HITCON CTF 2026

What to have open when it starts

• Pwn

  Get the offset and the libc base mechanically, so the thinking is spent on the chain rather than on arithmetic.

  • Cyclic pattern generator and offset finder
  • Buffer overflow offset finder
  • Libc base address calculator
  • ROP gadget finder
  • Pwntools exploit script generator

  New to this? Read Binary exploitation, Fuzzing and crash triage, After the shell: privilege escalation

• Crypto

  Have the cipher identifier open on the first paste. Most of the round-one crypto is a classical cipher or an RSA parameter mistake, and both are recognised faster than they are solved.

  • Cipher identifier and automatic decoder
  • RSA decryption and attack runner
  • XOR cipher decoder and key recovery
  • Vigenere cipher solver with automatic key recovery
  • Modular arithmetic and number theory toolkit

  New to this? Read Classical ciphers and frequency analysis, XOR and the cost of reusing a key, Block ciphers, modes and oracles, RSA and the parameters that break it, Discrete logs, Diffie-Hellman and elliptic curves

• Reversing

  Identify the binary before you open it. Knowing it is a .pyc, a JAR or a stripped ELF decides the next hour.

  • ELF, PE and Mach-O binary analyzer
  • Strings extractor for binaries and blobs
  • Python .pyc bytecode disassembler
  • Java .class disassembler
  • WebAssembly disassembler

  New to this? Read Reverse engineering, Mobile applications, Firmware, hardware and signals, Smart contracts and the EVM

• Misc

  Misc is whatever did not fit, which in practice means encodings and esolangs. Identify, do not guess.

  • Cipher identifier and automatic decoder
  • Recipe builder: chain decodes and transforms
  • Brainfuck and esolang decoder
  • Base64 decoder and encoder
  • Regex tester with match offsets and capture groups

  New to this? Read Recognising encodings, Misc, esolangs and prompt injection