Blog
Technique-first notes on capture-the-flag. Every post teaches a method you can apply the same night - how to recognise it, why it works, and where the shortcut lives inside ctfpal. No war stories, no tool dumps, no “install these forty repos”.
Looking for solved challenges instead? The writeup index maps each technique to a canonical walkthrough.
The first ten minutes: a triage playbook for any CTF challenge
Most challenges are lost to flailing, not to difficulty. Here is a repeatable order of operations for an unknown blob, an unknown file, and an unknown service - and the point at which you should stop guessing and start reading.
Read it- miscAugust 4, 20265 min
Spot the encoding: reading base64, base32, hex and friends at a glance
Alphabet, length, and padding are enough to name almost any encoding on sight. A field guide to the encodings CTFs actually use, the magic prefixes that tell you what is underneath, and the traps that make a correct guess look wrong.
encodingbase64base32hex - cryptoJuly 28, 20266 min
Chi-squared, index of coincidence, and why classical ciphers fall
Caesar, Vigenere, and substitution ciphers do not need guesswork - they need two statistics. How chi-squared scores a candidate plaintext, how the index of coincidence recovers a key length, and how to combine them into an attack that runs in milliseconds.
classicalcaesarvigenerefrequency-analysis - cryptoJuly 21, 20266 min
XOR, crib dragging, and the two-time pad
Single-byte XOR, repeating-key XOR, and keystream reuse are three faces of the same weakness. How to recover a key length from Hamming distance, drag a crib across a XOR of two plaintexts, and know when a stream cipher has handed you the answer.
xorcrib-dragone-time-padkeystream-reuse - cryptoJuly 14, 20267 min
The RSA attack decision tree
RSA challenges are not solved by knowing every attack - they are solved by reading the parameters and picking the one attack that matches. A decision tree from e and n to Fermat, Wiener, Hastad, common modulus, and the oracle attacks.
rsafactoringwienerhastad - cryptoJune 30, 20266 min
Hash cracking that actually works: identify, wordlist, rules, mask
Cracking is a search problem, and most failed attempts are searches aimed at the wrong space. How to identify a hash from its shape, choose between wordlist, rules, and mask attacks, and recognise the hashes you should not be brute-forcing at all.
hashescrackinghashcatwordlists - webJune 23, 20266 min
Attacking JWTs: alg=none, algorithm confusion, and the header fields nobody audits
A JSON Web Token is a signed claim you were handed and asked to give back. Every classic JWT bug is a place where the verifier lets the token choose how it is verified - alg=none, RS256 to HS256 confusion, kid injection, and attacker-hosted key URLs.
jwtauthenticationalgorithm-confusionalg-none - stegoJune 16, 20267 min
A workflow for image steganography, from magic bytes to bit planes
Stego challenges reward order, not inspiration. The sequence that finds the payload: container checks before pixel checks, structure before statistics, and the specific tells that separate a PNG trick from a JPEG one.
steganographypngjpeglsb - pwnJune 9, 20267 min
From crash to shell: stack overflows, offsets, ret2win, and ret2libc
A segfault is not an exploit. The path from an unexpected crash to a controlled instruction pointer to a shell, with the mitigation checks that decide which technique you need and the stack-alignment detail that breaks working exploits.
pwnbuffer-overflowropret2libc - forensicsJune 2, 20266 min
PCAP triage: finding the flag in a hundred thousand packets
Network forensics challenges hand you a capture and no question. The triage order that finds the answer fast - protocol hierarchy, conversations, streams - plus the exfiltration channels people actually hide flags in: DNS, ICMP, USB, and TLS you can decrypt.
pcapwiresharktsharknetwork-forensics