our exploits will be legend
Ubuntu 26.04의 glibc 2.43에서 달라진 fastbin, tcache, normal bin, mmap 동작과 heap exploitation 영향 정리
Package-tested impact of fastbin removal, tcache changes, allocator integrity checks, and mmap layout changes on heap exploit construction
Exploiting a QuickJS-ng fast-array bug to expose stale JSValues, corrupt the global property table, and call std.loadFile
Turning a missing pyjnius type check into Java object confusion, native memory access, and code execution through a forged PyObject
Recovering VM opcode semantics and translating bytecode into solvable constraints
Modeling binary verification logic with Z3, debugging constraints, and validating solutions
Recovering a 37-byte flag by reconstructing and inverting an anti-debug-aware Xbyak JIT verifier
Decrypting an 18-byte flag payload by reversing a position-dependent XOR stream derived from a fixed 16-byte key
Combining malloc-failure undefined behavior and signedness bugs to obtain NULL-based absolute memory access and code execution
Navigating a height-128 2-isogeny volcano by lifting both endpoints to its unique CM crater
Extracting embedded bit-vector puzzles from a Next.js bundle, solving them with Z3, and rebuilding the flag keystream
Carving an embedded compiled AppleScript and inverting its bytecode-level character transform to recover the hidden payload
Recovering a 150-character AES-CBC secret through UTF-8 and JSON response oracles under a strict decoding barrier
Recovering xorshift128 state from encoded audio tones and removing the PRNG mask to reconstruct the flag
Forcing RSA factor recovery to fail by choosing primes with matching small-base 2-adic residue behavior
DefCamp D-CTF Final
Hiding a syscall opcode inside an immediate and jumping into the instruction midpoint to bypass Capstone-based shellcode filtering
Deriving an AES-256 key from a hardcoded Windows path and decrypting Pumpkin.html.enc with the fixed IV embedded in the binary
Solving an embedded Sudoku, deriving a row-ordered 27-byte keystream, and XORing the hardcoded ciphertext
Recovering a 48-byte secret from a stateful AES-CBC encryption oracle by forcing block collisions across chained requests
The 3th HSACE CLUB LEAGUE Quals
금융보안 위협분석 대회 2025
얼굴 인증 API를 상대로 GA로 코사인 임계값을 넘어선 과정
Beacon 패턴과 WebSocket 트래픽을 분석해 침해 지표를 도출
네트워크 포렌식으로 C2 비콘과 데이터 업로드 경로를 규명
Forging an AES-CBC subscription packet by flipping IV bytes to rewrite the subscriber identifier as 0xdeadbabe
Recovering reused AES-CTR plaintext by aligning consecutive ciphertexts one block apart and scoring printable XOR chains
Recovering an AES-128 key from power traces with a first-round CPA model
Recovering early SEED round keys with byte-wise CPA and key-schedule inversion
Recovering an ARIA-128 master key with first-round and ciphertext-side CPA
![[SAS CTF 2026] JSculator writeup](/_astro/SAS26.C8H7_A0o_28emzr.webp)
![[SECCON CTF 14] Crown Flash writeup](/_astro/seccon14.CPpgPmZa_tkyJ0.webp)
![[D-CTF] inline8](/_astro/d-ctf.C_wVRWf-_Z1f3OuT.webp)
![[H7CTF 2025] 0x0f05 writeup](/_astro/h7ctf.DX83Bz1u_1q0QBY.webp)
![[CLUB LEAGUE] Admin QA writeup](/_astro/club.BOG-ZyMo_1pDw9Q.webp)
![[FIESTA 2025] Debug Shield Breaker writeup(up-solving)](/_astro/fiesta.O_PXr6Yb_Z1TuJdt.webp)
![[SunshineCTF 2025] bits of space writeup](/_astro/sunshine.D8KoxPYW_Zaifty.webp)