https://th3b0ywh0l1v3d.github.io/categories/ctf/ Recent content in CTF on Th3B0yWh0L1v3d — Security Writeups Hugo en-us Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/crypto/a-basic-start/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/crypto/a-basic-start/ Decoding a multi-layer encoding chain: Base64 followed by Base91. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/reversing/alphacode/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/reversing/alphacode/ Reverse-engineering a custom esolang stack machine to recover the flag. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/reversing/amazing/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/reversing/amazing/ Reversing a Python marshal bytecode maze generator seeded by an LCG to find the escape path. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/crypto/babels-vault/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/crypto/babels-vault/ Finding the flag inside the Library of Babel using a seed and image residual pixel indices. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/beyond-the-homepage/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/beyond-the-homepage/ Flag hidden in an HTML comment, visible only via browser developer tools or view-source. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/misc/boro-hero/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/misc/boro-hero/ OSINT challenge: identify a Freehold High School alum from a blurred music photo — Bruce Springsteen. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/boro-senpai-1/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/boro-senpai-1/ IDOR / broken access control lets you access another user’s flag by changing an ID parameter. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/boro-senpai-2/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/boro-senpai-2/ Part 2 of the Boro Senpai series: SSRF via Docker internal hostname. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/boro-senpai-3/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/boro-senpai-3/ Flag or unlock parameter hardcoded in client-side JavaScript. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/borogpt/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/borogpt/ Source-map leak reveals JWT secret, forge admin token, then exploit Jinja2 SSTI for RCE. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/reversing/cat/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/reversing/cat/ Reversing a repeating-key XOR crackme that downloads the flag from catbox.moe. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/pwning/chicken-dinner/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/pwning/chicken-dinner/ Brute-force stack canary byte-by-byte via fork’s PID oracle, leak libc with puts, then ORW ROP chain. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/pwning/coming-together/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/pwning/coming-together/ Two’s complement INT_MIN negation overflow bypasses an absolute-value check to trigger the win condition. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/cracking-the-vault/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/cracking-the-vault/ Password and flag hardcoded in client-side JavaScript — just read the source. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/crypto/disco-franklin/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/crypto/disco-franklin/ Decoding ASCII characters from RGB color blocks in a PNG image. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/dotdotslashflagtxt/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/dotdotslashflagtxt/ Classic path traversal — the challenge name tells you exactly what to do. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/drone-dash/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/drone-dash/ Node.js prototype pollution via POST /api/flight-profile grants admin access. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/crypto/et-tu-brute/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/crypto/et-tu-brute/ Classic Caesar cipher shifted by +3 conceals the flag. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/reversing/franklin/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/reversing/franklin/ Recovering the flag from TrueType GSUB ligature substitution rules. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/reversing/george-orwell/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/reversing/george-orwell/ Decompiling a compiled AutoHotkey executable to extract the flag. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/reversing/hidden-but-definitely-not/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/reversing/hidden-but-definitely-not/ Recovering a flag hidden via stack-string construction and XOR obfuscation. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/kobenis-dashboard/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/kobenis-dashboard/ Abusing ImageMagick’s SVG text: pseudo-coder to read the flag file via server-side image conversion. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/pwning/mania/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/pwning/mania/ Use-after-free on a tcache chunk to overwrite a function pointer and call win(). https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/misc/natures-takeover/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/misc/natures-takeover/ Identify the abandoned ship overgrown with vegetation from an OSINT image — SS Ayrfield. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/neural-sync-portal/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/neural-sync-portal/ SSRF via Docker internal hostname to reach the metadata service and retrieve the flag. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/pwning/new-to-the-format/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/pwning/new-to-the-format/ Blind format-string exploit with ASLR off: leak stack address then use %n + call rax to redirect execution. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/misc/next-challenge/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/misc/next-challenge/ Reverse-psychology logic puzzle: telling the bot the flag IS the answer gets you the flag. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/crypto/not-the-flag/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/crypto/not-the-flag/ Apply bitwise NOT to a hex string to reveal the flag. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/reversing/not-your-time/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/reversing/not-your-time/ Crackme that stores the bitwise NOT of the flag bytes; invert them to get the flag. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/reversing/perfectly-destructive-file/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/reversing/perfectly-destructive-file/ Extracting a flag hidden inside a PDF stream using FlateDecode and base64. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/solarity/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/solarity/ Path traversal via /view?file=../flag.txt reads the server-side flag file.