Web
SSTI, auth bypasses, prototype pollution, request smuggling, SSRF chains.
/ctf/web
# ctf
Capture the flag — and write down what got me there.
CTFs are where I sharpen intuition. The writeups here are not walkthroughs — they focus on the moment a challenge opened up and what generalizes back to real engagements.
ctf/ — strategy
# ctf playbook 1. read every endpoint twice 2. trust no client-side validation 3. diff between "works" and "secure" 4. write while it is still fresh 5. ship the writeup or it did not happen
# categories
Where I play
Where most of my CTF time goes — and the kind of writeups you can expect.
Crypto
RSA quirks, oracle attacks, lattice tricks, and broken protocol assumptions.
/ctf/crypto
Forensics
Disk, memory, packet capture, and reconstructing what an attacker actually did.
/ctf/forensics
Reverse Engineering
Static and dynamic analysis on Linux and Windows binaries — Ghidra, GDB, x64dbg.
/ctf/reverse
OSINT
Tracing artifacts back to humans, infrastructure, and timelines.
/ctf/osint
Pwn
Stack and heap exploitation, ROP, format strings, modern mitigations.
/ctf/pwn
# writeups