PatriotCTF 2026

What to have open when it starts

• Crypto

  Have the cipher identifier open on the first paste. Most of the round-one crypto is a classical cipher or an RSA parameter mistake, and both are recognised faster than they are solved.

  • Cipher identifier and automatic decoder
  • RSA decryption and attack runner
  • XOR cipher decoder and key recovery
  • Vigenere cipher solver with automatic key recovery
  • Modular arithmetic and number theory toolkit

  New to this? Read Classical ciphers and frequency analysis, XOR and the cost of reusing a key, RSA and the parameters that break it

• Misc

  Misc is whatever did not fit, which in practice means encodings and esolangs. Identify, do not guess.

  • Cipher identifier and automatic decoder
  • Recipe builder: chain decodes and transforms
  • Brainfuck and esolang decoder
  • Base64 decoder and encoder
  • Regex tester with match offsets and capture groups

  New to this? Read Recognising encodings, Misc and esoteric languages

• Web

  Read the token before you read the source. A session cookie that decodes is the shortest path through half the web board.

  • JWT decoder and signature verifier
  • Flask session cookie decoder
  • HTTP request replayer
  • Directory and path scanner
  • HTTP security header analyzer

  New to this? Read Web attacks and session tokens

• Forensics

  Start with the file's own claim about itself, then with what is appended after it ends. Both are one paste away.

  • File type identifier by magic bytes
  • Hex viewer and hexdump
  • ZIP archive inspector
  • PCAP analyzer for CTF network forensics
  • Memory dump, disk image and registry hive analysis

  New to this? Read File forensics and carving, Network forensics, Memory and disk forensics