Sql Map1
Using sqlmap to dump credentials from a vulnerable endpoint, then logging in with cracked credent...
cat /team/readme.md
MergesortFries
CTF team writeups, exploits, and solutions. We break things, learn stuff, document everything.
picoCTF 2026
Active
14 writeups
categories
Web
XSS, SQLi, SSRF, auth bypass, session forgery
Crypto
Cipher breaks, RSA attacks, hash collisions
Pwn
Buffer overflows, ROP chains, heap exploitation
Rev
Binary analysis, disassembly, deobfuscation
Forensics
Disk images, memory dumps, network captures, steganography
Misc
General skills, encoding, OSINT, and everything else
picoCTF 2026
All writeups from picoCTF 2026
latest writeups
-
→
-
Small TroubleWiener's attack on RSA — recovering a 256-bit private exponent from a 2095-bit modulus using cont...→
-
Shift RegistersBreaking an LFSR-based stream cipher with a 126-byte key that gets immediately masked to 8 bits —...→
-
Secure Password DatabaseHeartbleed-style memory leak in a binary — leaking a secret from adjacent heap memory, then recov...→
-
Rogue TowerIdentifying a rogue cell tower from captured network traffic and decrypting its exfiltrated data.→
-
Related MessagesFranklin-Reiter related message attack on RSA — exploiting two ciphertexts encrypted under the sa...→
-
Old SessionsForging a Flask client-side session token to escalate privileges to admin.→
-
No FACracking an unsalted password hash and brute-forcing an OTP with no rate limiter to bypass 2FA.→
-
MultiCodeA string encoded through four nested layers — Base64, Hex, URL encoding, and ROT13. CyberChef Mag...→
-
HashgateCredentials leaked in HTML source, profile URLs use MD5-hashed numeric IDs — brute force the admi...→
-
Forensics Git 1Recovering deleted data from a Git repository's object store inside a disk image.→
-
ClusterRSAMulti-prime RSA with four factors — factoring n via factordb then computing phi from all four pri...→
-
Binary DigitsExtracting hidden data encoded in binary from an image or file.→
-
Not TRUeLattice attack on NTRU — recovering the private key (f, g) from the public key h using LLL reduct...→