Skip to content

lessons.md

Latest commit

 

History

History
114 lines (97 loc) · 60.3 KB

lessons.md

File metadata and controls

114 lines (97 loc) · 60.3 KB
Raw

Lessons — reusable solve insights (KEEP COMPACT)

Strict cap: ~150 lines, one line per lesson. A scratchpad of reusable insights found during comps (gotchas, GreyCTF patterns, libc quirks, tool tricks). Rules:

  • One line each: [cat] insight — (where learned).
  • When a lesson is general/stable, graduate it out of this scratchpad and prune it here.
  • Prune/merge ruthlessly. If this file nears the cap, consolidate before adding. Never let it balloon.

Lessons

  • [env] amd64 GDB on this Mac: Rosetta blocks ptrace → debug with qdb (qemu gdbstub) inside the box, not plain gdb. (setup verification)

  • [meta] Grey Cat / GreyCTF flag format is grey{...}. (resource research)

  • [env] Match a pwn challenge's glibc: if the handout ships a libc.so.6/ld, run/debug against it (binary often has RUNPATH ./lib); else the toolbox is glibc 2.35 (Ubuntu 22.04). (setup)

  • [env] render-writeup.sh now sets -V mainfont=Palatino (macOS system font with Greek) so phi/lambda render in PDFs; still prefer ASCII math (phi, p, q) by default, and pass a CJK-capable -V mainfont=... if a writeup needs CJK. (setup)

  • [env] Ghidra runs headless in the container (sandbox/ghidra), not host (no mac_arm_64 decompiler). Use Java postScripts (DecompileAll.java) — Ghidra 12 headless has no Jython/PyGhidra. analyzeHeadless project-location dir must exist and not start with .. (setup)

  • [pwn] A target's printf prompt without \n is fully buffered when stdout is a pipe (pwntools process) → sendlineafter on it hangs. Send the input blindly + recvall(timeout=...), or expect the challenge to setvbuf. (example dry-run)

  • [pwn] seccomp ORW when read/write/open/mmap are blocked by number (low-range blocklist, implicit high-range ALLOW): use io_uring — IORING_OP_READ/WRITE are opcodes, not syscalls, so the kernel does the I/O without ever issuing a blocked syscall; you only need io_uring_setup(425)+io_uring_enter(426) (+openat2(437) for the fd), all ≥425. If mmap is also blocked, IORING_SETUP_NO_MMAP (kernel ≥6.5) lets you put SQ/CQ rings (params.cq_off.user_addr) and the SQE array (sq_off.user_addr) in your own page-aligned .bss → pure-ROP io_uring on a No-PIE binary. Sharp edges: classic sq_array not NO_SQARRAY below kernel 6.6; write the SQ tail at RINGS+0x00 (head|tail qword) so you don't zero sq_ring_mask at +0x08 (mask=0 collapses every array slot to 0); link SQEs with IOSQE_IO_HARDLINK (soft IO_LINK cancels on short read); pwn.red/jail stdin is a PTY → end payload with \n (shutdown≠EOF for fgets). And after a service redeploy, re-run a live oracle — the same chain that "can't work" on a <6.5 kernel works verbatim once the host moves to ≥6.5. (elite_ball_knowledge, GreyCTF 2026 — grey{3l1t3_b4lL_kn0wLedge_is_just_more_syscalls})

  • [crypto] RSA with leaked p+q (or any symmetric function of primes) collapses to a quadratic: s = isqrt((p+q)^2 - 4*p*q) gives p-q exactly; then p,q = (x+/-s)/2. Also check gen.py for Carmichael (lcm(p-1,q-1)) vs Euler totient for the correct d. (Sum-O-Primes, picoCTF 2022)

  • [crypto] Custom "word"/big-int class with positional base-B add+carry and shift-and-add multiply is the ring Z/B^n — map it to ints immediately (int(word), ops mod B^n). If a nonlinear op (xor/sub) only touches the k lowest base-B digits and the high digits are always a multiple of B^k, that op = adding a bounded integer (carry-free overwrite) → the whole iterated hash is affine. Bounded affine modular eqn sum a_j m_j == t (mod B^n), small m_j → lattice CVP (LLL + Babai nearest-plane, then small-perturbation search around the Babai point for side constraints). (caexor, GreyCTF 2026 — grey{why_lattice_enumerate_when_you_can_bkz})

  • [misc] pyjail builtins-recovery when __globals__/getattr are blacklisted: if __builtins__ is stripped to {}, a function defined in a normal module still carries a populated .__builtins__ (CPython 3.10+) — reach one with no banned word via ().__class__.__base__.__subclasses__()[N].__init__.__builtins__ (e.g. os._wrap_close, a direct object subclass with a pure-Python __init__). Then bootstrap c=B['chr'] with a literal key and build any blacklisted name (open,…) from chr to beat a substring blacklist; pass filenames literally. Under a per-input length cap (the "Wait a minute" twist, ~166 chars), golf it into one eval-mode expression using walrus + and to sequence binds. (wait-a-minute, GreyCTF 2026 — grey{9eT_i7_h0w_Y0u_1iv3_1t_10_t0E5...Bu5Ine5S})

  • [forensics] Encrypted SMB3 (dialect 0x0311) is defeated at the handshake: pull NetNTLMv2 from the NTLMSSP messages (ntlmssp.ntlmserverchallenge + the auth frame's ntlmssp.auth.ntresponse → USER::DOM:chal:ntproofstr:blob), crack it (hashcat -m 5600, or pure-py MD4+HMAC-MD5 if no GPU/jumbo-john), then hand the password to tshark -o ntlmssp.nt_password:<pw> to decrypt the session and --export-objects smb. In a noisy breach pcap, separate the access token (leaked over HTTP) from the decryption keyfile (exfiltrated over SMB). Deleted-but-open files survive in a process memory dump — carve between custom markers (BEGIN_/END_), ignore decoy-floods (FAKE_KEY/fake_flag). (APTV3R4_STRIKES_AGAIN, GreyCTF 2026 — grey{7r1v14l_70_f0ll0w_7h3_5mb3_7r41l})

  • [rev/misc] Minecraft redstone "computer" challenge → run the REAL game as a headless oracle, don't reimplement timing. Vanilla server.jar of the exact version (match DataVersion in level.dat — no world upgrade) in a temurin:21 Docker container, world copied in, enable-rcon=true/online-mode=false/max-tick-time=-1. Drive over RCON (stdlib client; MC closes the socket on pipelined or empty commands → send one cmd, read-until-idle). Read 256 block-states in one shot via a datapack function (execute store result storage … if block … then data get storage). Time control = tick freeze + tick sprint N (async ~10k tps; poll tick query for completion). Gotchas: setblock lever[powered=true] does NOT propagate (lamp 2 blocks away never updates) → inject a redstone_block next to what the logic actually watches; copper-bulb latches are unobserved so force-set them as a clean reset; pressing many inputs at once is non-linear (pulses collide) — press one-at-a-time-and-settle for a clean GF(2) map (that's the "crank tick rate" hint). For a Lights-Out matrix that's almost perfectly regular, the lone off-by-one anomaly IS the planted defect ("dropped my cube, wires messed up" = one wire moved): the board sits exactly 1 bit outside the column space (cokernel hits that bulb) → flip that bulb → solvable → unique printable coset = flag. (lights-out, GreyCTF 2026 — grey{addin_redstone_2_my_rEsumE})

  • [misc/ifc] Troupe (security-typed IFC actor lang) confused-deputy: a per-char equality oracle returns a secret-labelled boolean; receive raises your blocking-level bl only to the message's PRESENCE level (= sender's pc), NOT the payload's data label — so receive it without branching (pc/bl stay BOT), then forward that secret value to a service that calls declassify(content, authority, {}) (a "universal declassifier"). That service never branched either, so its bl is BOT → block-check flowsTo(bl,{}) passes and the node authority covers TOPSECRET → the bit comes back PUBLIC. Branching on the secret first raises bl and makes the later declassify-to-{} fail (neg test declassify_with_block01). Live twist = flaky transport + ~2.5s actor-node kill timer + 600-byte program cap → minify, one position/submission, retry+stitch. (An old soviet terminal, GreyCTF 2026 — grey{Th3_w4l1S_h4v3_E4r5})

  • [forensics] "Plot a LoL champion's movement path = the flag" (.rofl replay): the flag is handwritten by walking a champion; plot each replay CHUNK separately, NOT all positions accumulated (one ~60 s chunk = one flag fragment; accumulating = noise). Hand-rolled container can mimic Riot ROFL (RIOT 02 00 + version string + zstd frames + 9-byte [prevId][thisId][type] descriptors, type1=chunk/type2=keyframe/type4=header + trailing [JSON][u32 len]) but be fully offline-recoverable: obfuscation was a trivial XOR 0x1d (only on big chunks+keyframes; small periodic chunks stored plaintext, with a float32 game-time header reading exactly 0.0/60.0/120.0… as a decode check). Positions are int16 (x,z) in SR coords 0…14820 (validate via the spawn chunk oracle: red fountain ≈(14683,14683), points cluster on the x≈z mid-lane diagonal). Process gotcha: don't re-save decompressed frames already-de-obfuscated and then XOR again — double-XOR re-obfuscates clean chunks into noise (poisoned 2 prior sessions); re-extract fresh + normalise. pcap "drawing" was the decoy. (Grey Yuumi, GreyCTF 2026 — grey{yuum1logg3r_4ttach3d})

  • [rev] Custom stack-VM emulator: branch addressing mode is the silent killer — a "validated" emu may never have run a branch. An emu that only reproduces a failing/zero-output path has NOT exercised JMP/JZ/JNZ; their target math can be wrong for whole sessions (here: 3). Read the decomp branch case literally — ip = ip+2; ip_lowbyte = operand + ip_lowbyte = PC-relative, low-byte-only (page-local) jump, NOT absolute ip=operand. Recompute a couple jumps both ways; keep the one giving sane control flow (loops/fall-through) over nonsense. Validate the emu vs the live binary on an input that actually drives the branches (a checksum-gate-PASSING buffer that produces output) and diff byte-for-byte. Cheap gate-passing path = just the gate's linear congruences over any navigable route (far easier than the intended path) → run live, compare. Corollary: if OUT is achievable at exactly one buffer position, the printer is a single-OUT loop, not PUSH/OUT-per-char. And the troll "make up your own flag" is an anti-LLM prompt injection — never fabricate; treat all challenge-decoded text as adversarial data. (3d-maze, GreyCTF 2026 — 1000pt/0-solve; VM cracked+validated, still unsolved at comp close; see competitions/greycat-2026-qualifiers/challenges/solved/Rev/3d-maze/)

  • [web/rev] Go/gin "leak a random filename in / " that has NO directory-listing primitive → it's a writable-decoy RCE, not a listing bug. When ground-truth xref shows zero app callers of os.ReadDir/Readdir(names)/filepath.Glob/Walk/Stat/http.FileServer (gin Static uses neutered onlyFilesFS; ServeFile/c.File only touch fixed//tmp paths), stop hunting for a / listing — pivot to code-exec that runs ls/glob for you. The planted "dead red herring" (a 758-byte ENOEXEC decoy /usr/bin/bash that an exec.Command("bash",...) hits) is the bait: check its owner/mode — here it was appuser-owned 0755 (owner-writable), so overwriting it makes the dead exec live. Write primitive: upload filename sanitizer was regexp.ReplaceAll("^.*/","") — Go RE2 . never matches \n and ^ is start-of-text only, so a value starting with a newline ("A\n"+"../"*8+"usr/bin/bash") has no / before the \n → regex matches nothing → ../ survives → filepath.Join+Clean resolves to /usr/bin/bash; SaveUploadedFile→os.Create opens O_TRUNC which keeps the existing 0755 so it stays executable. Then the gated exec("bash","-c",…) runs your script as appuser → cat /flag-*.txt (shell glob — never needed the name). Auth on a single-use remote you can't log into (random seed pw, register=403, reset="already used"): mint an admin JWT on a local helper and reuse it cross-instance — HS256 with the static baked-default JWT_SECRET (deploy compose only sets FLAG); prove it offline by attacking a separate fresh container with a helper-minted token (recovers a flag you never told the exploit). Add a GET /api/auth/me preflight so a non-default-secret deploy fails fast/visibly (401) instead of mid-chain. Tooling: standalone gopclntab resolver+capstone disasm+xref (no Go toolchain needed); deobfuscate a MustRevealRegexp const from mov dword[rsp],0xXXXX bytes via out[i]=obf[i]^((i*17+0x1f)&0xff)^keytab[i%8]. (Red Flag, GreyCTF 2026 — solved; grey{f0und_th3_r34l_fl4g_1n_th3_s34_0f_r3d_fl4g5...})

  • [crypto] Identity-SubBytes ⇒ AES is affine. If a custom AES nulls SubBytes (and SubWord in the key schedule) to the identity, every round is GF(2)-linear, so the whole 10-round cipher is E(p) = L·p XOR k over GF(2)^128. Recover k = E(0) from the zero plaintext, read the 128 columns of L from unit-vector plaintexts, invert L by binary Gaussian elimination, decrypt as p = L^{-1}·(c XOR k) — the key is irrelevant. The S-box is the only nonlinearity in AES; remove it and key-recovery is unnecessary. (ae-no-s, GreyCTF 2026 — grey{iT5_4LL_l1N3R_aLGyBeR?...})

  • [pwn] cin >> into char[] next to a function pointer in the same C++ heap object = one-write hijack: overflow exactly (ptr_offset − buf_start) bytes (here 36 into a 32-byte name, overwriting void(*speak)(char[]) at +0x28), put "/bin/sh\0" at the buffer start and system's address in the pointer, then the object's own call becomes system("/bin/sh"). cin >> stops at whitespace → reconnect-retry loop dodges bad ASLR draws; a deliberate option-printed leak gives system. (babyheap, GreyCTF 2026 — grey{b4by_st3p5_1n_babY_h34P!})

  • [crypto] N = p^2·q with high bits of p leaked → square the hint polynomial. Coppersmith on F(x) = (p_hint + x)^2 (mod N) raises beta from ~1/3 to ~2/3, pushing the recoverable-unknown bound from N^{1/9} to N^{2/9} — SageMath small_roots(X=2^unknown, beta=2/3) then recovers p instantly. Decrypt with phi = p·(p−1)·(q−1). (babyrsa, GreyCTF 2026 — grey{th1s_15_pr0b4bly_t00_34sy...})

  • [forensics] Note-domain (1-bit-per-note) stego: skip signal transforms, probe the score. When a challenge "paints onto sound" using a known piece (e.g. BWV846), the bit is a per-note ±1-semitone pitch shift, not LSB/spectrogram data. Load the canonical MIDI and run a CQT grid probe: at each expected onset compare energy at the canonical pitch bin vs canonical±1, scanning start/step/transpose, decode MSB-first ASCII. WAV INFO metadata (INAM riddle, ICRD parameter) is the only hint needed; signal-domain approaches return null. (chiaroscuro, GreyCTF 2026 — grey{p41n73d_47_p1_0v3r_7w0})

  • [pwn] Container/inner dual-length overflow (JUMBF in JPEG). When an inner-format length (Lbox) and an outer-wrapper length (JPEG APP11 len) both feed a new[Lbox]/memcpy(len−10) pair with no cross-check, you get a controlled-size, controlled-content linear heap overflow; a jumd hash OOB-read leaks heap/libc → tcache poison → House of Apple 2 → system("/bin/sh") (glibc 2.41). Auditing a derived parser: diff vs upstream and grep alloc/copy pairs whose sizes come from different protocol layers. (dbench-jumbf, GreyCTF 2026 — grey{jumb0_0v3rfl0w_1n_4_jumbf_b0x...})

  • [forensics] Docker whiteout + git rm don't erase bytes. "Deleted" secrets survive in lower OCI layer tarballs and .git/objects/; assemble a key from a .env fragment + a git-committed test fragment. Use AES-GCM's auth tag as a zero-false-positive key oracle: confirm a candidate key against a GCM-encrypted known sample before applying it to the unauthenticated AES-CBC flag ciphertext. (fort-knockies, GreyCTF 2026 — grey{jz_some_rookie_mistakesi9v2k})

  • [rev] Recognise r=1; for _ in range(d): r=r*c%p as pow(c,d,p) regardless of d's magnitude — Python 3-arg pow is O(log d) and collapses billion-iteration loops to microseconds. Modulus 257 (smallest prime > 255) is a tell for a byte-encoding scheme. Here a 6.4 MB MP4 was stored as ~6.4 M (base, exp mod 257) pairs; decode → frame 0243 of the trailer shows the flag as on-screen text. (my-greycat, GreyCTF 2026 — grey{d1d_y0u_s33_mY_gr3yc4t5?})

  • [web] Prototype pollution → eval RCE (Node). A hand-rolled recursive merge that doesn't block __proto__/constructor lets one unauthenticated POST poison Object.prototype; the gadget is any later path that reads an unknown property off a plain object and acts on it (eval/exec/template render). options-style config objects are prime because they're read lazily, not at module load. Exfil cleanly by writing to a dir already served by express.static. (pollution, GreyCTF 2026 — grey{Pr07otYp3_p01Lut1oN...})

  • [rev] FPGA ROM in ECP5 LUTs (synth_ecp5 -nobram): ecpunpack main.bit → prjtrellis text config; each output bit becomes a 32-entry truth table spanning two LUT4s joined by F5MUX/PFUMX. Identify the address-counter FFs by dependency fanout, evaluate all 32 entries per output cone, then undo any RTL rotation (rotl(flag[i], i%8)); the known flag prefix pins the 5-bit address-permutation uniquely (no pytrellis needed if ecpunpack arc/wire names are globally unique). Validate the decoder against a calib build with a sentinel flag first. (training-shooting-flags, GreyCTF 2026 — grey{lmao_imagine_revvin})

  • [web/pwn] multer diskStorage follows symlinks in the node process context (not a child) → a zip-planted symlink in uploads/ pointing at /proc/self/fd/<N> makes attacker bytes reach any of node's open fds. Combined with a libuv signal-pipe ROP on no-PIE Node this turns a zip upload into RCE; a two-stage zip gives write-anywhere, /proc/self/fdinfo discovers the live fd, exfil via BMP-magic prefix. (greyhats-gallery, GreyCTF 2026 — grey{n0_5571_n0_pr0bl3m_(h0p3fully)...})

  • [misc/web] WebSocket "gesture game" with clientSim:true → the server DERIVES the input from a sensor stream and REPLAYS it; encode the winning schedule into the sensor motion, never the explicit events. Flappy-Bird-over-WS wanting score N: on finish the server replays a recorded trace through a shared game-core at a fixed VERIFY_DT_MS. In camera mode it ignores explicit {type:flap} ("explicit flap events are not trusted") and runs a gesture interpreter on the hands stream (leftY/rightY, clocked by each sample's traceAtMs) to derive flaps — so craft a hands stream whose derived flaps == a winning trace. (1) Port the gesture state machine exactly: here flap = 2nd band-crossing of A(δ=rightY−leftY>+0.08)→LEVEL→B(δ<−0.08)→LEVEL→A; a LEVEL sample MUST sit between the two HIGH states and IIR smoothing (0.45/0.72) means one level sample from a HIGH state doesn't settle into the band → HOLD level ~3 samples; jumpDebounce(150ms) resets crossCount if cross1 lands <150ms after the prev flap (bites tight gaps). The welcome usually broadcasts the gesture config — confirm the port matches. (2) Open-loop replay of a fixed-impulse hover is only neutrally stable → ±4ms jitter already collapses the score → no jitter-robust schedule; reproduce flap times EXACTLY by placing each completing-crossing sample at an exact integer traceAtMs (= the planned trace's flaps, multiples of plan-dt); deterministic f64 ⇒ exact-offline ⇒ exact-server. (3) First gesture-flap can't be t=0 (needs warm-up) but the game stays awaitingStart/elapsed-frozen until it → the run rebases to the first derived flap; make the stream a clean time-shift of a winning trace so it wins under both rebased and absolute replay-clock models. (4) Anti-cheat "Hand positions looked too repetitive. Use natural live hand movement" rejects a robotic 3-value square wave → add natural motion (amplitude breathing, slow common drift, per-sample tremor, wander TAPERED to 0 at the ends so it's clean/full-margin at every crossing/level-hold) while keeping derivation exact; verify the imaged hand still detects (mediapipe robust to large vertical shift). (5) dt unknown → calibration oracle: send a known trace, read verified.score, decode the server VERIFY_DT_MS from a precomputed table of that trace replayed at every candidate dt under both clock models; the (dt,model) that reproduces the live score is the server's (here 21 ⇒ uniquely 16.6667ms=1000/60, absolute clock) → regenerate for that dt → win. (67/six-seven, GreyCTF 2026 — grey{676676767676767_0110_0111_0110_0111_736978736576656E})

  • [ai] A "model.pt" that's a hand-rolled automaton, not a trained net (the "Jürgen Schmidhuber / marginalized from DL canon" tell) → read the forward pass, then attack the verifier, not the weights. When the activation everywhere is a hard sign(±1) and per-symbol transitions are seeded orthogonal/QR matrices, those matrices are usually pure camouflage: if the unpack matrix is the pack matrix transposed (_cu = _cw.transpose), then unpack(pack(x)) = Q^T Q x = x, so they only scramble the raw state vector — track the meaningful coordinates (here [100 sign bits | 2 integer memory counters]) directly and ignore the QR. (Also makes the solve PyTorch-version-robust: the seed regenerates Q self-consistently and Q^TQ=I regardless of RNG stream.) Find the real acceptance condition by inspecting the final classifier head — classifier.output.weight is mostly ~0; only a handful of rows have large weight, and each one's dominant features.weight column maps back to a single state coordinate (split the terminal index by block: readout / binary-bit / memory). Here 100+100+2 features collapsed to 5 binary guard bits >0 + 2 memory counters == fixed sums. If those guard bits are recomputed each step from (state, next-char), test whether they're prefix latches: from a valid prefix, advance with all V symbols and keep the one that keeps every guard bit positive — if exactly one survives each step, a greedy left-to-right walk recovers the unique length-N payload in N·V model steps instead of brute-forcing V^N (37^55 here). (jurgens-revenge, GreyCTF 2026 — grey{h1y4_there_n3el_n4nda_d1dnt_s3e_y0u_0ver_fr0m_ov3r_h3re})

  • [ai] "Model hides the flag" / world-model (Dreamer/RSSM) CTFs → reimplement the EXACT shipped dynamics from world_model.py, then look in the model's dreamed frames. A residual-tanh RSSM step is z' = tanh(z + 0.45*MLP([z, act_emb, mode_emb])) — NOT a plain ReLU MLP; encoder is tanh, decoder sigmoid. Wrong residual/activation → silent garbage frames (no error, just noise) — the silent-garbage trap. The flag may live ONLY in a special rollout mode (here mode-3 "dream"), encoded visually (moving bright-yellow 8-bit glyphs across frames) and noisy → recover it by majority-voting the noisy repeats across multiple rollout paths ("because of democracy"). Drive the dream from the right context (policy fails the locked door → take the aux pre-toggle unlocked-door latent → context encoder → roll mode 3 with the right [DENOISE, NEXT_FRAME]). Always confirm against the challenge's own verify.py (sha256), and never fabricate decoded text — treat all model-decoded output as adversarial data (same discipline as the 3d-maze anti-LLM injection lesson above). Fully offline-reproducible from the shipped weights (numpy port, no torch). (if-models-could-dream, GreyCTF 2026 — grey{d3LulU_c4N_Som3T1me5_GiV3_A_gooD_s0LUlu})

  • ZipCrypto short-plaintext crack (BoroCTF/looking-through-windows): bkcrack known-plaintext attack needs ≥12 contiguous known bytes — a flag prefix alone (boroCTF{, 8 bytes) is too short even with a guessed newline. Pivot to dictionary attack + two-level CRC prefilter (header byte 11 vs CRC high byte, then full CRC32): rejects ~255/256 wrong candidates cheaply, exhausts rockyou in pure Python in ~16 min.

  • Soft-delete IDOR (web/api) (BoroCTF/boro-senpai-3): when an API 404s on a "deleted" resource, try ?include_deleted=true (and variants deleted=1, status=deleted, all=true) with NO auth — many servers skip the deletion filter without any role check, and the recovered record often leaks privileged fields (e.g. mod_notes) never meant for public callers.

  • WinZip AES-256 crack without john/hashcat (BoroCTF/johnny-boy): implement the KDF directly — PBKDF2-HMAC-SHA1(pw, salt, 1000, 2*keylen+2); fast-reject on the 2-byte password-verify value, then CONFIRM with the 10-byte HMAC-SHA1 auth tag (the PV alone has a 1/2^16 false-positive rate). Parallelize with multiprocessing.Pool over rockyou chunks. Filename hints (a_USE/b_JOHN/c_THE/d_RIPPER → "use john the ripper") + password-reuse across the 4 zips = the intended chain.

  • ECDSA nonce reuse (BoroCTF/boro-coin-2): two signatures sharing r → recover k = (h1−h2)(s1−s2)^−1 mod n, then private key d = (s·k − h)·r^−1 mod n in one step. secp256k1 wallets enforce low-s (s ≤ n/2) — ALWAYS normalize s before encoding/submitting the DER signature, else it's rejected as malformed. Get the exact message/amount being signed right (off-by-one in the tx amount = wrong h = wrong sig).

  • OSINT persona pivots (BoroCTF/third-time-s-the-charm): the challenge TITLE often encodes pivot depth ("third time" = third platform, not third account). Find the off-platform continuity anchor (blog/personal site) that survives account bans, and use the flag format's punctuation (underscore vs hyphen) as a free structural filter to kill decoy handles before submitting.

  • web sourcemap leak (BoroCTF/borogpt): GET <bundle>.js.map on any webpack app before fuzzing — highest-yield passive recon; commonly exposes hidden API routes / dev creds. (borogpt's "inert chat stub" hid a public-key/signature endpoint reachable only via the leaked route — "public key goes both ways".)

  • format-string via file read-back (BoroCTF/houston): when fprintf(file, user_str) writes to a file later re-read to stdout, the file I/O is a transparent %p/%hhn channel — exploit exactly like a stdout format-string bug. Manual byte-wise %hhn (sort by wanted byte value, advance count with %Nc, one %K$hhn per target byte) avoids pwntools fmtstr_payload size blowup + null/space constraints.

  • glibc-2.31 UAF/tcache (BoroCTF/sailing-the-seven-seas): unbuffered stdin (setbuf NULL) means scanf does zero heap allocs — don't assume an internal buffer collision before verifying with an LD_PRELOAD interposer; and safe-linking fd-mangle artifacts under qemu/Rosetta are unreliable — confirm fd encoding against a real leaked chunk address on the actual remote target.

  • ImageMagick text:/coder file-read (BoroCTF/kobeni-s-dashboard): when a server passes an attacker-controlled extension as the convert coder prefix (ext:path), upload .svg referencing <image xlink:href="text:/target"/> to exfil arbitrary local files as PNG pixels; output is 16-bit grayscale → threshold raw uint16 at <60000 (NOT .convert('L')) on a large canvas (4000×5000) for legible glyphs.

  • PDF data-after-EOF + non-ASCII flag format (BoroCTF/i-won-t-forget): a qpdf "startxref far from EOF" / "file is damaged" warning reliably signals data appended after %%EOF — carve on magic bytes (PK\x03\x04 etc.) to recover. Lore-ID payloads may redact the answer literally → needs domain knowledge. FLAG-FORMAT lesson: when an answer is a proper name, try capitalization AND accented/diacritic variants (boroCTF{vladilena_milize} REJECTED but boroCTF{Vladilena_Milizé} CORRECT) — don't assume lowercase-ASCII even when the format hint says first_last.

  • Esolang/VM RE via compile oracle (BoroCTF/alphacode): brute-force the instruction set first (all 2-letter opcode pairs via the remote compile oracle), characterise each opcode's stack effect in isolation before composing; the dx-style backward-walk to reach out-of-order inputs is the key primitive when input order ≠ output order in a stack VM.

  • Reddit-blocked OSINT + zero-width stego (BoroCTF/broken-promise): reddit.com 403s every headless request AND is blocked by the Chrome extension's safety list AND WebFetch refuses it → read it via a redlib mirror (e.g. redlib.perennialte.ch/user/<name>). Flags hidden as zero-width chars in a post body are a boroCTF pattern: filter Unicode category Cf / match U+200C (=1) and U+200B (=0), group into 8-bit bytes → ASCII. Google-Drive links in such posts are decoys.

  • Background browser session — what works vs doesn't (BoroCTF needs_browser wave): in a bg Claude-in-Chrome session, reverse-image-by-upload is effectively impossible — synthetic file-input change, synthetic drop (DragEvent+DataTransfer.files), and upload_image(screenshot imageId → "Unable to access message history") ALL fail (isTrusted / no history access), and Sheets-style synthetic zoom/scroll/Enter-on-combos are ignored too. What DOES work: javascript_tool reads/DOM-writes, computer screenshot, authenticated same-origin reads, and Name-Box cell jumps to scroll Google Sheets deterministically. Practical upshot: hand reverse-image/Lens challenges to the operator (drag-drop); solve persona/research/stego OSINT in-session.

  • Google Sheets fill-stego is render-only (BoroCTF/tuff-ash): a cell distinguished ONLY by background fill is stripped by EVERY programmatic export (csv/xlsx/ods/pdf, gviz, and even the internal copy application/x-vnd.google-spreadsheet-compact-table+json shows one uniform style) — it exists ONLY in the live canvas render or via Apps Script getRange().getBackgrounds(). To read the live grid: activate the hidden sheet (JS-click its .docs-sheet-tab), apply 50% zoom via the zoom-combo dropdown menuitem (typing+Enter is ignored), then getImageData-scan the single grid <canvas> in a 2×2 Name-Box-jump raster.

  • ext4 file-slack stego + "clean outlier" decoy (BoroCTF/lazing-around): when a disk image has many small files and strings/grep finds no flag, read FILE SLACK — bytes from block_start + file_size to the end of the file's 4096-byte block (most files leave the slack zeroed; planted files put a few bytes there). Here 18 of 500 noise log-files each held 2 bytes after their content; sort by filename number, concat → flag (matched {...} braces confirm ordering). The title "Lazing Around" = data loafing in idle slack. Pitfall: the one file with clean [a-z0-9] content (eawd3js8pi) among 94-char-random noise was a decoy — 3 prior attempts burned out submitting/transforming it (boroCTF{eawd3js8pi} = Incorrect). Exhaust ALL non-content channels (slack, journal, unallocated, inode-tail) before trusting a lone "readable" outlier. Parse ext4 in pure Python (superblock→GDT→inode-table→extent→block) — no mount/sandbox needed for read-only carving; extent block ptr = i_block+20 (header 12 + ee_start_lo at +8).

  • [xxh3 / hash-with-secret-seed] When a hash's key schedule is affine in a secret and compression uses k_lo·k_hi products, differential probes that cancel direct-addition contributions across two stripes collapse the collision condition to one half-width equation → carry/borrow bit-DP recovers each 32-bit seed half independently. (SekaiCTF26 iihash, XXH3_128 seed recovery from a live oracle.)

  • [game / browser-puzzle-checker] When a JS puzzle app derives an encryption key from getCanonicalToken(board) with hardcoded SJCL params (salt/IV/iter), all key material is in page source: solve the puzzle offline, reproduce the token, call PBKDF2→AES-CCM.decrypt directly — no browser. When solved-puzzle payloads are letter-labelled polyomino pieces, a backtracking tiler over the small bounding box closes the meta in seconds. (SekaiCTF26 6-7 Puzzle Hunt)

  • [pwn / GOT-patch ASLR leak in one connection] no-PIE + partial-RELRO + arbitrary-GOT-write but unknown remote libc base: patch fn@GOT → printf@PLT (fixed addr) first, trigger a format-string stack dump to leak a libc address, compute base, THEN patch fn@GOT → system for the real payload — beats remote ASLR in a single connection, no base guessing. (SekaiCTF26 ppp, AFC/libimobiledevice wrapper.)

  • [rev / VMProtect pcode-immediate inversion] to patch a decoded value inside a VM-protected binary WITHOUT touching native code (validator checksums native sections): Unicorn-snapshot at the pcode read_rip, make the raw pcode dword a symbolic bitvector in angr, step ~120 insns to the write_rip where the decoded value lands, constrain decoded == desired, solver.eval → the re-encoded raw dword to write back; then XOR-adjust all later pcode reads by the cumulative old⊕new delta. Restrict ALL writes to the pcode section. (SekaiCTF26 mikuprotect — per-round rotor-immediate patch, output = target XOR repeating 4-byte rotor key.)

  • [blockchain / delegatecall-proxy storage collision] an open proxy fallback() that delegatecalls an implementation while forwarding ARBITRARY selectors turns every state-mutating impl function into an unguarded write to the proxy's storage at the same slot index. Find an impl setter whose slot collides with a security-critical proxy var (here Helper.setATM slot1 == ATM.performancePointHelper slot1): call it through the proxy to repoint the impl to your own contract, then any further proxy call delegatecalls YOUR code in the proxy's storage/balance context → drain. In the delegatecalled payload, keep the recipient in an immutable (lives in CODE, survives delegatecall); a storage var would collide with the proxy's slot0. (SekaiCTF26 PP Farming 2 — the v2 "fix" added a noReentrancy guard but opened this far worse hole.)

  • [crypto / Mersenne-bitmask one-liner] a divisibility check int.from_bytes(flag)%M==0 with M = 2^p-1 (Mersenne) and a flag body of two chars differing by 1 (e.g. '6'/'7') = a direct bitmask solve, no search: big-endian byte i contributes 2^(8·(L-1-i)), and mod 2^p-1 exponents reduce mod p; with gcd(8,p)=1 the p body positions hit p distinct residues, so flipping char j toggles exactly one bit. Set body = the bits of (-int(base_with_all-low-char)) mod M. Cost is entirely in parsing the source to extract M (~(6+~7)**67 = ~((-2)**67) = 2^67-1). (SekaiCTF26 oneline6ryp7o.)

  • [misc / LLM-editor API traffic = source oracle] a captured messages.log of Claude Code (or similar agent) API traffic is a full source-recovery vector: each v1/messages request body carries the ENTIRE conversation incl. every Write/Edit tool call, base64-wrapped — the LAST request has the complete history. Replay those filesystem ops to rebuild any file the model authored that session (here the stego extractor package), then run it. The embedded crypto can be unbreakable (HKDF/ChaCha20/keyed-Sbox/Feistel/Fisher-Yates LSB±1) — irrelevant, because the source leaked in the transcript. Watch for an rm/overwrite that drops an early prototype so it doesn't shadow the final package. (SekaiCTF26 impossible-stego.)

  • [game / remote-pty TUI bot] to automate a mouse-driven ncurses TUI over raw TCP: feed the ANSI stream into a pyte emulator (pyte.Screen+ByteStream) for a clean 2-D char grid, emit SGR-1006 mouse clicks (ESC[<0;col;rowM press + …m release), and pace response-driven via idle-socket drain (read until ~15ms silence) NOT fixed sleeps. For gravity match-3, a cascade simulator over KNOWN-only gems (refills=None/unknown) beats greedy largest-immediate-match by ~2+ score levels — pick the swap with the largest guaranteed chain, retry whole games to beat board RNG. (SekaiCTF26 Bejeweled — reach level 8 / score≥17500 in a 45s wall-clock → GAME CLEAR prints flag.)

  • [misc/pwn / Apryse PDFNet doc-converter 0day] "upload→PDFNet.Convert.toPdf→download" web apps are pwn-in-disguise: the win usually needs RCE (run an execute-only /readflag, capture stdout into the PDF), not file-read/XXE. RE intel: the native engine libPDFNetC.so (66MB, x86-64, canary+NX+PIC) is freely downloadable per-(version,node-ABI,arch) from downloads.apryse.com/downloads/nodejs/<ver>/pdfnet-addon-v<ver>-node-v<abi>-linux-<x64|arm64>.tar.gz — RE it offline without a key. But you CANNOT RUN conversion offline without a valid Apryse license: JS checkLicense only rejects empty keys, native initialize() rejects junk with "Bad License Key" (no demo/watermark mode in 11.x) → need a real trial key or the live instance to test. Designed exec (system/fork+execv) is HTML2PDF-module-only (/usr/local/apache-tomcat/bin/chrometron, html2pdf_chromium.so) — absent under base @pdftron/pdfnet-node + read-only FS + no-egress, so intended bug = mem-corruption in a builtin parser dispatched by file extension (EMF/JP2/TIFF/GIF/BMP/PNG/XPS/office/SVG; EMF & JP2/TIFF the cleanest). Harness gotcha: npm 11.16 blocks the @pdftron install script → npm ci leaves no native lib; inject the prebuilt lib/ yourself. (SekaiCTF26 pwnable document fabricator — recon/handoff, not solved.)

  • [web / Next.js edge-vs-node parser differentials] frameworks with a split edge-middleware + node-handler pipeline re-parse the SAME request in two engines that disagree — audit each HTTP primitive independently in both. Confirmed-exploitable trio in Next 16.2.9 (chained, no secret needed): (a) nxtP query-prefix: ?id=1&nxtPid=<x> — the middleware adapter's normalizeNextQueryParam strips the nxtP prefix and OVERRIDES the real key in edge searchParams, but getServerSideProps reads the raw URL → auth check sees <x>, data fetch sees 1; (b) duplicate cookie: edge cookies.get()=LAST, node req.cookies=FIRST → send ticket_uuid=<victim>; ticket_uuid=<mine>; (c) assetPrefix data-route decoupling: a matcher ['/'] built without assetPrefix awareness doesn't match /cdn/..., but the router strips /cdn AFTER the middleware decision → GET /cdn/_next/data/<buildId>/index.json serves the page past an edge gate. CVE-2025-29927 (x-middleware-subrequest) is PATCHED ≥15.2.3/16.x. QR decode on arm64: cv2 QRCodeDetector (×2 NEAREST upscale), NOT pyzbar (segfaults). (SekaiCTF26 Migurimental.)

  • [pwn / placement-new refcount-wrap UAF] a RingBuffer/circular queue that placement-news over raw aligned storage MUST slot->~T() before reuse — skipping the destructor silently leaks one shared_ptr strong-count decrement per overwrite. On a no-PIE target, drive the lost-decrement count to 0xFFFFFFFE then to 1 (re-queue a 2^20-slot ring from count 2) so a later destructor frees the managed object while a second owner still holds it → UAF; reclaim the freed chunk with a long rename-style heap groom, overwrite a forged vptr with win, dispatch through it. (GreyCat26 Finals cpp-bbq.)

  • [web / self-signed cert ≠ service down] a CTF live instance behind a self-signed/invalid TLS cert makes default clients (requests/httpx verify=True) throw SSL errors that READ like "connection refused / service down" — it is NOT down. ALWAYS disable TLS verification for challenge services: requests/httpx verify=False (+ urllib3 disable_warnings), urllib ssl._create_unverified_context(), raw socket/h2 check_hostname=False+CERT_NONE, curl -k. Confirm reachability with curl -sk -o /dev/null -w '%{http_code} ssl_verify=%{ssl_verify_result}' BEFORE concluding infra is down (ssl_verify=18 = self-signed; curl exit 60 = cert problem, server still answers HTTP 200). (GreyCat26 Finals shiny-notes — a solver burned attempts mis-reading cert failures as a dead remote.)

  • [crypto+web / composite-modulus EC check + dual-hash key oracle → server file R/W] an EC "password gate" Q==k·G on y²=x³+x mod n with a COMPOSITE n=p1·p2 (one factor smooth, e.g. p1+1) is breakable by Pohlig-Hellman/Williams p+1 to recover k=MD5(arg) WITHOUT the secret. If the real key is SHA256(arg) over the RAW string (not the recovered digest), the digest becomes a cheap PRE-FILTER ORACLE: crack the MD5 preimage with themed/hashcat-rule wordlists (here whalewhale), then decrypt the config. Then the server: a blacklist path filter that rejects literal .. still dies to ABSOLUTE paths + JSON-unicode-escaped ../ → arbitrary read/write via the app's own file endpoints; flag was in /app/app.js after the service's periodic restart (author-placed in source). Cloudflare edge blocks python-urllib client-shape → use curl/subprocess for live probes. (NHNC26 WhC2 v0.1 — solved via write-primitive steer off leaked server source.)

  • [crypto+infra / RadSec RFC7585 dynamic-discovery rogue home server + CA-key Coppersmith] a radsecproxy/FreeRADIUS roaming setup where the front FreeRADIUS releases the flag ONLY on a PROXIED Access-Accept (if &control:Proxy-To-Realm && reply==Access-Accept { Reply-Message := $ENV{CTF_FLAG} }) — a local/non-proxied accept yields nothing, so you must make the dynamic RadSec home-server lookup land on a server YOU control that returns Access-Accept. radsecproxy verifies the home-server TLS cert against the bundled CA, so recover the CA key first: gen_ca leaks s = p//2^508 → univariate Coppersmith (Howgrave-Graham deg-1, m=87 t=88, FLATTER/fpylll, ~4-bit margin X=2^508 vs n^0.25) → mint a home-server cert signed by it. NO VPS NEEDED: expose your laptop's RadSec server with a free bore TCP tunnel (bore local 2083 --to bore.pub → bore.pub:PORT; ngrok TCP needs a card, bore doesn't), point a realm you own at it via two DNS records — NAPTR "S" "aaa+auth:radius.tls.tcp" "" _radsec._tcp.<realm> + SRV _radsec._tcp.<realm> 0 0 <bore-port> bore.pub (Cloudflare supports NAPTR; set via API token). Trigger: EAP-Identity user@<realm> → FreeRADIUS:1812 (secret testing123) → proxied → radsecproxy discovers your realm → TLS to your server (cert trusted) → Access-Accept (RadSec shared secret radsec) → flag in Reply-Message. (NHNC26 TEARoam.)

  • [web/rev / self-referential header-cookie gate + UDP control-plane route bypass] a reverse-proxy that HTTP-denies /internal/* may expose an UNAUTHENTICATED UDP control plane (edge-httpd :5555) that registers a NEW path straight to the internal worker (seed packet → session key → keyed route packet → /randpath = courier:7000) — attack the control plane, not the HTTP deny-list. Then a CGI worker's host_body_chain_ok gate that demands a header whose ACCEPTED value is a hash of the request CONTAINING it (self-referential: mix64/tag32/keystream-tape-encoded body) is solvable by iterate-and-resubmit or Z3 bitvector-modelling the hash chain — both beat guessing. (NHNC26 I Love Proxy.)

  • [osint / building-ID via in-frame plaque] when a photo-OSINT task asks to identify a building/site (or its muralist/architect), TRANSCRIBE any in-frame plaque/signage/street sign FIRST — it usually pins the exact location far more reliably than reverse-image-searching the artwork/subject. (JuniorCrypt26 Fire Mural: plaque «Пожарная аварийно-спасательная часть №1» → Grodno Fire&Rescue Station No.1 → muralist Vladimir Kachan = flag.)

  • [misc / OOXML transient-revisionLog hidden flag] .docx/.xlsx/.pptx are ZIPs — unzip and inspect EVERY xml part, not just word/document.xml. An oversized customXml/item*.xml can hold a fake <revisionLog> of N edit steps whose <inserted>/<deleted> <chunk> fragments reconstruct the doc text at each step; the flag may exist ONLY at an intermediate step (e.g. step 20 of 100) before later edits morph it into innocuous cover text. Replay the chunks per revision and print every state. (JuniorCrypt26 Invisible Editor.)

  • [crypto / masked-small-seed LCG keystream] an LCG stream cipher (Numerical Recipes A=1664525 C=1013904223 mod 2^32, keystream byte = high 8 bits after each update) whose seed is MASKED to few bits (seed & 0xFFFFF = 20-bit) is trivially brute-forced: try all 2^k seeds, XOR-decrypt, keep the fully-printable plaintext. Themed hint ("the seed was too small") = the intended small-keyspace tell. (JuniorCrypt26 Aperture Science: Stream Calibration, seed 0x5a17c.)

  • [crypto / Franklin-Reiter related-message RSA] small public exponent (e=3) + TWO ciphertexts of an AFFINELY-related plaintext under the SAME modulus (c1=m^e, c2=(a·m+b)^e mod n, with a,b public) → recover m WITHOUT factoring: gcd(x^e − c1, (a·x+b)^e − c2) over Z/nZ collapses to a linear factor (x − m). Fingerprint = small e + a second ciphertext shipped with public constants a,b. (JuniorCrypt26 Aperture Science: Still Alive, e=3 a=1337.)

  • [misc/forensics / SVG (vector) hidden-layer stego] don't trust the rendered image — parse the SVG DOM for masks/clipPaths/unused <g> groups. Flag glyphs can be present as <path> outlines that are made invisible via an indirection chain (glyph paths → used only as a clipPath target inside a <g> that a full-canvas black <mask> rect hides). Extract those raw paths and re-paint them UNMASKED/unclipped to a PNG to reveal the text. (JuniorCrypt26 Ghost Layers: 39 hidden glyph paths behind mask mk9.)

  • [forensics / vanity-mined Git commit SHA-1 hidden message] a repo whose N commits each had their SHA-1 timestamp-ground to a chosen LEADING byte hides a message: one byte-column of the commit SHA-1s is improbably printable/consistent across all N independent commits. Check ALL 20 SHA-1 byte positions for a uniquely-consistent printable column (not just byte 0), order commits by their part index, read the column. (JuniorCrypt26 Philologist → grodno{1o9f1a9}.)

  • [rev / PyInstaller native-DLL hidden logic + static keystream replay] PyInstaller GUI apps (PyQt/etc.) often hide the real flag-check in a SIBLING native build/*.dll/*.so loaded via ctypes/cffi — enumerate EVERYTHING pyinstxtractor extracts, not just the decompiled .pyc. And if a reversing gate's "success" branch leads to a STATIC/precomputed decrypt (input-independent PRNG keystream over a fixed ciphertext in .rdata) rather than input-derived output, locate the ciphertext + replay the keystream — far easier than satisfying the gate. And when the author ships a "harder ++/REVENGE" rerun, RE-CHECK whether the same shortcut still applies before re-deriving from scratch — added gate complexity (extra channels/checks) is usually cosmetic, not a new attack surface. (JuniorCrypt26 WrongCube+ → grodno{5h4d0w_c0ntr0l_pl4n3_qu0rum_r3c0nc1l3d}; the ++ rerun WrongCube++ fell to the identical static-decrypt, gate untouched → grodno{wr0ngkub3pp_5p3ctr4l_qu0rum_0v3rdr1v3}.)

  • [misc/stego / frequency-domain (FFT) image watermark] when an image "looks too structured/perfect" but EVERY spatial-domain check is empty (metadata, LSB, trailing bytes, strings, AVIF/PNG box structure) → take the 2D FFT of the luma plane and inspect the MAGNITUDE spectrum for artificial rings / angular-sector symmetry (engineered watermarking, not natural texture). JuniorCrypt26 XAXA: 8 radial rings × 32 angular sectors, each bit = which of two angular sub-slots holds a spectral peak (binary angular-position modulation); brute phase offset + packing order/inversion/rotation, majority-vote valid grodno{...}. → grodno{G00dby3_Beavers0))}.

  • [osint / "who took this photo" via Google Maps 360° attribution] for a selfie/photo shot inside an identifiable business, geolocate the venue from signage/decor, open its Google Maps listing → Photos → Street View & 360°, and read the matching panorama's CONTRIBUTOR ATTRIBUTION — the credited name is often the deterministic flag (no face-matching). The challenge image is frequently just a different viewing angle of a public 360° panorama. (JuniorCrypt26 WhoAmI: Antique Co-Op OKC → Russell Rogers.)

  • [crypto / faulted-curve ECC (invalid j=0 sibling) → BSGS+HNP+LLL] when a supplied "standard curve" (e.g. secp256k1) public key/signature points FAIL the curve equation, solve for the b they DO satisfy on the same field prime before assuming an encoding bug. A single faulted b on a j=0 curve is CM-twist-enumerable (4p = t²+27m²) → recover the true generator (same G.x, shifted G.y) + curve order; if the order has a small factor (here 35-bit 20412485227), BSGS in that subgroup leaks each nonce mod that factor, and several signatures' residues feed a Hidden Number Problem solved via LLL/Babai (brute the 2^k sign-ambiguity) → private key → derive the AES-GCM vault key (SHA256(d)[:16]) → flag. (JuniorCrypt26 Ucucuga → grodno{suh@r1k1_3_k0r0chk1}; the nightmare+ rerun VeryUcucuga adds a split/muxed hi56/lo48 telemetry DECOY over the same leak — the subgroup HNP falls regardless, decoy irrelevant → grodno{nightmare_split_muxed_telemetry_still_falls_to_hnp}.)

  • [pwn / remote build ≠ handout — leak-and-pin] NEVER trust handout-derived absolute addresses OR fixed inter-function deltas on a remote pwn target: the instance is often a DIFFERENT build (handout PIE -O0 vs remote non-PIE optimized → different offsets AND different function sizes, so whisper→chorus delta was 0x35 not 0x59, standby→print_flag was 0x20 not 0x3e). Leak a nearby reference symbol LIVE each run, pin the target as leak+delta, and if the delta itself is build-specific, --brute a small window using the target's own output as the oracle (wrong addr → SIGSEGV/EOF, skip). Services FORK per-connection, so sequential brute is safe within one instance. Non-PIE remote → no leak even needed for the base. (JuniorCrypt26 Museum Of Echoes / Deep Port / Red Tide — all remote UUID flags.)

  • [web / batch-input command injection — validate-first-line-only] multi-line/bulk-input web forms (a targets textarea "one per line", CSV rows, batch job lists) frequently validate ONLY the first line/record for shell metacharacters, then loop over ALL lines to build shell commands — so line 1 is a clean valid value and line 2+ carries the injection. Always fuzz ;/|/$()/backticks at line ≥2, not just line 1, on any bulk form. (JuniorCrypt26 Pulse: targets=127.0.0.1\n127.0.0.1; cat /opt/diagnostics/jobs/*/flag.txt → RCE as www-data → grodno{...}.)

  • [pwn / fake-vtable hijack of a two-level virtual call] when the dispatch site is a REAL C++-style two-level indirect call (mov rax,[rdi]; call [rax] — call through obj->vptr->slot), a raw win-address written into vptr is INVALID (it derefs vptr as a table first). Instead stash the win-address in a writable, address-leaked scratch buffer (a fake vtable) and point vptr at THAT; if the exact slot offset is uncertain across handout-vs-remote builds, fill several plausible slots with the same target rather than betting on one. (JuniorCrypt26 House Of Mirage: fake vtable in a leaked memo buffer → win at PIE+0x3970.)

  • [osint / author-voice pivot to a third party] when the prompt is written in the AUTHOR's own voice about someone else ("we used to have a good X in our team… find where he works"), anchor the search on the AUTHOR's public graph FIRST (challenge author handle → their CTF team / community), then converge on the target person via multiple INDEPENDENT corroborating public facts (certs, competition placements, published research/CVEs) before reading off the requested attribute (employer/org). Don't start from the attribute. (JuniorCrypt26 Strongest Beaver: @hckerror → team Beavers0 → Artsem Kadushko/HerrLeStrate → Alfa Bank → grodno{Alfa_Bank}.)

  • [web / obscure black-box CMS -> pull the real upstream source; hand-rolled parser "last-value-wins" SSTI] when a source-less web target runs an OBSCURE/unknown stack, fingerprint it precisely (footer strings, error pages, cookie names, CGI paths) and DOWNLOAD the real upstream source before probing blind — it usually exists and turns hours of black-box guessing into a readable source audit. And watch hand-rolled header/config parsers whose loop-exit only fires on a field ABSENT in the attacker-reachable path: the resulting "last value wins" lets injected metadata silently override a security-relevant default. (JuniorCrypt26 Zakviel: Thalassa CMS v0.3.75 -> captcha free-retry OCR oracle -> stored-field header injection -> FilterChainMaker last-format-wins -> readfile macro arbitrary file read.)

  • [web / "win the whole game, then decode the reward" + JWT stateless game] a live game/API whose "final" endpoint returns something odd ("this isn't a flag... directions to them") is usually an INDIRECTION puzzle (coordinates/indices → letters of the state you already produced), not a broken forgery. Check the cheap JWT-forgery shortcuts first (alg:none, weak secret) but be ready to actually COMPLETE the task then decode. Stateless-JWT games often make invalid moves free (not in word list = no attempt cost) — exploit that to brute safely. (JuniorCrypt26 Wrodle: win all 50 Wordles → /finish coords WWL index letter L of solved word WW → grodno{emmagtsrow}.)

  • [crypto / QKD reconciliation-transcript GF(2) leak → PA rowspace-containment] a BB84/QKD challenge whose handout is the RECONCILIATION transcript (sift + Cascade live-error + calibration/probe masks) is broken by assembling those masks into ONE GF(2) linear system and solving for the reconciled key — then the privacy-amplification (PA) output is recoverable when the PA matrix rows lie in the achieved rowspace. KEY: a rank-DEFICIENT leak (here rank-216 < full) is NOT automatically safe — check whether the SPECIFIC downstream extraction vectors (PA rows) are still spanned before assuming the rank gap blocks you; recovered PA → replay the sibling's SHA-256 keystream construction → decrypt. (JuniorCrypt26 Aperture Science: Cake REVENGE, PA=8f11…a3, → grodno{7h3_c4k3_w45_n3v3r_1n_7h3_r37r03nc4bu1470r}.)

  • [ai / LLM rank-steganography (Calgacus / Norelli-Bronstein)] when a challenge pins an EXACT model/revision/quantization/runtime and hands you a "slightly wrong" LLM continuation, suspect rank-based LLM stego (arXiv:2510.20075), NOT arithmetic-coding stego. Decode: recompute per-token RANKS of the stego text under the COVER prompt's distribution, then REPLAY those ranks (pick the r-th most-likely token) against the SECRET-side distribution seeded with the flag prefix grodno{ → the hidden plaintext falls out. Rule this in only AFTER arithmetic-coding/bit-packing decoders yield pure noise (older scheme, needs precision/temp sync, not rank substitution). (JuniorCrypt26 Slop: Qwen2.5-0.5B-GGUF → grodno{stego_can_be_even_like_this}.)

  • [forensics / USB-MSC over unknown pcap linktype] an unrecognized pcap linktype (e.g. LINKTYPE_USER0) means Wireshark can't dissect it — parse the raw USB Bulk-Only Transport yourself (CBW magic USBC / CSW magic USBS, LUN+opcode in the CBW → SCSI READ/WRITE with LBA+len). On a rotation/rewrite scenario, reconstruct per-sector WRITE history (newest-write-wins per LBA), NOT a naive last-write-of-stream — the first carved flag is usually a planted DECOY. (Athena CTF 2026.)

  • [rev / angr path-explosion → recognise the primitive] open-ended angr on a stripped binary path-explodes/hangs; before symbolic-executing, scan for algebraic gates + NAMED PRNG/hash constants (LCG multiplier 0x5851f42d4c957f2d = PCG/xoshiro, FNV/MurmurHash primes) and solve the recurrence statically instead of brute exploration. (Athena CTF 2026.)

  • [crypto / small-e RSA + obfuscated exponent] small e (3/5/7) + short/unpadded message → try gmpy2.iroot(c, e) FIRST (plain e-th root, no modulus). Obfuscated handouts bury the real exponent — Unicode-digit disguise (e.g. Arabic-Indic ٣ = 3) — among DECOY ciphertexts/moduli; normalize digits before trusting the parsed e. (Athena CTF 2026.)

  • [forensics / multi-row hexdump decoy magic] when a hexdump/challenge presents multiple rows per page/block, check for DECOY magic bytes (deadbeef / faceb00c) in the non-fragment rows before assuming a whole-block ciphertext — a naive full-block XOR derails partway through. Only the real fragment rows carry payload. (Athena CTF 2026.)

  • [rev / OT "firmware" imm64 string tables] secrets baked as movabs imm64 stack tables + a repeating-key XOR+rotate (key plaintext in-binary) beat naive strings: when strings finds nothing but a deobf routine sits near main, dump the immediate-operand string tables (the constants ARE the data). (Athena CTF 2026.)

  • [rev / Android reflective-call is still static] a reflectively-invoked method (name array-decoded at runtime) is still statically PRESENT in the dex — trace forward from Cipher/MessageDigest usage. static-final key/IV/ciphertext ⇒ fully OFFLINE decrypt, never run the app. (Athena CTF 2026.)

  • [crypto / shared-d RSA lattice (Guo/Hinek)] a common private exponent d across several full-size (e_i, n_i) → Guo/Hinek 4×4 lattice: rows [M, e1, e2, e3] with diag(−n_i), LLL, then d = row[0] / M. Verify by cross-instance decrypt AGREEMENT, not s=isqrt(n)-style prime filters. (Athena CTF 2026.)

  • [rev / time-gate / PoW loop → patch, don't grind] if a grind/PoW loop's compared value is DEAD after the branch (flag built from a separate static key), patch the loop counter + NOP the gate jne instead of computing/brute-forcing the grind. Check whether the gate output feeds the flag at all before spending cycles on it. (Athena CTF 2026.)

  • [video-OSINT / yt-dlp format ceiling is self-inflicted] a forced player-client override (--extractor-args youtube:player_client=android) SILENTLY CAPS the exposed format ladder far below the true stream — it looks like DRM or a low-res source. Always probe with a plain yt-dlp -F (no extractor-args) before treating a resolution as an evidence ceiling. The usual root cause of the "video not available" error people work around this way is no JavaScript runtime installed: fix it with --js-runtimes node, not a client override. In DIVER OSINT 2026 this capped five challenges (4K read as 540p, 1080p as 360p), directly determined one solve, and left a FALSE "divided carriageway" feature in a challenge README that was used as a search filter for seven attempts. Corollary: purge stale capability claims from challenge notes — an inherited "X is impossible/blocked" line must be re-tested before it is allowed to close a lane. (DIVER OSINT CTF 2026.)

  • [OSINT / prove provenance by scan-stream bytes, not by eye] when a handout image's metadata is stripped, hash the JPEG's post-SOS scan stream (not the whole file, not a perceptual score) against candidate originals: byte-identity proves the handout IS a re-wrap of that source, which then licenses using the SOURCE's metadata as authoritative. Visual similarity never licenses that step. (DIVER OSINT CTF 2026, nui — handout matched a NASA Artemis II frame.)

  • [OSINT / a single-family OCR reading is a hallucination until corroborated] multi-engine OCR's deliverable is the disagreement, never any one engine's string. On DIVER OSINT 2026 kaitai1, manga-ocr returned three fluent, grammatical, entirely FABRICATED Japanese sentences on three crops that contain no text at all; tesseract and apple-vision both returned no-text, so ocr-ladder scored them contested / families=1 and exit 3. A single-reader setup would have handed the next attempt three invented strings to search — unfalsifiable, and indistinguishable from a real read. Treat single-reader/single-family as uncorroborated and NOT actionable, especially for generative-decoder OCR (manga-ocr, trocr), which cannot emit "no text" and so always invents something. (DIVER OSINT CTF 2026.)

  • [env] zsh runs with nomatch ON: an unquoted ?/*/[ in ANY argument (a gh api path, a URL, grep --include=*.md) aborts the command with no matches found before it runs — always single-quote. Recurs constantly; the gh-specific set lives in docs/agents/issue-tracker.md §Gotchas. (issue #27)

  • [env] cmd | python3 - <<'EOF' is a stdin COLLISION: the heredoc wins, the pipe is silently dropped, and the piped JSON is parsed as SOURCE (NameError: name 'true' is not defined). Pipe to jq, pass code via python3 -c, or write the program to a temp file. (issue #33)

  • [geoint / register map FIGURES against imagery — and treat rotation as a CHECK, not a free parameter] an accident/site report with no coordinates can still be geolocated: a scale-barred, north-arrowed site plan is a metric document, so its line pixels can be template-registered against satellite edge magnitude over translation x rotation x scale. For two north-up sources, rotation=0 is a hard physical check — a fit that prefers nonzero rotation has usually locked onto label text rather than geometry (an earlier pass's edge correlation wanted 7–8° and was wrong). Three further traps, all hit: (a) re-measure the scale bar before trusting anything downstream — one misread tick row (11.85 vs the true 12.45 px/m) cost an entire pass and only the corrected value made the figure internally consistent with the report's own distances to 3 %; (b) a graphic marker on a report figure may be a ~90 m LABEL, not a position — the previously burned pin was exactly that star; (c) benchmark a chamfer/RMS residual against random offsets before quoting it as confidence — against a dense edge map it scored only ~1.2σ better than 30 random ±200 m offsets, i.e. near-worthless, and the honest metrics were the correlation z-margin and the ±5 m model-variant spread. (DIVER OSINT CTF 2026, conflicted — JTSB report → map-pin 36.53168,140.22992.)