CTF Challenge Solver

A pattern catalog for Capture The Flag challenges — reverse engineering, steganography, forensics, cryptography, web exploitation, OSINT, and blockchain. Each section is a recipe: detect the pattern, apply the technique, recover the flag.

Workflow

1. Identify the category: reverse, crypto, web, forensics, steganography, binary, OSINT, misc
2. Triage with direct tools: terminal, browser, Python for quick solves (encoding, simple crypto, web inspection)
3. Pivot fast on failure: after 3 wrong flag submissions on the same approach, switch attack vectors entirely — do not iterate small variations of a failing technique
4. Validate before submitting: confirm the flag format matches the challenge's stated pattern before submission

Direct Tools (Tier 1)

Flag Format Detection

Always check the flag format first. Common formats:

• SiberVatan{...}, SIBERVATAN{...}, sibervatan{...}
• CTF{...}, flag{...}, FLAG{...}

Grep is your first tool: grep -roP '[A-Za-z]*[Vv]atan?{[^}]+}' ./

Reverse Engineering

For YARA rules or math-based reverse engineering problems:

1. Parse the condition as a series of byte-level equations: ((byte[i] OP1 val1) OP2 val2) == result
2. Apply inverse operations in reverse order:
   • (x + a) ^ b == c → x = (c ^ b) - a
   • (x - a) ^ b == c → x = (c ^ b) + a
   • (x ^ a) + b == c → x = (c - b) ^ a
3. Convert result bytes to ASCII string

Steganography

For PNG/images with hidden data:

• Check metadata: identify -verbose image.png | grep -i flag
• Check IEND trailer: xxd image.png | tail
• LSB steganography: extract LSB from each pixel's R/G/B/A channel

  bits = [pixel[ch] & 1 for row in arr for pixel in row]
  bytes_arr = bytes(sum(bits[i+j] << (7-j) for j in range(8)) for i in range(0, len(bits)-7, 8))
  text = bytes_arr.decode('latin-1')
  

• Try all channels (0=R, 1=G, 2=B, 3=A)

Hash Cracking

For brute-force style problems:

• Identify hash type by length (MD5=32 hex, SHA1=40, SHA256=64)
• Identify token format from problem description
• Use Python itertools: itertools.product(string.ascii_lowercase, repeat=4)
• 2-stage hashing: chain hash outputs as binary inputs to next stage
• Always use hashlib.md5(token.encode()).digest() (binary) not .hexdigest() for stage chaining

Encoding Detection

Auto-detect common encodings:

• Base64: contains only [A-Za-z0-9+/=], length is multiple of 4
• Hex: only [0-9a-fA-F\s], decode with bytes.fromhex()
• Binary: only [01\s]
• ASCII codes: space-separated numbers 68 97 121

Web Challenges

• Browser tools: view-source, network tab, cookies, storage
• curl: check headers, API responses, follow redirects with -L
• For hidden parameters: try common ones (admin, flag, secret, token)

Multi-Stage Web Game (Yavuzkraft Pattern)

Minecraft-themed or quest-based web games with resource gathering and multiple stages:

Game Flow:

1. Login with captcha → overworld.php (redirect target)
2. Gather resources by POSTing to /overworld.php with action name
3. Each resource stage requires accumulating units (click buttons 5x each)
4. Special passwords required for advanced resources
5. Progress through: Overworld → Nether → End stages
6. /flag.php is the ultimate target, returns 302 if game incomplete

CRITICAL: URL distinction

• Login POST goes to / (index.php) with oyuncu_adi + captcha_cevap
• On success, 302 redirects to /overworld.php — this is where ALL game actions happen
• Game-action POSTs go to /overworld.php, NOT back to /
• Posting game actions to / triggers a re-login with captcha check, breaking the session flow
• Always use allow_redirects=True or follow the Location header

Resource gathering:

for _ in range(5):
    s.post(OVERWORLD_URL, data={"odun_topla": "1"})  # NOT base URL!

Stage tracking:

• Inventory shows counts: Odun, Taş, Demir, Elmas, Obsidyen
• Each stage requires 5 of previous resource to unlock
• Buttons show disabled class until requirements met
• Game actions use simple button names in POST data: odun_topla, tas_topla, demir_topla, elmas_topla, obsidyen_topla, nether_portal

Special password format discovery:

• The HTML reveals the password pattern in pattern attribute: ^!Y[a-z]{6}r\d{3}$
• Format: !Y + 6 lowercase letters + r + 3 digits
• Common Turkish 6-letter words work: "madeni" → !Ymadenir000
• Try Minecraft-themed words first: madeni (mineshaft), elmas, yavuz, kraft, gizli, sifre, oyuncu
• Brute-force approach: for each word, try 000-999 (1000 combos per word)

Stage advancement:

s.post(OW, data={"elmas_sifre": "!Ymadenir000", "elmas_topla": "1"})  # 10 elmas
s.post(OW, data={"obsidyen_topla": "1"})                                # 10 obsidyen
s.post(OW, data={"nether_portal": "1"})                                 # to Nether

SVG / Pixel-Art Captcha Recognition

CTF web challenges sometimes use SVG-based pixel art captchas (e.g., Minecraft-style block font). Each number is an inline <img> with a data:image/svg+xml;base64,... source.

Recognition technique:

1. Extract the base64 from each SVG image's src attribute
2. Decode and parse the SVG for fill="#f0f0f0" (white pixel) path elements
3. Each path Mx y Hw Vh Z defines a filled rectangle — these are the visible pixels
4. Build a 64×64 grid marking which cells are filled
5. Determine which quadrants are filled (top-left, top-right, bottom-left, bottom-right, middle)
6. Recognize the digit based on the quadrant pattern:
   • All 4 quadrants + middle = 8
   • All 4 quadrants, no middle = 0
   • Top-right + bottom-right + middle = 3
   • Top-right + bottom-right only = 7
   • Top-left + bottom-left + middle = 2 or 5 (check right side)
   • Top-left + top-right + bottom-left = 9
7. Operator: + = 2 rectangles (horizontal + vertical), - or × = other
8. Compute the result and submit

When recognition fails: Brute-force all 100-200 arithmetic combinations (0-9, + - *). Each wrong answer returns an error message — session persists so you can retry quickly.

Hidden Elements & Base64 Extraction

HTML elements with style="display: none;" or hidden attributes often contain base64-encoded URLs or clues. CSS comments (/* ... */) are also common hiding spots. Always scan both — across ALL pages and ALL static assets (CSS, JS, PHP, HTML):

curl -s "URL" | grep -oP '[A-Za-z0-9+/]{30,}={0,2}'
# Then decode each:
echo "BASE64_STRING" | base64 -d 2>/dev/null

Key locations to scan: index page, login page, admin page, every JS file, every CSS file. Do NOT stop after one page — the chain may span multiple.

robots.txt Enumeration

Check /robots.txt first — Disallow directives reveal hidden endpoints (/admin.php, /login.php). Always check these discovered paths immediately.

JavaScript-Based Auth (AJAX/API Login)

Modern CTF web apps use JavaScript fetch() instead of HTML form submits, making direct form POST fail (404).

1. Check /js/app.js or inline <script> tags for fetch() calls — the actual endpoint is typically /api/login, /api/register, etc.
2. The content type is application/json, not form-urlencoded
3. Request body is JSON.stringify({username, password, captcha})
4. Captcha is fetched from /api/captcha (returns JSON {"question":"123 + 456"})
5. Captcha answer changes on every request — use a session (requests.Session) to keep cookies
6. The onclick attribute on the submit button may show an alert but the backend endpoint still works when hit directly
7. After login, profile API (/api/profile) shows isAdmin field — target this for privilege escalation
8. Profile PATCH endpoint (/api/profile with PATCH, JSON {"email":"..."}) may be vulnerable to NoSQL injection
9. UNION-based SQLi may not work because the field is used in an UPDATE query, not SELECT — but the email value IS reflected back in the response, confirming injection point

NoSQL Injection (Express.js + MongoDB)

For challenges running Express.js (x-powered-by: Express) with MongoDB:

Profile escalation pattern: PATCH endpoints often use $set: req.body — extra fields pass through:

{"email": "test@test.com", "isAdmin": true}

Other fields to try: "role", "is_admin", "user_level", "permissions", "__v", "admin".

Login/Register NoSQL injection:

• Login: {"username": {"$gt": ""}, "password": {"$gt": ""}} — but may be blocked by input validation
• Register with extra fields: {"username":"x","password":"Test1234!","isAdmin":true} — backend may silently ignore unknown fields

MongoDB regex/$where rejection: Backend email validation will reject object-type values for email. Stick to flat JSON field injection.

OTP/2FA Bypass Via Debug Header

When a 2FA verification page is encountered:

1. Check for a /otp.php endpoint (old deployment artifact — look for <!-- TODO: remove debug before production --> comments in HTML)
2. With an active session cookie (PHPSESSID), accessing /otp.php returns a debug response header x-debug-otp containing MD5 hash of the OTP
3. The hash is of a 6-digit numeric code (000000-999999) — crack with Python:

   import hashlib
   target = "hash_from_x-debug-otp"
   for i in range(1000000):
       if hashlib.md5(f"{i:06d}".encode()).hexdigest() == target:
           print(f"OTP: {i:06d}")
   

4. Submit the cracked OTP to verify_action.php via POST: otp=312888
5. On success, access the dashboard/flag page

Cookie is key: /otp.php requires an active session. Without cookies, it 302-redirects to login. With cookies, it returns the debug header AND the 2FA page simultaneously.

Origin Header Bypass

Some admin panels check Origin header for CSRF-like protection. Send Origin: https://same-domain.zone with the POST to bypass:

curl -s -X POST "https://site/admin.php" \
  -H "Origin: https://site.hacker.zone" \
  -d "action=get_secret_recipe" \
  -L  # follow redirect

This works when the server uses same-origin checks but doesn't validate sessions. Without the header, the server 302-redirects to login. With it, the POST succeeds and returns the protected content.

Chained YouTube Puzzles (Kulaktan Kulağa Pattern)

Hidden base64 YouTube links can appear in MULTIPLE locations across the same site:

• index.html in <h3 style="display:none"> elements
• Secondary pages (login.php) in <p style="display:none"> elements
• Static assets (style.css) in /* CSS comments */

Workflow:

1. Extract all base64 strings from ALL pages and assets
2. Decode each to get YouTube URLs — the pp query parameter contains a base64 search term
3. Follow the chain of videos — the final video or a page in the chain reveals admin credentials or AES keys in HTML comments
4. POST to admin endpoint with Origin: <same-domain> header
5. Decrypt the returned base64 ciphertext with AES-256-CBC

AES-256-CBC Decryption (Known Key/IV)

from Crypto.Cipher import AES
import base64

key = b"your_32_byte_key_here"  # 32 bytes for AES-256
iv = b"1234567890123456"        # 16 bytes IV
enc = base64.b64decode("base64_ciphertext")

cipher = AES.new(key, AES.MODE_CBC, iv)
dec = cipher.decrypt(enc)
pad = dec[-1]
flag = dec[:-pad].decode('utf-8')

Chained Multi-Page Hidden Base64 (YouTube Puzzle Pattern)

Multiple hidden base64 strings across DIFFERENT pages form a chain that must be traversed sequentially:

1. Index page: <tag style="display:none">base64</tag> → decodes to YouTube link
2. Login page: Same pattern → different YouTube link
3. CSS file: /* CSS comment with base64 */ → third YouTube link (often a Shorts video)

The search terms in the YouTube URLs (pp parameter, base64-decoded) correlate to the page's context/login credentials. Eventually, one of the accessed pages' HTML comments reveals an AES encryption key and IV.

Always scan ALL pages and ALL static assets in sequence — don't stop at the first find.

CSS/JS Comment Scanning

Always check static assets (style.css, app.js, main.js) for:

• CSS comments /* ... */ containing base64 data, URLs, or credentials
• JavaScript comments // TODO, /* TODO */ with debug endpoints, keys, or credentials
• CSS class names that reveal hidden page structure (e.g., .flag-box, .flag-container)
• JavaScript variables or config objects that may contain API endpoints, tokens, or flags

Admin Panel Bypass (Disabled Login Form)

When login forms are disabled client-side (onclick="alert('bakımda')"):

• The backend POST endpoint may still work when hit directly via curl
• Try default credentials (admin/admin, yavuz/yavuz, kafe/kafe)
• SQL injection in POST body
• IP spoofing headers (X-Forwarded-For: 127.0.0.1)
• Referer header manipulation

Blockchain / EVM Transaction Analysis

For challenges involving blockchain transactions (BNB Chain, Ethereum, etc.):

When explorer sites are bot-blocked:

• BSCScan, Etherscan, and similar use Cloudflare — try browser_navigate with user-agent spoofing
• Alternative explorers: explorer.bnbchain.org, debank.com, oklink.com
• Public RPC endpoints bypass browser entirely:

  curl -s -X POST "https://bsc-dataseed.binance.org/" \
    -H "Content-Type: application/json" \
    -d '{"jsonrpc":"2.0","method":"eth_getTransactionCount","params":["0xADDRESS","latest"],"id":1}'
  

  Response 0x3 = 3 transactions (nonces 0, 1, 2)

Transaction search via RPC (when tx hash unknown):

• eth_getBlockByNumber with "latest" returns recent block's tx list
• Compare from/to addresses in each transaction to find target wallet
• For historical transactions (old nonces), you need the block number — impossible without an indexer (BSCScan)
• Fallback: search the address on search engines — someone may have shared a tx link

Transaction input data decoding:

• Hex in tx.input field — common hiding spot for flags/messages
• Strip 0x prefix and decode as ASCII:

  bytes.fromhex(tx_input[2:]).decode('utf-8', errors='replace')
  

SSTV (Slow Scan Television) Signal Analysis

Radio-based CTF challenges involving .wav audio files that decode to images:

Detection indicators:

• WAV file ~7.5 seconds = Scottie 1 format (7.1s = Martin M1)
• Frequency analysis shows bands in 1200-2300 Hz range
• Sync pulse at 1200 Hz, black level at 1500 Hz, white at 2300 Hz
• The dominant frequency (e.g. 107 Hz) is ambient/DC noise — ignore it
• Check the spectrogram for the actual signal in the 800-2800 Hz band

Challenges with decoding:

• qsstv and fldigi are the standard tools but BOTH require a GUI/display
• pysstv (Python) is encode-only — no decode support
• No Python SSTV decoder is available on PyPI
• Custom implementation from scratch requires implementing the Scottie 1 protocol: 9ms sync + 1.5ms channel sync + 1.5ms porch + 138.24ms × 3 (G, B, R) per line, ~18 lines total

Fallback strategies:

• Upload WAV to an online SSTV decoder service (if browser works)
• Try calling qsstv with Xvfb (virtual framebuffer): xvfb-run qsstv
• The decoded image typically contains the flag as text overlaid on the image
• if all else fails and you know the format (Scottie 1), attempt a brute-force pixel decode: the frequency at each 138ms block maps to a grayscale value (1500Hz=black, 2300Hz=white)

For people/organization research:

Try multiple search engines: Google blocks automated queries (bot detection CAPTCHA). Fallback options:

• DuckDuckGo (lite/html modes also blocked by CAPTCHA)
• Bing (least aggressive bot detection)
• Yandex (heavy CAPTCHA)
• Direct API calls (GitHub API, etc.)

Social media research:

• LinkedIn: public profiles require login → check Google cache first, site:linkedin.com/in "Name"
• Twitter/X: login wall since 2024
• GitHub: API-first, works without login for public repos
• Instagram/Facebook: login required

When browser search is blocked:

• Use curl with proper User-Agent headers (Mozilla/5.0 ...)
• Try Google cache: webcache.googleusercontent.com/search?q=cache:URL
• Use programmatic APIs (GitHub API, etc.) which don't require browser
• Try whois/domain lookups for website research

Flag location patterns:

• LinkedIn profile headline/summary/about section
• GitHub README or profile bio
• Personal website/blog posts
• Social media posts with specific hashtags
• Numeric clues in profiles (follower count, profile IDs, post numbers)

When all search fails:

• Consider that the flag might be derived from the numeric/text clues themselves
• Common patterns: SiberVatan{150}, SiberVatan{kisi_adi}, SiberVatan{sayisal_deger}
• Initials as ASCII sum: A person's initials (e.g., "Kemal Kahramanoğlu" = KK) can sum to a numeric clue (K=75, K=75 → 150). The initials appended or the sum itself may be the flag or a clue.
• If a number (like "150") appears in the challenge but no direct match is found, check if it's the sum of ASCII values of related words/names

Sub-Agent Escalation (Tier 2)

For medium-complexity challenges (multi-step crypto, coded reverse, chained pattern search) delegate to a sub-agent:

fetih -p "challenge description and files to analyze"

Print mode (-p) is non-interactive and exits when done. Useful when the parent agent wants to fan out file-system grep / search / pattern-matching work without polluting its own context.

When to delegate

• Multi-step problems requiring tool chaining
• File-system heavy work (mass extract, search across many files)
• Encoding / simple-crypto puzzles that just need iteration
• When the parent agent's context is getting noisy and a clean sub-context will help

Strategy

1. Analyze the challenge, identify the approach
2. Formulate the sub-agent query with explicit instructions and the file paths to analyze
3. Sub-agent executes the query and returns results
4. Parent validates the flag against the stated format before submission

External LLM Escalation (Tier 3)

For hard problems where 3+ direct attempts failed (complex cryptography, binary exploitation / ROP chains, advanced reverse engineering), escalate to an external LLM (e.g. claude -p "..."). Treat the third failed flag submission as a hard pivot trigger: switch attack vector, switch tool chain, or hand off to a different model with a fresh context — do not keep banging on the same approach.

File Management

• Use a dedicated working directory per competition: ~/Desktop/<competition>/
• Extract all zips and organize by challenge
• Save found flags to flag.txt in the directory
• Clean up downloaded models/tools after the competition

Common Pitfalls

• Flag format changes mid-competition: Check each challenge's stated format (SIBERVATAN{} vs SiberVatan{})
• Hash pipeline ordering: 2-stage hashing — the output of stage 1 (binary .digest()) enters stage 2, not the hex string. Order matters!
• Brute force range: 45M combinations (26⁴ × 10²) = ~1M/s in Python → ~45 seconds for full scan
• Stego file size: Tiny PNGs (~4KB) are suspicious — check metadata, trailer, LSB
• MFT/forensics: File records in MFT give timestamps, filenames, and parent directory references
• Supply chain attacks: Python setup.py files can contain obfuscated payload — check sys.call_tracing or base64-encoded exec
• Sample rate confusion: When outputting TTS/audio, verify sample rate matches model native rate. Supertonic outputs at 44100Hz — writing to 24000Hz makes audio play 1.83x slower and deeper.
• Multi-stage web games: Some challenges require completing a multi-step game (resource gathering, passwords, portal navigation). The flag is NOT in the challenge description HTML but at a dedicated endpoint (/flag.php) only accessible after completing all game stages. Don't waste time trying to find the flag in challenge pages — progress the game.
• Game session confusion: Login POST goes to index.php (root), but the game page is at /overworld.php (a 302 redirect target). If you keep hitting the login page, check your redirect handling. Resource-gathering POSTs go to /overworld.php, NOT the root URL. If you POST a resource action to the root, the server treats it as a new login attempt and asks for captcha again.
• SVG captcha brute-force: 100 combinations max (10×10), each taking ~1s with session overhead. Total ~100s worst case. Optimize by guessing common operations first (+, *). Session cookies MUST persist across attempts.
• Elmas şifresi pattern: !Y + 6 lowercase letters + r + 3 digits. Common Turkish 6-letter words work: "madeni" (mineshaft) → !Ymadenir000. Try relevant Minecraft-themed words first.

Proof of Work (PoW) Authentication Bypass\n\nSome CTF web challenges (like "Bartzabel") require solving a Proof of Work puzzle before login/register.\n\nDetection: Check login page HTML for hidden inputs like powNonce, powSolution, powSig, powExpires, powDifficulty. These indicate JavaScript-generated PoW.\n\nWorkflow:\n1. Fetch the PoW challenge from the API:\n python\n ch = s.get(f\"{BASE}/api/pow/challenge\").json()\n # Returns: {nonce, sig, expires, difficulty}\n \n2. Solve SHA-256 hash puzzle:\n python\n import hashlib\n prefix = '0' * ch['difficulty'] # e.g., \"0000\" for difficulty=4\n n = 0\n while True:\n h = hashlib.sha256(f\"{ch['nonce']}{n}\".encode()).hexdigest()\n if h.startswith(prefix): break\n n += 1\n \n3. Submit with all PoW fields in the POST:\n python\n s.post(url, data={\n \"username\": \"...\",\n \"password\": \"...\",\n \"powNonce\": ch['nonce'],\n \"powSolution\": str(n),\n \"powSig\": ch['sig'],\n \"powExpires\": ch['expires'],\n \"powDifficulty\": str(ch['difficulty'])\n })\n \n\nPoW difficulty estimation: difficulty=4 (~50K hashes, <1s), difficulty=5 (~500K, ~5s), difficulty=6 (~5M, ~30s).\n\nPitfalls:\n- PoW is needed for BOTH register AND login — each requires its own fresh challenge\n- The PoW API endpoint is /api/pow/challenge — NOT on the HTML page\n- Hidden input value attributes are EMPTY in HTML; they're filled by JS after PoW solves\n- The sig field comes from the API, NOT computed client-side\n\n#### NPort 5110 / IoT Device Default Credentials\n\nWhen encountering an "Akıllı Ev Sistemi" (Smart Home System) or any page mentioning "NPort 5110" or "Moxa":\n1. Check the HTML meta tags — NPort 5110 Web Console is a dead giveaway\n2. Look for the user:user credential hint — often displayed in an alert or secondary text\n3. The captcha is a simple inline SVG math problem (e.g., <text>5 + 6 = ?</text>) — parse directly\n4. Default credentials: user:user with random arithmetic captcha\n5. After login, you get an IoT device management dashboard with:\n - Device list (lamps, AC, TV, etc.)\n - REST API: POST /api/v1/device/status/control with JSON body {\"device_id\": X, \"status\": \"on/off\"}\n - Device add/delete via ?delete=X parameter\n\nVulnerability exploitation:\n- ?delete=X parameter may be SQL injectable — test with ?delete=1 AND 1=1 vs ?delete=1 AND 1=2 (boolean-based blind SQLi)\n- API endpoint expects proper JSON — passing raw text returns "Cihaz bulunamadı"\n- SQL injection may return 500 errors due to syntax — adjust comment syntax (-- , #, /*)\n\n### Reference Walkthroughs (in skill directory)

• references/yavuzkraft-walkthrough.md — Minecraft-themed web game with SVG captcha, resource gathering, multi-stage portal navigation
• references/kulaktan-kulaga-walkthrough.md — Chained YouTube puzzle with hidden base64, AES-256-CBC decryption, Origin header bypass
• references/yara-reverse-engineering.md — YARA rule reverse engineering: byte-by-byte math unrolling
• references/ghostknock-apk-analysis.md — Android APK reverse with native .so library JNI calls
• references/trust-the-code-walkthrough.md — OTP/2FA bypass via debug endpoint and MD5 hash cracking
• references/sewer-pollutants-walkthrough.md — NoSQL injection in Express.js + MongoDB, mass assignment for privilege escalation
• references/0xsimsar-blockchain-analysis.md — BNB Chain transaction analysis via public RPC
• references/hash-cracking-pipeline.md — 2-stage hashing pipeline brute-force
• references/ying-yang-pcap-analysis.md — PCAP HTTP body extraction, trap message chains, base64 decoding

<!-- ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih Yetkisiz kullanim/kopyalama tespit edilebilir. hash: 9859e8b3e4235ecc -->