bi0sCTF 2025
62 challenges with 134 published community solutions between them. Solution links go to CTFtime’s task page, which aggregates every writeup for a challenge - individual blog posts rot, the aggregator does not.
Full task list on CTFtimeMisc40
Everything that fits no other box: esolangs, puzzles, scripting exercises, and the jail escapes that have not yet earned their own category.
Setup
6 official solutionsAlso written up in: snwox/ctf-writeup, snwox/ctf-writeup, snwox/ctf-writeup, snwox/ctf-writeup, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
Also written up in: snwox/ctf-writeup, snwox/ctf-writeup, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
Deploy.s
4 official solutionsAlso written up in: snwox/ctf-writeup, snwox/ctf-writeup, snwox/ctf-writeup, tranminhprvt01/CTF-writeups
Also written up in: snwox/ctf-writeup, snwox/ctf-writeup, snwox/ctf-writeup, tranminhprvt01/CTF-writeups
Address
3 official solutionsAlso written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
Arrays
3 official solutionsAlso written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
CompTimelock
3 official solutionsAlso written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
draft ERC20TemporaryApproval
3 official solutionsAlso written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
draft ERC7579Utils
3 official solutionsAlso written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
ERC1155Supply
3 official solutionsAlso written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
ERC20
3 official solutionsAlso written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
ERC2771Forwarder
3 official solutionsAlso written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
ERC721
3 official solutionsAlso written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
Governance
3 official solutionsAlso written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
Governor
3 official solutionsAlso written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
GovernorCountingFractional
3 official solutionsAlso written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
GovernorTimelockAccess
3 official solutionsAlso written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
GovernorTimelockControl
3 official solutionsAlso written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
MerkleTree
3 official solutionsAlso written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
Packing
3 official solutionsAlso written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
ProxyAdmin
3 official solutionsAlso written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
SafeCast
3 official solutionsAlso written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
Strings
3 official solutionsAlso written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
TimelockController
3 official solutionsAlso written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
Also written up in: pwn-la-chapelle.eu
- ml
- misc
- adversarial
- audio
Same technique in picoCTF: PW Crack 2, Permissions, Specialer
Finance
2 official solutionsAlso written up in: snwox/ctf-writeup, tranminhprvt01/CTF-writeups
VasthavikamainaToken
2 official solutionsAlso written up in: snwox/ctf-writeup, tranminhprvt01/CTF-writeups
WhiteListed
2 official solutionsAlso written up in: snwox/ctf-writeup, tranminhprvt01/CTF-writeups
Console
1 official solutionAlso written up in: tranminhprvt01/CTF-writeups
CONTRIBUTING
1 official solutionAlso written up in: tranminhprvt01/CTF-writeups
Forge Std
1 official solutionAlso written up in: tranminhprvt01/CTF-writeups
IERC7540
1 official solutionAlso written up in: tranminhprvt01/CTF-writeups
Same technique in picoCTF: PW Crack 2, Permissions, Specialer
SafeMath
1 official solutionAlso written up in: tranminhprvt01/CTF-writeups
StdCheats
1 official solutionAlso written up in: tranminhprvt01/CTF-writeups
StdCheats.t
1 official solutionAlso written up in: tranminhprvt01/CTF-writeups
StdStorage
1 official solutionAlso written up in: tranminhprvt01/CTF-writeups
StdUtils
1 official solutionAlso written up in: tranminhprvt01/CTF-writeups
StdUtils.t
1 official solutionAlso written up in: tranminhprvt01/CTF-writeups
UniswapV2Pair
1 official solutionAlso written up in: tranminhprvt01/CTF-writeups
Uncategorised12
The upstream scoreboard did not say, so neither do we.
Solve.s
3 official solutionsAlso written up in: snwox/ctf-writeup, snwox/ctf-writeup, snwox/ctf-writeup
Kernel Mailinglists
2 official solutionsAlso written up in: mito753/Kernel-Exploit-Dojo, mito753/Kernel-Exploit-Dojo
Breaking Bad
1 official solutionAlso written up in: tvdat20004/CTF_write-up
Encrypt
1 official solutionAlso written up in: s41nt0l3xus/CTF-writeups
Exploit fail.s
1 official solutionAlso written up in: Ectario/articles-and-wu
Exploit.s
1 official solutionAlso written up in: Ectario/articles-and-wu
Also written up in: mito753/CTF
Also written up in: Ectario/articles-and-wu
Script.s
1 official solutionAlso written up in: snwox/ctf-writeup
Solve1
1 official solutionAlso written up in: tvdat20004/CTF_write-up
Unintialized VM
1 official solutionAlso written up in: mito753/CTF
Also written up in: tvdat20004/CTF_write-up
Cryptography9
Recover a plaintext or a key from something that was supposed to protect it. In practice: identify the scheme, find the parameter the author got wrong, exploit it.
Chall
3 official solutionsAlso written up in: tvdat20004/CTF_write-up, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
Also written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
Also written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
Braiding Bad
2 official solutionsAlso written up in: tranminhprvt01/CTF-writeups, tranminhprvt01/CTF-writeups
Message
2 official solutionsAlso written up in: tvdat20004/CTF_write-up, tranminhprvt01/CTF-writeups
apna AES
1 official solutionAlso written up in: tranminhprvt01/CTF-writeups
Also written up in: tranminhprvt01/CTF-writeups
Tmp.Sage
1 official solutionAlso written up in: tranminhprvt01/CTF-writeups
Veiled XOR
1 official solutionAlso written up in: tranminhprvt01/CTF-writeups
Binary exploitation1
Turn a memory-safety bug in a native binary into control of execution. Usually a stack overflow, a format string, or a heap primitive.
Also written up in: s41nt0l3xus/CTF-writeups, s41nt0l3xus/CTF-writeups
- secp256k1
- pwn
- crypto
- heap
- android
Same technique in picoCTF: vr-school, sice_cream, zero_to_hero