2013weight 40.00CSAW CTF Organizers

CSAW CTF Qualification Round 2013

31 challenges with 146 published community solutions between them. Solution links go to CTFtime’s task page, which aggregates every writeup for a challenge - individual blog posts rot, the aggregator does not.

Full task list on CTFtime

OSINT8

Answer a question about the real world from public sources. The work is pivoting between identifiers, not exploiting anything.

Solve it with:EXIF metadata viewer QR code decoder

Recon 100-1
100 pts4 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook
Recon 100-3
100 pts4 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook
Recon 100-5
100 pts4 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook
Recon 100-6
100 pts4 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook
Recon 100-2
100 pts3 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook
Recon 100-4
100 pts3 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook
Recon 100-7
100 pts3 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook
Recon 100-8
100 pts3 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook

Reverse engineering6

Work out what a compiled program does without its source, then work backwards from the check to the input that passes it.

Solve it with:Strings extractor for binaries and blobs WebAssembly disassembler Java .class disassembler Python .pyc bytecode disassembler Learn: Binary exploitation

Reversing 500
500 pts8 writeups
Same technique in picoCTF: WinAntiDbg0x100, WinAntiDbg0x200, WinAntiDbg0x300
Reversing 100
100 pts7 writeups
Same technique in picoCTF: WinAntiDbg0x100, WinAntiDbg0x200, WinAntiDbg0x300
Reversing 200
200 pts5 writeups
Same technique in picoCTF: WinAntiDbg0x100, WinAntiDbg0x200, WinAntiDbg0x300
Reversing 400
400 pts5 writeups
Same technique in picoCTF: WinAntiDbg0x100, WinAntiDbg0x200, WinAntiDbg0x300
Reversing 300
300 pts4 writeups
Same technique in picoCTF: WinAntiDbg0x100, WinAntiDbg0x200, WinAntiDbg0x300
Reversing 150
150 pts2 writeups
Same technique in picoCTF: WinAntiDbg0x100, WinAntiDbg0x200, WinAntiDbg0x300

Binary exploitation5

Turn a memory-safety bug in a native binary into control of execution. Usually a stack overflow, a format string, or a heap primitive.

Solve it with:ROP gadget finder Shellcode assembler and library Cyclic pattern generator and offset finder Format string exploit builder Learn: Binary exploitation

Exploitation 400
400 pts7 writeups
Same technique in picoCTF: Guessing Game 1, x-sixty-what, format string 3
Exploitation 300
300 pts6 writeups
Same technique in picoCTF: Guessing Game 1, x-sixty-what, format string 3
Exploitation 200
200 pts4 writeups
Same technique in picoCTF: Guessing Game 1, x-sixty-what, format string 3
Exploitation 500
500 pts3 writeups
Same technique in picoCTF: Guessing Game 1, x-sixty-what, format string 3
Exploitation 100
100 pts2 writeups
Same technique in picoCTF: Guessing Game 1, x-sixty-what, format string 3

Misc5

Everything that fits no other box: esolangs, puzzles, scripting exercises, and the jail escapes that have not yet earned their own category.

Solve it with:Brainfuck and esolang decoder Cipher identifier and automatic decoder Regex tester with match offsets and capture groups Learn: Recognising encodings

Trivia 50
50 pts10 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook
Misc 50
50 pts9 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook
Misc 100
100 pts5 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook
Misc 200
200 pts5 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook
Misc 300
300 pts5 writeups
Same technique in picoCTF: Permissions, Specialer, Codebook

Web4

Reach data or functionality the application meant to keep from you - through its inputs, its tokens, or its trust in the client.

Solve it with:JWT decoder and signature verifier JWT alg=none bypass generator Web attack payload catalog JWT secret brute force Learn: Web attacks and session tokens

Web 400
400 pts10 writeups
Same technique in picoCTF: Client-side-again, dont-use-client-side, Irish-Name-Repo 3
Web 300
300 pts4 writeups
Same technique in picoCTF: Client-side-again, dont-use-client-side, Irish-Name-Repo 3
Web 200
200 pts3 writeups
Same technique in picoCTF: Client-side-again, dont-use-client-side, Irish-Name-Repo 3
Web 100
100 pts2 writeups
Same technique in picoCTF: Client-side-again, dont-use-client-side, Irish-Name-Repo 3

Cryptography3

Recover a plaintext or a key from something that was supposed to protect it. In practice: identify the scheme, find the parameter the author got wrong, exploit it.

Solve it with:Cipher identifier and automatic decoder Vigenere cipher solver with automatic key recovery RSA decryption and attack runner Wiener’s attack on small RSA private exponents In-browser hash cracker with rule transforms Learn: Classical ciphers and frequency analysis Learn: RSA and the parameters that break it

Crypto 100
100 pts5 writeups
Same technique in picoCTF: StegoRSA, Timestamped Secrets, AES-ABC
Crypto 300
300 pts4 writeups
Same technique in picoCTF: StegoRSA, Timestamped Secrets, AES-ABC
Crypto 500
500 pts3 writeups
Same technique in picoCTF: StegoRSA, Timestamped Secrets, AES-ABC

OSINT8

Recon 100-1

Recon 100-3

Recon 100-5

Recon 100-6

Recon 100-2

Recon 100-4

Recon 100-7

Recon 100-8

Reverse engineering6

Reversing 500

Reversing 100

Reversing 200

Reversing 400

Reversing 300

Reversing 150

Binary exploitation5

Exploitation 400

Exploitation 300

Exploitation 200

Exploitation 500

Exploitation 100

Misc5

Trivia 50

Misc 50

Misc 100

Misc 200

Misc 300

Web4

Web 400

Web 300

Web 200

Web 100

Cryptography3

Crypto 100

Crypto 300

Crypto 500

Other 2013 events