-hook 1 #apk-decompilation 1 #android-dynamic-analysis 1 #smali 1 #java-hashmap-race 1 #dotnet-mono 1 #unluac 1 #pyinstaller-unpacking 1 #pyinstaller-extraction 1 #java-jar-reversing 1 #holyc 1 #golang-reverse-engineering 1 #jni-native 1 #java-reverse 1 #java-rmi 1 #java-el-injection 1

general 84

→ all 84 general challenges

#reversing 81 #reverse-engineering 3

vm-bytecode 65

→ all 65 vm-bytecode challenges

#vm-reversing 13 #custom-vm 9 #vm-escape 8 #python-bytecode 5 #vm 5 #custom-vm-reversing 4 #bytecode 3 #brainfuck-interpreter 2 #bytecode-reversing 2 #bytecode-interpreter 2 #kvm-vm-reversing 1 #vm-pwn 1 #jit-bytecode-verifier-executor-mismatch 1 #cpython-bytecode 1 #evm-bytecode-crafting 1 #process-vm-writev 1 #opcode-filter 1 #python-bytecode-reversing 1 #opcode-fuzzing 1 #bytecode-vm-emulation 1 #custom-bytecode 1 #lua-5.1-bytecode-decompilation 1 #java-bytecode 1 #vm-obfuscation 1 #bytecode-devirtualization 1 #dvd-vm 1 #custom-interpreter 1 #jit-vm 1 #interpreter-overflow 1 #bytecode-crafting 1 #systemverilog-vm-reversing 1

windows 55

→ all 55 windows challenges

#prototype-pollution 15 #type-confusion 14 #windows-reversing 5 #type-juggling 3 #swipe-typing 1 #turbofan-escape-analysis 1 #jit-type-confusion 1 #v8-turbofan-type-confusion 1 #union-type-confusion 1 #pe-unpacking 1 #windows-driver-reversing 1 #dll-hijacking 1 #opentype-font 1 #typescript-type-system 1 #rust-type-system 1 #html-escape-bypass 1 #javascript-type-coercion 1 #ocaml-type-confusion 1 #python-type-confusion 1 #escape-bypass 1 #php-type-juggling 1 #content-type-bypass 1 #content-type-confusion 1 #javascript-scope-pollution 1

obfuscation 37

→ all 37 obfuscation challenges

#anti-debugging 7 #self-modifying-code 5 #upx-unpacking 4 #deobfuscation 3 #powershell-deobfuscation 2 #string-obfuscation 2 #obfuscated-c 2 #python-obfuscation 2 #vba-macro-deobfuscation 1 #anti-analysis 1 #obfuscation 1 #anti-debug-bypass 1 #javascript-deobfuscation 1 #llvm-obfuscation 1 #control-flow-flattening 1 #pyarmor-deobfuscation 1 #script-deobfuscation 1 #js-deobfuscation 1 #import-obfuscation 1

tooling 37

→ all 37 tooling challenges

#static-analysis 11 #ghidra 4 #ida 4 #gdb 3 #ghidra-static-analysis 3 #dynamic-analysis 3 #gdb-scripting 2 #decompilation 2 #gdb-autoload-exploit 1 #checksum-guided-debugging 1 #jar-decompilation 1 #symbol-guided-static-analysis 1 #autoit-decompilation 1 #gdb-register-extraction 1

architecture 24

→ all 24 architecture challenges

#mips 4 #x86-assembly 4 #arm 3 #powerpc 2 #riscv 2 #mips64 1 #mips-assembly 1 #riscv-shellcode 1 #aarch64 1 #anti-disassembly 1 #splitmix64-prng 1 #webassembly 1 #6502-assembly 1 #byte-assembly 1

emulation 14

→ all 14 emulation challenges

#qemu-escape 4 #simavr-emulation 1 #qemu-monitor 1 #unicorn-emulation 1 #qemu 1 #emulator-detection 1 #qemu-user 1 #unicorn-engine 1 #c64-emulation-reversing 1 #emulator-debugging 1 #emulation 1

symbolic 11

→ all 11 symbolic challenges

#angr 7 #symbolic-execution 6 #angr-solver 1 #angr-symbolic-execution 1

crackme 10

→ all 10 crackme challenges

#keygen 4 #crackme 3 #password-check-bypass 1 #license-key-reversing 1 #flag-checker 1 #password-check-reversing 1

other 168

→ all 168 other challenges

#mmap 3 #cpp-reversing 3 #hardcoded-credentials 3 #dnspy 2 #arm-reversing 2 #esoteric-language 2 #algorithm-reimplementation 2 #6502 2 #backdoor 2 #unpacking 2 #bevy 2 #tea-cipher 2 #malware-analysis 2 #gmp 2 #javascript-reversing 2 #pico-8-cartridge-reversing 1 #cheat-engine 1 #bfs 1 #graph 1 #adler32 1 #custom-dsl-reversing 1 #iso-extraction 1 #mit-app-inventor 1 #aia-reversing 1 #per-substring-check 1 #backdoored-bash-binary 1 #code-in-data-section 1 #algorithm-replication 1 #interactive 1 #multi-stage-unpacking 1 #strace-dump 1 #custom-file-format 1 #qoi 1 #css 1 #stack-string-decode 1 #debugger-patch 1 #procyon 1 #memory-search 1 #chicken-lang 1 #lisp 1 #compile-and-run 1 #firebase 1 #rle-inversion 1 #xnor-cipher 1 #renpy 1 #strcmp 1 #veh 1 #xor-self-encryption 1 #xor-swap-reversal 1 #nftables 1 #xor-rol-inversion 1 #decoy-path-elimination 1 #nes-reversing 1 #elf-patching 1 #godot 1 #risc-v-reversing 1 #stripped-binary 1 #string-decoding 1 #playdate 1 #scratch 1 #fork 1 #maldoc 1 #vba-macro 1 #tls-callback 1 #python-reversing 1 #bit-extraction 1 #bit-position-table 1 #harmonyos 1 #string-decryption 1 #static-string-analysis 1 #overridden-stack-check 1 #breakpoint-flag-extraction 1 #nim 1 #loongarch 1 #instruction-set-reversing 1 #malware-unpacking 1 #gcode 1 #minesweeper 1 #pokemon-mini 1 #s1c88 1 #false-flag 1 #vba-macro-analysis 1 #xlsm 1 #office-document 1 #custom-ftp 1 #pthread-scheduling-analysis 1 #fnv-1a-hash 1 #sigill-jit 1 #subleq 1 #oisc 1 #byte-transform-reversing 1 #self-referential-key-decryption 1 #ipc-postmessage 1 #regex 1 #feistel-key-inversion 1 #recursion 1 #memoization 1 #m68k 1 #string-analysis 1 #name-divecount-check 1 #webgl-reversing 1 #fibonacci-cipher 1 #fuzzing 1 #nucleotide 1 #predictable-key 1 #ltrace 1 #lambda-calculus 1 #tar-wildcard-injection 1 #plaintext-flag 1 #xor-decoding 1 #static-reversing 1 #spn-cipher-inversion 1 #xtea 1 #reversed-string 1 #rexx-reversing 1 #s390x-reversing 1 #zealos-reversing 1 #garmin-fit 1 #fit2csv 1 #vex-ir 1 #valgrind 1 #fortran-reversing 1 #state-machine 1 #string-count-bypass 1 #inline-asm-compile 1 #additive-cipher 1 #cellular-automaton 1 #elf 1 #inverse-transform 1 #c-preprocessor 1 #logisim-cpu-reversing 1 #cuda-reversing 1 #gpu-reversing 1 #thread-race 1 #search-pruning 1 #prime-field-crypto-reversing 1 #regex-derivatives 1 #dfa 1 #broadcast-receiver-intent 1 #scratch-project-reversing 1 #x87-fpu 1 #janet 1 #grub-cfg 1 #gf2 1 #function-hooking 1 #crc8 1 #mheg-reversing 1 #state-machine-reversing 1 #clemency 1 #custom-loader 1 #instrumentation-callback 1 #custom-isa 1 #enclave-dump 1 #nim-reversing 1 #bitwise-not 1 #tetration 1 #power-tower 1 #bignum-arithmetic 1 #quine-reversing 1 #permutation-recovery 1 #memcmp 1 #compiler-exploitation 1 #google-sheets 1 #malware-reversing 1 #self-unpacking 1 #char-shift-cipher 1 #c++-reversing 1 #elf-manipulation 1 #cryptoapi 1 #hardcoded-comparison 1 #client-side-js 1 #ternary 1 #latex 1 #multiprocessing 1 #ipc 1 #traveling-salesman 1 #floyd-warshall 1 #free-pascal 1 #r2pipe 1 #ransomware 1 #qft-adder 1 #gate-synthesis 1 #anagram 1 #byte-array-decoding 1 #int-to-bytes 1 #bit-shifting 1 #custom-architecture 1 #avx512 1 #anti-tampering 1 #function-inversion 1 #ocaml 1 #dtmf-decoding 1 #fft 1 #mxcsr 1 #mds-sbox-inversion 1 #rubber-ducky-decode 1 #kaprekar-constant 1

▦ forensics 125 all 125 challenges →

archive-cracking 31

→ all 31 archive-cracking challenges

#hashcat 3 #native-library 3 #arbitrary-storage-write 2 #zip-cracking 2 #password-cracking 2 #john 2 #zip-password-cracking 2 #archive-cracking 1 #rar 1 #zip2john 1 #pdf2john 1 #master-password-cracking 1 #restic2john 1 #john-the-ripper 1 #nested-archives 1 #encrypted-zip 1 #multi-volume-zip 1 #archive-forensics 1 #zip 1 #shared-library-cow 1 #arbitrary-null-write 1 #arbitrary-function-call 1 #library-hooking 1 #zip-bomb 1 #shared-library-injection 1 #zip-slip 1 #zip-symlink-read 1 #zip-symlink-race 1

file-analysis 29

→ all 29 file-analysis challenges

#strings 11 #binwalk 4 #exif-metadata 3 #strings-analysis 3 #polyglot-file 2 #polyglot-appended-zip 1 #binwalk-recursive-extraction 1 #binwalk-embedded-file 1 #hexdump-reconstruction 1 #binwalk-extraction 1 #exif-metadata-comment 1 #strings-extraction 1 #stack-strings 1 #polyglot 1

network 16

→ all 16 network challenges

#pcap-analysis 8 #network-forensics 3 #pcap 3 #wireshark 2 #dns-exfiltration 1 #usb-forensics 1 #usb-keystroke 1 #disk-address-packet 1

disk-fs 12

→ all 12 disk-fs challenges

#file-carving 5 #deleted-file-recovery 2 #disk-image 1 #disk-image-forensics 1 #file-recovery 1 #xcf-file-recovery 1 #evtx 1 #archive-carving 1

memory 8

→ all 8 memory challenges

#memory-forensics 3 #memory-dump 2 #core-dump-analysis 2 #volatility 1 #physical-memory-dump 1 #memory-dump-reversing 1

log-analysis 6

→ all 6 log-analysis challenges

#log-analysis 5 #windows-event-log-analysis 1

general 4

→ all 4 general challenges

#forensics 4

other 40

→ all 40 other challenges

#minecraft-nbt 2 #xlsx 2 #file-format-analysis 2 #windows 2 #http-object-extraction 2 #modbus 2 #uudecode 1 #dos-com 1 #sam-hive-analysis 1 #dpapi-decryption 1 #esp32-flashdump 1 #uac-flag-analysis 1 #xtensa-reversing 1 #smb-file-extraction 1 #firefox-credential-decryption 1 #disk-forensics 1 #regex-filtering 1 #file-repair 1 #powershell 1 #cmdscan 1 #file-header-repair 1 #linux-forensics 1 #png-repair 1 #s7comm-analysis 1 #restic-backup-cracking 1 #ntds-extraction 1 #sstv 1 #line-ending-anomaly 1 #audacity-reverse 1 #deepsound 1 #byte-stride-extraction 1 #powershell-analysis 1 #sinogram-reconstruction 1 #gaussian-deblur 1 #nmap-xmas-scan 1 #traffic-decryption 1 #figlet 1

▦ misc 241 all 241 challenges →

programming 28

→ all 28 programming challenges

#bit-manipulation 4 #floating-point 4 #maze-solving 4 #code-golf 3 #game-logic 2 #game-reversing 2 #rust-game-hacking 2 #math-random-prediction 1 #game-logic-abuse 1 #godot-game-reversing 1 #shellcode-golf 1 #logic-reconstruction 1 #game-boy-rom-reversing 1 #maze-traversal 1 #mathjax-xss 1

media 17

→ all 17 media challenges

#image-decode 1 #ppm-image 1 #docker-image-forensics 1 #image-subtraction 1 #audio-triangulation 1 #image-deblurring 1 #image-analysis 1 #image-averaging 1 #image-ocr 1 #adversarial-audio 1 #custom-image-parser 1 #image-unscramble 1 #image-unswirl 1 #audio-analysis 1 #audio 1 #image-upload-bypass 1 #imagemagick 1

esolang 16

→ all 16 esolang challenges

#brainfuck 9 #esolang 4 #befunge 4 #brainfuck-esolang 2 #esolang-reversing 1

barcode 8

→ all 8 barcode challenges

#qr-code 3 #codablock-barcode 1 #gif-frame-qr 1 #qr-code-reconstruction 1 #aztec-code 1 #qr-recovery 1

quantum 7

→ all 7 quantum challenges

#quantum-computing 2 #grovers-algorithm 2 #qiskit 2 #quantum-cloning 1 #quantum-money 1 #quantum-change-of-basis 1 #quantum-cryptography 1 #shortest-path-tree 1 #quantum 1

scripting 7

→ all 7 scripting challenges

#dynamic-programming 2 #pwntools-automation 1 #visual-programming 1 #macro-metaprogramming 1 #regex-constraints 1 #constraint-reconstruction 1

jail 4

→ all 4 jail challenges

#python-sandbox 2 #sandbox 1 #sandbox-bypass 1

git-forensics 2

→ all 2 git-forensics challenges

#base3-digit-sum 1 #git-forensics 1 #git-bundle 1

general 1

→ all 1 general challenges

#misc 1

other 162

→ all 162 other challenges

#storage-read 2 #ssl-pinning-bypass 2 #safe-linking-bypass 2 #tag-forgery 2 #huffman-coding 2 #javascript 2 #negative-size 2 #objective-c-reversing 2 #error-correction 2 #diophantine-equations 2 #tpm2 2 #prompt-injection 2 #c++ 2 #setcontext 2 #cpp-string 2 #memory-corruption 2 #modulus-recovery-gcd 2 #anomalous-curve 2 #smooth-order 2 #proc-self-maps 2 #safe-linking 2 #kvm-hypervisor 2 #automatic-exploit-generation 2 #memfd-create 2 #x86-16bit-real-mode 1 #bios-interrupts 1 #boot-reversing 1 #x86-bootloader-reversing 1 #strcpy-overlap 1 #card-duplication 1 #score-overflow 1 #keyboard-cipher 1 #ast 1 #cve-2021-41773 1 #cve-2019-12083 1 #hessian-curve 1 #signal-analysis 1 #keyboard-layout-mapping 1 #solang 1 #parameter-tampering 1 #debug-mode 1 #secret-key 1 #logic-bug 1 #compression-reconstruction 1 #deconvolution 1 #byte-at-a-time-decryption 1 #chosen-prefix 1 #atoi 1 #linear-equations 1 #api-response-inspection 1 #functionless-exploit 1 #bash-injection 1 #pca 1 #data-analysis 1 #acpi-dsdt 1 #system 1 #microsoft-seal 1 #approximate-common-divisor 1 #overlay-attack 1 #tapjacking 1 #nested-files 1 #js-engine-exploit 1 #valueof-gc-callback 1 #addrof-fakeobj 1 #keyboard-layout-cipher 1 #file-concatenation 1 #minecraft 1 #save-file-analysis 1 #ml-classifier-bypass 1 #string-concatenation 1 #libmalloc 1 #irc 1 #etherscan 1 #thread-arena 1 #non-coprime-exponent 1 #ppc 1 #scheduling-algorithm 1 #nfs-filehandle 1 #memory-disclosure 1 #lu-decomposition 1 #sms-ems-decoding 1 #file-struct-overwrite 1 #sum-of-cubes-factoring 1 #strncpy 1 #go-templates 1 #base5 1 #no-relro 1 #curve-parameter-recovery 1 #order-preserving-encryption 1 #splay-tree 1 #ssh-mitm 1 #credential-theft 1 #low-entropy-key 1 #null-terminator-overwrite 1 #srand 1 #winternitz-ots 1 #checksum-bypass 1 #ccsds 1 #covert-channel 1 #non-coprime-moduli 1 #noise-reduction 1 #enigma-cipher 1 #latex-symbols 1 #check-bypass 1 #base92-decoding 1 #jit-exploit 1 #buy-sell-dupe 1 #radio-signal-decoding 1 #quadratic-double-root-construction 1 #png 1 #shared-exponent-multiple-moduli 1 #malware-c2 1 #google-apps-script 1 #dl-fini-hijack 1 #double-url-decode 1 #command-length-limit 1 #automated-wordle-solver 1 #braille-cipher 1 #mcp-exploitation 1 #fake-file 1 #blind 1 #write-primitive 1 #text-overwrite 1 #parcelable-mismatch 1 #cve-2017-13288 1 #file-struct-exploit 1 #refcount-overflow 1 #io-file 1 #reimplementation 1 #minecraft-nbt-parsing 1 #region-file-forensics 1 #js-engine-exploitation 1 #windows-heap 1 #custom-curve 1 #point-addition-algebra 1 #heap-corruption 1 #gf-2^6 1 #forbidden-attack 1 #kexec 1 #fortify-bypass 1 #bst-index-lookup 1 #flag-reconstruction 1 #factoring-concatenated-primes 1 #static-binary 1 #amd-sev 1 #sev-register-injection 1 #micropython 1 #grep-mbedtls-test-vector 1 #loop-counter-overwrite 1 #realloc-overflow 1 #realloc-zero-size-free 1 #jit-compiler 1 #wx-memory 1 #smooth-p-1 1 #rand-prediction 1 #xoshiro256 1 #mmap-threshold-overwrite 1 #checkmaps-elimination 1 #cve-2020-8597 1 #pppd 1 #eap 1 #magic-value 1 #pwntools-abuse 1 #jump-chaining 1 #execveat 1 #module-attribute-reset 1 #hensel-lifting 1 #c++-stl 1 #trustzone 1 #swap-primitive 1 #personality 1 #stdout-file-attack 1 #key-derivation 1 #remote-attestation 1 #sealed-object 1 #pcr 1 #cve-2024-38807 1 #cpp-exploitation 1 #missing-bounds-check 1 #zsh 1 #ipc-abuse 1 #claims-forgery 1

▦ stego 28 all 28 challenges →

general 28

→ all 28 general challenges

#steganography 9 #lsb-steganography 4 #bitplane-steganography 3 #whitespace-steganography 2 #steghide 2 #zsteg 2 #audio-steganography 2 #spectrogram 2 #spectrogram-stego 1 #ip-fragment-offset-stego 1 #font-steganography 1 #chess-notation-stego 1 #stegcracker 1 #rbp-lsb-overwrite 1 #header-whitespace-normalization 1

▦ blockchain 27 all 27 challenges →

general 21

→ all 21 general challenges

#smart-contract 9 #reentrancy 1 #flash-loan 1 #evm-quine 1 #predictable-blockchain-rng 1 #smart-contract-logic-error 1 #ethereum-storage-read 1 #blockchain 1 #solidity 1 #delegatecall 1 #blockchain-osint 1 #solidity-smart-contract-reversing 1 #blockchain-transaction-tracing 1 #solana 1 #ton-smart-contract 1 #solana-account-confusion 1

other 9

→ all 9 other challenges

#hardcoded-secret 2 #cairo-starknet-contract-reversing 1 #metamorphic-contract 1 #private-storage-read 1 #storage-reading 1 #move-state-machine 1 #private-variable-exposure 1 #ton 1 #shared-state-abuse 1

▦ hardware 28 all 28 challenges →

general 24

→ all 24 general challenges

#logic-circuit-reversing 4 #verilog-reversing 3 #hardware 2 #logic-analyzer 2 #i2c 2 #avr-firmware-reversing 2 #sdr 2 #quantum-circuit-reversal 1 #spi 1 #logic-gate-circuit 1 #firmware 1 #uart-logic-analyzer 1 #xor-logic-circuit 1 #eeprom 1 #oscilloscope 1 #i2c-decoding 1 #spi-logic-analyzer 1 #hardware-reversing 1 #verilog 1 #logic-circuit 1 #verilog-softcore-reversing 1

other 5

→ all 5 other challenges

#bacnet 1 #scapy 1 #pic18f-microcontroller-reversing 1 #bootloader 1 #correlation-power-analysis 1 #tcp-stream 1 #arduino-seven-segment 1

▦ mobile 4 all 4 challenges →

other 4

→ all 4 other challenges

#hardcoded-key 2 #cordova 1 #hardcoded-pin 1 #concurrent-requests 1

▦ osint 21 all 21 challenges →

general 21

→ all 21 general challenges

#osint 13 #geolocation 10 #reverse-image-search 6 #image-geolocation 3 #social-media-osint 2 #image-geolocation-osint 1 #signage-osint 1

other 2

→ all 2 other challenges

#google-maps-street-view 1 #google-maps 1

▦ cve 14 all 14 challenges →

2024 2

→ all 2 2024 challenges

#cve-2024-38807 1 #cve-2024-34351 1

2023 1

→ all 1 2023 challenges

#cve-2023-21688 1

2022 3

→ all 3 2022 challenges

#cve-2022-23632 1 #cve-2022-21449 1 #cve-2022-21824 1

2021 4

→ all 4 2021 challenges

#cve-2021-41773 1 #cve-2021-31439 1 #cve-2021-40346 1 #cve-2021-22204 1

2020 1

→ all 1 2020 challenges

#cve-2020-8597 1

2019 1

→ all 1 2019 challenges

#cve-2019-12083 1

2017 1

→ all 1 2017 challenges

#cve-2017-13288 1

2014 1

→ all 1 2014 challenges

#cve-2014-4699 1

Techniques

Browse by domain expand a family to see its tags; the roll-up link filters challenges

All techniques