# Writeups by Solution

This document organizes CTF writeups by solution type and technique rather than by CTF event. Use this as a reference when looking for specific exploitation techniques or vulnerability types.

## AI

- Jailbreak:

  - [System prompt leak](<https://jia.je/ctf-writeups/2025-09-05-imaginary-ctf-2025/tax-return.html>)
- KV cache:

  - [Recover prompt from kv cache](<https://jia.je/ctf-writeups/2025-12-20-tsg-ctf-2025/chatbot.html>)

## Crypto

- RSA:

  - [Small n](<https://jia.je/ctf-writeups/2018-09-28-thuctf2018/crypto/easy_rsa.html>)
  - [Small e](<https://jia.je/ctf-writeups/2025-08-16-scriptctf2025/rsa-1.html>)
  - [Factorable n](<https://jia.je/ctf-writeups/2025-08-22-brunnerctf2025/half-baked.html>)
  - [Small d](<https://jia.je/ctf-writeups/2025-09-19-k17-ctf-2025/worsehelp.html>)
  - [Same m and n, different e](<https://jia.je/ctf-writeups/2025-09-26-iran-tech-olympics-ctf-2025/techras.html>)
  - [N and c has common factors](<https://jia.je/ctf-writeups/2025-10-18-qiangwangbei-quals-2025/check-little.html>)
  - [Known n, p-q](<https://jia.je/ctf-writeups/2025-10-24-hack-the-boo-ctf-2025/leaking-for-answers.html>)
  - [Known n, e, phi^{-1}\*d mod n](<https://jia.je/ctf-writeups/2025-10-24-hack-the-boo-ctf-2025/leaking-for-answers.html>)
  - [Known n, e, d](<https://jia.je/ctf-writeups/2025-10-24-hack-the-boo-ctf-2025/leaking-for-answers.html>)
  - [Known n, pow(p, -q, q), pow(q, -p, p)](<https://jia.je/ctf-writeups/2025-10-24-hack-the-boo-ctf-2025/leaking-for-answers.html>)
  - [Solving p, q for diffent known values](<https://jia.je/ctf-writeups/misc/rsa.html>)
  - [Recover message with non co-prime factors](<https://jia.je/ctf-writeups/2025-12-19-hkcert-ctf-2025-quals/cruel-rsa.html>)
- Discrete logarithm:

  - [Baby-step giant-step](<https://jia.je/ctf-writeups/2025-09-08-wanqubei-quals-2025/new-trick.html>)
  - [Pohlig-Hellman](<https://jia.je/ctf-writeups/2025-09-04-nullcon-berlin-hackim-2025-ctf/field-trip.html>)
  - [Pohlig-Hellman without large factors](<https://jia.je/ctf-writeups/2025-12-19-hkcert-ctf-2025-quals/ec-fun.html>)
  - [Elliptic Curve Discrete Logarithm Problem](<https://jia.je/ctf-writeups/2025-12-19-hkcert-ctf-2025-quals/ec-fun.html>)
  - [Smart's Attack](<https://jia.je/ctf-writeups/2025-12-19-hkcert-ctf-2025-quals/lwecc.html>)
- AES:

  - [Chosen plaintext attack](<https://jia.je/ctf-writeups/2025-08-16-scriptctf2025/eaas.html>)
  - [Padding oracle attack](<https://jia.je/ctf-writeups/2025-09-04-nullcon-berlin-hackim-2025-ctf/decryption-execution-service.html>)
  - [XOR attack against AES-CTR &amp; CRC](<https://jia.je/ctf-writeups/2025-09-04-nullcon-berlin-hackim-2025-ctf/magntic-tape.html>)
  - [GCM nonce reuse attack](<https://jia.je/ctf-writeups/2025-12-02-blackhat-mea-ctf-final-2025/tampering-detection-system.html>)
- DES:

  - [Weak keys](<https://jia.je/ctf-writeups/2018-09-28-thuctf2018/crypto/101DES.html>)
  - [Slide attack](<https://jia.je/ctf-writeups/2025-09-04-nullcon-berlin-hackim-2025-ctf/narrow-des.html>)
- Double block cipher:

  - [Meet in the middle](<https://jia.je/ctf-writeups/2025-08-16-scriptctf2025/secure-server-2.html>)
- Caesar cipher:

  - [QuipQiup](<https://jia.je/ctf-writeups/2018-09-28-thuctf2018/misc/Flow.html>)
- Polynomial:

  - [Find small coefficients using LLL](<https://jia.je/ctf-writeups/2022-11-25-hitconctf2022/babysss.html>)
  - [N-th root to reduce the number of unknown coefficients](<https://jia.je/ctf-writeups/2025-08-16-sekaictf2025/ssss.html>)
  - [Find odd-degree coefficients](<https://jia.je/ctf-writeups/2025-08-30-corctf2025/ssss.html>)
- Linear congruential generator

  - [Parameter recover](<https://jia.je/ctf-writeups/2025-09-06-cracconctf2025/ecg.html>)
  - [Recover truncated LCG with LSB bits known](<https://jia.je/ctf-writeups/2025-10-25-qiangwang-nitai-quals-2025/FMS.html>)
  - [Recover different types of LCG](<https://jia.je/ctf-writeups/misc/lcg.html>)
- ECDSA:

  - [Reused nonce k](<https://jia.je/ctf-writeups/2025-09-10-watctf-f25/curve-desert.html>)
  - [Nonce leakage attack](<https://jia.je/ctf-writeups/2025-11-22-qiangwangbei-final-2025/forge.html>)
- Python random number generator

  - [Solve MT19937 using known bits](<https://jia.je/ctf-writeups/misc/pyrand.html>)
- C random number generator

  - [Enumerate seed to recover](<https://jia.je/ctf-writeups/2025-10-26-xctf-final-2025/tch3s.html>)
- Approximate Common Divisor

  - [Algorithms for Approximate Common Divisor Problem](<https://jia.je/ctf-writeups/misc/acd.html>)
- Modular Inverse Hidden Number Problem

  - [Algorithms for MIHNP](<https://jia.je/ctf-writeups/misc/mihnp.html>)
- Differential Cryptanalysis

  - [Recover key by using two keys that differ in only one bit](<https://jia.je/ctf-writeups/2025-12-02-blackhat-mea-ctf-final-2025/limeade.html>)
- Learning with Errors

  - [Errors are sampled from a small set](<https://jia.je/ctf-writeups/2025-12-19-hkcert-ctf-2025-quals/lwecc.html>)

## Forensics

- Wireshark:

  - [USB keyboard events](<https://jia.je/ctf-writeups/2018-09-28-thuctf2018/misc/Flow.html>)
  - [TLS key injection](<https://jia.je/ctf-writeups/2025-08-22-brunnerctf2025/the-secret-brunsviger.html>)
  - [USB SCSI data extraction](<https://jia.je/ctf-writeups/2025-09-04-nullcon-berlin-hackim-2025-ctf/usbstorage.html>)
  - [Hostname extraction from NetBIOS](<https://jia.je/ctf-writeups/2025-09-22-holmes-ctf-2025/the-watchmans-residue.html>)
- Microsoft Word:

  - [Visual Basic](<https://jia.je/ctf-writeups/2025-08-08-why2025/forensics/painted-black.html>)
- Editor history:

  - [.viminfo replay](<https://jia.je/ctf-writeups/2025-08-08-why2025/forensics/the-wizard.html>)
- Disk image:

  - [binwalk](<https://jia.je/ctf-writeups/2025-08-16-scriptctf2025/diskchal.html>)
- Password protected files:

  - [fcrackzip](<https://jia.je/ctf-writeups/2025-08-16-scriptctf2025/just-some-avocado.html>)
  - [hashcat](<https://jia.je/ctf-writeups/2025-08-22-brunnerctf2025/peppernuts.html>)
- Audio:

  - [Spectrogram visualizer](<https://jia.je/ctf-writeups/2025-08-16-scriptctf2025/just-some-avocado.html>)
- Shell:

  - [Find files by date and time](<https://jia.je/ctf-writeups/2025-08-30-corctf2025/nintendo-sswitch.html>)
- Windows:

  - [NTUSER.DAT registry extraction using MiTeC Windows Registry Recovery](<https://jia.je/ctf-writeups/2025-09-05-imaginary-ctf-2025/obfuscated-1.html>)
  - [C:\\Windows\\System32\\winevt\\Logs\*.evtx files extraction using evtx\_dump](<https://jia.je/ctf-writeups/2025-09-22-holmes-ctf-2025/the-enduring-echo.html>)
  - [C:\\Windows\\System32\\config\* registry dump using reged or hivexregedit](<https://jia.je/ctf-writeups/2025-09-22-holmes-ctf-2025/the-enduring-echo.html>)
  - [NTFS USN journal dump using USN-Journal-Parser](<https://jia.je/ctf-writeups/2025-09-22-holmes-ctf-2025/the-watchmans-residue.html>)
  - [Registry key modification time recovery via regipy](<https://jia.je/ctf-writeups/2025-09-22-holmes-ctf-2025/the-watchmans-residue.html>)
  - [Find recently accessed files via C:\\Users\\USERNAME\\Recent\*.lnk using lnkinfo or LECmd](<https://jia.je/ctf-writeups/2025-09-22-holmes-ctf-2025/the-watchmans-residue.html>)
  - [Find recently accessed files via C:\\Users\\USERNAME\\Recent\\AutomaticDestinations\* using strings or JLECmd](<https://jia.je/ctf-writeups/2025-12-02-blackhat-mea-ctf-final-2025/pointbreak.html>)
  - [Find recently accessed files via RecentDocs in registry](<https://jia.je/ctf-writeups/2025-12-02-blackhat-mea-ctf-final-2025/pointbreak.html>)
  - [Find powershell execution history via C:\\Users\\USERNAME\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost\_history.txt](<https://jia.je/ctf-writeups/2025-12-02-blackhat-mea-ctf-final-2025/ranwide.html>)
  - [Find scheduled tasks under C:\\ProgramData\\Microsoft\\Group Policy\\History\\GUID\\Machine\\Preferences\\ScheduledTasks\\ScheduledTasks.xml](<https://jia.je/ctf-writeups/2025-12-02-blackhat-mea-ctf-final-2025/ranwide.html>)
- Linux:

  - [Linux memory dump analysis using volatility3](<https://jia.je/ctf-writeups/2025-09-22-holmes-ctf-2025/the-tunnel-without-walls.html>)
  - [Check files against checksum computed by package managers](<https://jia.je/ctf-writeups/2025-12-02-blackhat-mea-ctf-final-2025/between-the-lines.html>)
  - [Find files with recent modification time](<https://jia.je/ctf-writeups/2025-12-02-blackhat-mea-ctf-final-2025/bridged.html>)
  - [Dump memory by triggering core dump](<https://jia.je/ctf-writeups/2025-12-02-blackhat-mea-ctf-final-2025/bridged.html>)
- TightVNC:

  - [VNC password extraction](<https://jia.je/ctf-writeups/2025-09-05-imaginary-ctf-2025/obfuscated-1.html>)

## Misc

- Image steganography:

  - [StegSolve](<https://jia.je/ctf-writeups/2018-09-28-thuctf2018/misc/Format.html>)
- Text steganography:

  - [Zero width characters](<https://jia.je/ctf-writeups/2025-09-19-k17-ctf-2025/discord.html>)
- Audio steganography:

  - [Sonic visualizer](<https://jia.je/ctf-writeups/2025-09-26-iran-tech-olympics-ctf-2025/rider.html>)
  - [LSB](<https://jia.je/ctf-writeups/2025-12-12-nexhunt-ctf-2025/can-you-read-the-music.html>)
- Representations:

  - [Minecraft](<https://jia.je/ctf-writeups/2025-08-16-scriptctf2025/enchant.html>)
  - [Zeckendorf representation](<https://jia.je/ctf-writeups/2025-08-22-brunnerctf2025/pie-recipe.html>)
  - [EBCDIC](<https://jia.je/ctf-writeups/2025-08-22-brunnerctf2025/the-great-mainframe-bake-off.html>)
- Font:

  - [Ligature](<https://jia.je/ctf-writeups/2025-08-29-tfcctf2025/font-leagues.html>)
- Side channel:

  - [Blind execution with time side channel](<https://jia.je/ctf-writeups/2025-09-26-iran-tech-olympics-ctf-2025/koori.html>)
- PDF:

  - [Decompress /FlateDecode via qpdf](<https://jia.je/ctf-writeups/2025-09-27-sunshine-ctf-2025/pretty-delicious-food.html>)
- DNS:

  - [DNS Reconnaissance](<https://jia.je/ctf-writeups/2025-12-02-advent-of-ctf-2025/day-03.html>)

## Pwn

- Stack buffer overflow:

  - [Override return address to system](<https://jia.je/ctf-writeups/2018-09-28-thuctf2018/pwn/pwn1.html>)
  - [Return oriented programming](<https://jia.je/ctf-writeups/2025-09-05-imaginary-ctf-2025/babybof.html>)
  - [Run shellcode on stack](<https://jia.je/ctf-writeups/2025-09-27-sunshine-ctf-2025/daytona.html>)
- Format string:

  - [Blind printf arbitrary memory read](<https://jia.je/ctf-writeups/2025-08-08-why2025/pwnable/simple-ai-bot.html>)
  - [Override return address](<https://jia.je/ctf-writeups/2025-08-22-brunnerctf2025/the-ingredient-shop.html>)
  - [Random address write](<https://jia.je/ctf-writeups/2025-09-27-sunshine-ctf-2025/jupiter.html>)
- Out of bounds read/write:

  - [Arbitrary memory read](<https://jia.je/ctf-writeups/2025-08-16-scriptctf2025/index-1.html>)
  - [Arbitrary memory write to stdin-\>\_IO\_buf\_base](<https://jia.je/kb/software/glibc_file.html?h=file#stdin-_io_buf_base>)
  - [FSOP](<https://jia.je/kb/software/glibc_file.html?h=file#_3>)
  - [FSOP via house of apple 2](<https://jia.je/ctf-writeups/2025-09-07-blackhat-mea-ctf-quals-2025/file101.html>)
  - [FSOP via house of cat](<https://jia.je/ctf-writeups/2025-09-07-blackhat-mea-ctf-quals-2025/file101.html>)
- Arbitrary file access:

  - [Access memory via /proc/self/mem](<https://jia.je/ctf-writeups/2025-09-10-watctf-f25/hex-editor-xtended-v2.html>)
- Integer overflow:

  - [Overflow to get negative integer](<https://jia.je/ctf-writeups/2025-08-22-brunnerctf2025/online-cake-flavour-shop.html>)
  - [Overflow to get zero](<https://jia.je/ctf-writeups/2025-08-30-corctf2025/cor-shop.html>)
- Ruby jail:

  - [Define new method](<https://jia.je/ctf-writeups/2018-09-28-thuctf2018/misc/Ruby_Master_Level_1.html>)
  - [Disassemble method](<https://jia.je/ctf-writeups/2018-09-28-thuctf2018/misc/Ruby_Master_Level_2.html>)
  - [Memory scan](<https://jia.je/ctf-writeups/2018-09-28-thuctf2018/misc/Ruby_Master_Level_3.html>)
  - [CVE-2018-8778: Buffer under-read in String\#unpack](<https://jia.je/ctf-writeups/2019-01-27-codegate2019/mini_converter.html>)
- JavaScript jail:

  - [JSFuck, write any JavaScript using 6 characters](<https://jia.je/ctf-writeups/2022-11-26-glacierctf2022/pwn/Break the Calculator.html>)
- Python jail:

  - [Unicode bypass](<https://jia.je/ctf-writeups/2025-08-08-why2025/misc/title-case.html>)
  - [Without builtins and digits](<https://jia.je/ctf-writeups/2025-09-12-fortid-ctf-2025/michael-scottfield.html>)
  - [Access sys module from datetime.sys for Python \<= 3.11](<https://jia.je/ctf-writeups/2025-09-26-iran-tech-olympics-ctf-2025/vibe-web-mail.html>)
  - [Other Python jails](<https://jia.je/ctf-writeups/misc/pyjail.html>)
- Shell jail:

  - [Pager !/bin/sh](<https://jia.je/ctf-writeups/2025-08-22-hitconctf2025/git-playground.html>)
  - [Arithmetic evaluation](<https://jia.je/ctf-writeups/2025-10-18-hacklu-ctf-2025/gissningslek.html>)
- Perl jail:

  - [Newline to bypass regex](<https://jia.je/ctf-writeups/2025-09-05-imaginary-ctf-2025/pearl.html>)
  - [Pipe operator to execute command and get output](<https://jia.je/ctf-writeups/2025-09-05-imaginary-ctf-2025/pearl.html>)
- Environment variable:

  - [KEY==VALUE confusion](<https://jia.je/ctf-writeups/2025-09-12-fortid-ctf-2025/protect-the-environment.html>)
- Seccomp jail:

  - [Make syscalls via io\_uring](<https://jia.je/ctf-writeups/2025-12-01-advent-of-pwn-2025/day-05.html>)
  - [Send fd via sendmsg](<https://jia.je/ctf-writeups/2025-12-01-advent-of-pwn-2025/day-10.html>)

## Reverse

- Fuzzing:

  - [Crash on correct input](<https://jia.je/ctf-writeups/2021-08-15-inctf2021/find_plut0.html>)
- JavaScript:

  - [Evaluate code and inspect variables in developer tools](<https://jia.je/ctf-writeups/2025-08-08-why2025/web/why2025-ctf-times.html>)
- Android:

  - [apktool](<https://jia.je/ctf-writeups/2025-08-22-brunnerctf2025/bakedown.html>)
  - [dex2jar + JD-GUI](<https://jia.je/ctf-writeups/2025-09-05-imaginary-ctf-2025/weird-app.html>)
- Memory dump:

  - [Dump memory in debugger](<https://jia.je/ctf-writeups/2025-09-12-fortid-ctf-2025/rev-from-the-past.html>)
  - [Dump arguments of library functions with ltrace](<https://jia.je/ctf-writeups/2025-09-26-iran-tech-olympics-ctf-2025/badmode.html>)
- Validation bypass:

  - [Patch conditional jump instruction](<https://jia.je/ctf-writeups/2025-09-19-k17-ctf-2025/bait-and-switch.html>)
- PyInstaller:

  - [pyinstxtractor](<https://jia.je/ctf-writeups/2025-09-19-k17-ctf-2025/jumping.html>)
- BPF:

  - [Use bpftool to dump bpf program and maps](<https://jia.je/ctf-writeups/2025-09-27-sunshine-ctf-2025/warp.html>)
  - [BPF assembly reverse engineering](<https://jia.je/ctf-writeups/2025-12-01-advent-of-pwn-2025/day-04.html>)
- Side channel:

  - [Use loop count as side channel to recover flag](<https://jia.je/ctf-writeups/2025-10-25-qiangwang-nitai-quals-2025/hyperjump.html>)
- VM:

  - [Convert VM bytecode to RISC-V assembly to reuse decompiler](<https://jia.je/ctf-writeups/2025-12-02-advent-of-ctf-2025/day-10.html>)

## Web

- XSS:

  - [Inline JavaScript](<https://jia.je/ctf-writeups/2018-09-28-thuctf2018/web/XSS1.html>)
  - [SSRF in JavaScript](<https://jia.je/ctf-writeups/2018-09-28-thuctf2018/web/XSS2.html>)
  - [HTML injection](<https://jia.je/ctf-writeups/2025-09-19-k17-ctf-2025/autofill.html>)
  - [PDF.js vulnerability](<https://jia.je/ctf-writeups/2025-09-19-k17-ctf-2025/pwnable-document-format.html>)
- GraphQL:

  - [Schema introspection](<https://jia.je/ctf-writeups/2022-11-26-glacierctf2022/web/FlagCoin Stage 1.html>)
- CURL:

  - [SSRF using gopher://](<https://jia.je/ctf-writeups/2018-09-28-thuctf2018/web/BabyWeb.html>)
- PHP:

  - [php://filter for arbitrary file read](<https://jia.je/ctf-writeups/2025-08-22-brunnerctf2025/brunsviger-huset.html>)
  - [More than 1000 input variables](<https://jia.je/ctf-writeups/2025-09-07-blackhat-mea-ctf-quals-2025/cute-csp.html>)
- Flask:

  - [Jinja template injection to leak data](<https://jia.je/ctf-writeups/2018-09-28-thuctf2018/web/Flask.html>)
  - [Jinja template injection to RCE](<https://jia.je/ctf-writeups/2025-09-27-sunshine-ctf-2025/web-forge.html>)
  - [Debugger PIN leak](<https://jia.je/ctf-writeups/2025-08-16-sekaictf2025/my-flask-app.html>)
- SQL injection:

  - [Enumerate and read from unknown tables](<https://jia.je/ctf-writeups/2018-09-28-thuctf2018/web/wdSimpleSQLv1-1.html>)
  - [Arbitrary file read](<https://jia.je/ctf-writeups/2018-09-28-thuctf2018/web/wdSimpleSQLv1-2.html>)
  - [Use UNION SELECT to query extra data](<https://jia.je/ctf-writeups/2025-09-27-sunshine-ctf-2025/lunar-shop.html>)
- Json query injection:

  - [Blind recovery of hidden string](<https://jia.je/ctf-writeups/2025-09-12-fortid-ctf-2025/jey-is-not-my-son.html>)
- MongoDB:

  - [MongoDB $operator injection](<https://jia.je/ctf-writeups/2022-11-26-glacierctf2022/web/FlagCoin Stage 2.html>)
- Information leak:

  - [robots.txt](<https://jia.je/ctf-writeups/2025-08-22-brunnerctf2025/brunsviger-huset.html>)
- Next.js:

  - [CVE-2025-29927: Next.js Middleware Authorization Bypass](<https://jia.je/ctf-writeups/2025-08-22-brunnerctf2025/epic-cake-battles-of-history.html>)
- YAML:

  - [YAML v1.1 versus v1.2](<https://jia.je/ctf-writeups/2025-08-30-corctf2025/yamlquiz.html>)
  - [NO parsed as false](<https://jia.je/ctf-writeups/2025-09-07-blackhat-mea-ctf-quals-2025/cute-csp.html>)
- Race condition:

  - [Cookie session race condition](<https://jia.je/ctf-writeups/2025-09-04-nullcon-berlin-hackim-2025-ctf/webby.html>)
  - [Lock file race condition](<https://jia.je/ctf-writeups/2025-09-07-blackhat-mea-ctf-quals-2025/cute-csp.html>)
- Path traversal:

  - [Use / to force absolute path](<https://jia.je/ctf-writeups/2025-09-05-imaginary-ctf-2025/codenames-1.html>)
  - [Relative path](<https://jia.je/ctf-writeups/2025-09-07-blackhat-mea-ctf-quals-2025/hash-factory.html>)
- bcrypt:

  - [Length truncation to 72 bytes](<https://jia.je/ctf-writeups/2025-09-05-imaginary-ctf-2025/passwordless.html>)
- DNS:

  - [DNS rebinding attack](<https://jia.je/ctf-writeups/2025-09-19-k17-ctf-2025/janus.html>)
- Side channel:

  - [Timing side channel for password validation](<https://jia.je/ctf-writeups/2025-09-19-k17-ctf-2025/vault.html>)