derekwei.xyz

~/ctf

CTF writeups

Offensive-security methodology from Capture the Flag competitions, written to learn in public: reasoning and approach over flag spoilers. Each competition has its own page with results, context, and writeups by category.

Index

Competitions

Pick an event for its results, format, team, and per-challenge writeups.

Background

What is a CTF?

A Capture the Flag (CTF) is a legal, sanctioned competition where players solve security challenges to recover hidden tokens called flags. Everything runs against infrastructure the organizers set up for exactly that purpose, so it is a safe way to practice offensive techniques without touching real systems.

These writeups follow a red-team learning approach: enumerate, form a hypothesis, test it, and document what worked and what did not. They describe only authorized practice. There are no live flags, no unauthorized targets, and no guidance for acting against systems you do not own or have explicit permission to test. Each one ends with a short takeaway: the vulnerability, why the exploit worked, and what carries over to real engagements.

Method

How I structure a writeup

Longer writeups follow this outline in full. Short challenge notes keep the challenge, the approach and the takeaway, which is enough to follow a quick solve.

  1. 01Challenge, event, category, and difficulty
  2. 02Goal and initial observations
  3. 03Enumeration and recon
  4. 04Failed attempts (the useful part)
  5. 05Breakthrough and solution summary
  6. 06Takeaway: why it worked and what transfers
  7. 07Tools used and lessons learned