Challenges_2022_Public

blockchain Challenge| Author| Difficulty| Release Round ---|---|---|--- Solve Me| @bluealder| beginner| round 1 Crypto Casino| joseph8210| easy| round 2 Secret and Ephemeral| @bluealder| medium| round 1 Private Log| @bluealder| hard| round 1 EVM Vault Mechanism| joseph8210| hard| round 1 web...

seccomp-tools

Seccomp Tools Powerful tools for seccomp analysis. This project is aimed primarily but not exclusively at analyzing seccomp sandboxes in CTF pwn challenges. Some features are CTF-specific, but they're just as useful for analyzing real-world seccomp filters. Features Dump - Automatically dumps...

struts-pwn_CVE-2018-11776

struts-pwn - CVE-2018-11776 Exploit An exploit for Apache Struts CVE-2018-11776 Usage Check if the vulnerability exists against a single URL. python struts-pwn.py --url 'http://example.com/demo/struts2-showcase/index.action' Check if the vulnerability exists against a list of URLs. python...

ctf-skills

ctf-skills Agent Skills for solving CTF challenges — web exploitation, binary pwn, crypto, reverse engineering, forensics, OSINT, and more. Works with any tool that supports the Agent Skills spec, including Claude Code. Installation npx skills add ljagiello/ctf-skills Environment Setup Two setup...

CVE-2021-4034-CTF-writeup

CVE-2021-4034-CTF-writeup This is a CTF pwn challenge that I wrote in C which requires the user to exploit the CVE-2021-4034 vulnerability. Players are given 2 binaries in the challenge directory in this repo. The chal binary implements the CTF challenge and the shelly.so is a helper binary. How ...

struts-pwn_CVE-2017-9805

struts-pwn - CVE-2017-9805 Exploit An exploit for Apache Struts CVE-2017-9805 Usage Check if the vulnerability exists against a single URL. python struts-pwn.py --url 'http://example.com/struts2-rest-showcase/orders/3' Check if the vulnerability exists against a list of URLs. python struts-pwn.py...

elfxtract

ELFXtract ELFXtract is an automated analysis tool used for enumerating ELF binaries Powered by Radare2 and r2ghidra This is specially developed for PWN challenges and it has many automated features It almost displays every details of the ELF and also decompiles its ASM to C code using r2ghidra...

2018-QWB-CTF

2018-QWB-CTF 2018 Qiangwangbei CTF Challenge Collection │ ├── 01Misc-4题 │ ├── 题目名称：ai-nimals │ │ └── 题目名称：ai-nimals.mhtml │ ├── 题目名称：welcome │ │ └── 题目名称：welcome.mhtml │ ├── 题目名称：签到 │ │ └── 题目名称：签到.mhtml │ └── 题目名称：问卷调查 │ └── 题目名称：问卷调查.mhtml ├── 02Crypto-5题 │ ├──...

C2-Pwn

C2-Pwn Uses Shodan API to pull down C2 servers to run known exploits on them. Requires shodan account for API. https://www.shodan.io/ Rat Exploit Support Dark Comet Remote File Download https://www.rapid7.com/db/modules/auxiliary/gather/darkcometfiledownloader Gh0st Rat buffer Overflow...

GlacierCTF2023_writeups

Glacierctf 2023 Description CTF date: 24.11.2023 - 26.11.2023 Duration: 48 hours CTF Time: https://ctftime.org/event/1992 GlacierCTF 2023 was the second edition of the jeopardy-style CTF organized by LosFuzzys. The CTF featured challenges in various categories, including pwn, rev, web, crypto,...

CVE-2024-21338-1

CVE-2024-21338 This PoC was developed for the XSS PWN-Day contest. https://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion/threads/111240/...

chall2026-telneted

@Hack 2026: Telneted Authored by Harsh. Category : Pwn Solves : 34/120 Tags : beginner Protocol : telnet Recon team has found another endpoint in the Aliens' network, but we can't seem to be able to connect to it with our tools. Network captures show a user 'astrax' using it smuggle secret data...

Malicious Package

Overview pulse-pwn-9f3a2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in pulse-pwn-9f3a2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8086e23ce4b6ff1ca043ca8d9c83f384455e0baee3d06cd79e8a0d5d52c04e1 index.js contains top-level code that fetches /profile and sends document.cookie together with the response body to a hardcoded webhook.site URL...

MAL-2026-16254 Malicious code in pulse-pwn-9f3a2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8086e23ce4b6ff1ca043ca8d9c83f384455e0baee3d06cd79e8a0d5d52c04e1 index.js contains top-level code that fetches /profile and sends document.cookie together with the response body to a hardcoded webhook.site URL...

the-few-chosen-ctf-2026

The Few Chosen CTF 2026 — Writeups Solutions, exploits, and w...

compfest-ctf-2026

COMPFEST CTF 2026 — Writeups & Solutions Solutions, exploits,...

ASIS-CTF-Quals-2026

ASIS CTF Quals 2026 — Writeups Solutions, exploits, and write...

z0d1ak-ctf-qualifiers-2026

z0d1ak CTF Qualifiers 2026 — Writeups Solutions, exploits, an...

EUVD-2026-54565

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires...