Lesson pack 15 · Foundation · 60 minutes
Misc and esoteric languages
The category you cannot prepare for by learning a technique - so prepare the triage instead, and learn to identify a dozen shapes on sight.
Print this page for a paper plan - the navigation and links drop out.Student-facing version
Before the session
- Nothing to install. Students need a browser and https://ctfpal.com. Confirm the room can reach it once; after that it works offline.
- Read the lesson yourself first - about 4 minutes.
- Have one worked example ready to paste. The classroom link builder on the instructor page turns it into a URL that opens preloaded.
Objectives
Written as things a student can do afterwards, so they can be assessed rather than asserted.
- Identify Brainfuck, Whitespace, Ook!, JSFuck and Piet from their character sets alone
- Use a distinct-character count as a first-pass identifier for any unknown text
- Recognise the recurring misc shapes: encoding chains, damaged codes, audio, text steganography
- Read a file in hex before concluding it is empty or plain
- Recognise when a challenge is a joke and automate rather than repeat
Running order (60 min)
| Time | What happens |
|---|---|
| 0:00-0:06 | Frame the problemWhat the category looks like when you meet it cold, and why the naive approach fails. |
| 0:06-0:18 | Teach the methodThe technique itself, on the board or from the lesson. No tools open yet. |
| 0:18-0:33 | Demonstrate liveSame technique, in the workspace, on your worked example. Narrate every choice. |
| 0:33-0:54 | Practice setStudents work the challenges. Circulate rather than present. |
| 0:54-1:00 | Checkpoint and wrapCollect the artefact, name what comes next. |
Tools used
- Brainfuck and esolang decoder - Run Brainfuck, Ook!, Befunge, Whitespace, Deadfish, and friends. Esolangs are a recognition problem more than an execution problem.https://ctfpal.com/?tool=brainfuck-interpreter
- Cipher identifier and automatic decoder - Paste anything and find out what it is. ctfpal runs every decoder and rotation, including multi-pass cascades, and ranks results by English-likeness and flag patterns.https://ctfpal.com/?tool=cipher-identifier
- Zero-width character and text steganography decoder - Reveal messages hidden in zero-width Unicode characters, trailing whitespace, and homoglyph substitution - text steganography that survives copy-paste.https://ctfpal.com/?tool=zero-width-decoder
- QR code decoder - Decode QR codes from any image, including inverted, low-contrast, and partially damaged codes. Nothing is uploaded.https://ctfpal.com/?tool=qr-decoder
- Audio spectrogram and SSTV decoder - View a WAV as a spectrogram to find text drawn in frequency space, decode Morse and SSTV, and extract LSB data from audio samples.https://ctfpal.com/?tool=audio-spectrogram
Reading
- Esolangs and the misc pile - 4 min. Brainfuck, Whitespace, Piet and the rest are recognisable on sight once you know what to look at. Plus the rest of the misc category: what it actually contains, and the triage that resolves most of it in under a minute.
Practice set
Real picoCTF challenges tagged with this module’s techniques, easiest first. Assign the first three in class and the rest as homework.
- dont-use-client-side - picoCTF 2019, easy
- Unminify - picoCTF 2024, easy
- Client-side-again - picoCTF 2019, medium
- login - picoMini by redpwn, medium
- Pachinko - picoCTF 2025, medium
- Some Assembly Required 1 - picoCTF 2021, medium
- Some Assembly Required 2 - picoCTF 2021, medium
- The Add/On Trap - picoCTF 2026, medium
- Pachinko Revisited - picoCTF 2025, hard
- Some Assembly Required 4 - picoCTF 2021, hard
Checkpoint (gradeable)
Given five unlabelled artifacts, identify what each one is and name the tool that opens it, without solving any of them.
Deliberately a produced artefact rather than a quiz question: it is either there or it is not, which makes it fast to mark and hard to bluff. Every tool in ctfpal is deterministic, so two students who did the work correctly hand in the same value.
Where the room gets stuck
Resist the urge to teach how Brainfuck works. The transferable skill is identification, and an hour spent on tape semantics is an hour not spent seeing ten different shapes.
If you finish early
- Hand out a challenge from the cross-CTF index in this category - each one has published solutions to compare afterwards.
- Run the same input through Identify and let the class argue with the ranking. Disagreeing with a confidence score is where the technique actually lands.
- Ask a student to break their own example - construct an input that defeats the tool, and explain why.
Take this into a room
Markdown files, built here in your browser. They print, they open in anything, and they carry the challenge text - so the session works with no network in the room.