Official THJCC 2026 Summer writeup for NoNo, a log-analysis forensics challenge where 500 lines of loud fake-CVE noise hide one real lead: a single request to an internal vhost for a look-alike secret path.

THJCC 2026 Summer NoNo 官方解題。一條 log 分析鑑識題，500 行 log 全是假的 CVE 攻擊雜訊，真正的線索只有一筆打到內部 vhost 的請求。

HITCON CTF 2025 misc writeup for Git Playground: a chroot jail that hands you a real git repo plus arbitrary file writes, so overwriting core.pager in .git/config turns git log into flag disclosure through the shell.

CCCTF 2026 writeup covering the challenges I solved across Web, Crypto, Misc, and Reverse: a flag hidden before a Rick Roll redirect, a weak Flask secret key, a nested field-selector IDOR, XOR key reuse, JPEG-comment stego, a ZIP appended to a PNG, and a Windows keygen.

A picoCTF writeup covering 11 challenges across Web, Cryptography, Forensics, and Reverse Engineering: IDOR via MD5, SQLi to hash cracking, a Flask session OTP leak, LFSR-AES, Diffie-Hellman key reuse, an RSA key hidden in JPEG metadata, bitstream and git-history forensics, XOR unpacking, and a Heartbleed-style heap over-read.

Full attack-and-defense writeups for AWDT 2026: prototype pollution, XXE, SSRF-to-Redis, Phar deserialization, JWT forgery, Nginx off-by-slash traversal, sandbox escape RCE, ML data poisoning, an async TOCTOU race, stored XSS, and a seccomp ORW pwn, each with the minimal patch.

Writeup for Secso CTF 2026 challenges, covering RSA common factor attack, SQL injection to arbitrary file read, vmsplice TOCTOU commit-reveal break, /proc cmdline secret leak, and DOM clobbering cookie exfiltration.

Full writeup for No Hack No CTF 2026 Kira-Notes computer forensics challenge. Browser forensics, disk image recovery, password reconstruction, and archive extraction.

關於 PUCTF 2026 嘅參賽感受同埋對主辦方處理手法嘅遺憾。

Writeup for SekaiCTF 2025 web exploitation challenges, covering LFI vulnerability exploitation and Docker container filesystem analysis in the My Flask App challenge.

My HKCERT CTF 2025 writeups: renderme web RCE and privesc, plus crypto (cruel_rsa, EC Fun, Loss N, Bivariate copper, Triple Key Cipher), a pickle jail, reverse (easyjar SM4, findkey), and a PHP POP-chain web bug.

THJCC CTF 2026 official writeup, Complete solutions for these challenges! By UmmIt Kin.

FTP anonymous login, writable scripts, and env privilege escalation.

Password reset account takeover vulnerability in GitLab.

Bypassing auto-logout and brute-forcing a hardcoded OTP.

Full writeup for No Hack No CTF 2025 Crackme and gitgit challenges. Learn how to solve these challenges step by step.

Writeup for Bronco CTF 2025, covering reverse engineering, web, and miscellaneous challenges including Break the Battalion, Inspector Requestor, Mary's Lamb is a Little Phreak, and Rahhh-Sh.