D^3CTF 2026
10 challenges with 12 published community solutions between them. Solution links go to CTFtime’s task page, which aggregates every writeup for a challenge - individual blog posts rot, the aggregator does not.
Full task list on CTFtimeWeb3
Reach data or functionality the application meant to keep from you - through its inputs, its tokens, or its trust in the client.
Also written up in: jeff-160/CTF-writeups
- d3ctf
- web
- ctf
Same technique in picoCTF: Live Art, secure-email-service, No FA
- d3ctf
- web
- ctf
Same technique in picoCTF: Live Art, secure-email-service, No FA
Scope Drift + Ghost Zero
1 official solutionAlso written up in: cybersecurityelite.com
Binary exploitation3
Turn a memory-safety bug in a native binary into control of execution. Usually a stack overflow, a format string, or a heap primitive.
- d3ctf
- binaryexploitation
- ctf
- pwn
Same technique in picoCTF: lockdown-horses, Guessing Game 1, Bizz Fuzz
d3kbus & d3kbus revenge Kernel Page Cache Write via CRC32C Forgery
1 official solutionAlso written up in: cybersecurityelite.com
- d3ctf
- binaryexploitation
- ctf
- pwn
Same technique in picoCTF: lockdown-horses, Guessing Game 1, Bizz Fuzz
Cryptography2
Recover a plaintext or a key from something that was supposed to protect it. In practice: identify the scheme, find the parameter the author got wrong, exploit it.
- cryptography
- d3ctf
- ctf
- crypto
Same technique in picoCTF: It's Not My Fault 2, StegoRSA, AES-ABC
D3HFERP Direct MQ Breaks a Multivariate Scheme
1 official solutionAlso written up in: cybersecurityelite.com
Reverse engineering2
Work out what a compiled program does without its source, then work backwards from the check to the input that passes it.
- d3ctf
- ctf
- reverseengineering
- reverse
Same technique in picoCTF: Checkpass, WinAntiDbg0x100, WinAntiDbg0x200
- d3ctf
- ctf
- reverseengineering
- reverse
Same technique in picoCTF: Checkpass, WinAntiDbg0x100, WinAntiDbg0x200