7 challenges I authored · 11 solved writeups — github.com/VariableThe
An MP3 file that is actually an MP4 video underneath. Viewing its video frames reveals a frame of black and white pixels representing binary data.
An OSINT/Forensics hunt starting from Discord and Twitter ('X') clues pointing to the Tower of Babel, leading directly into the virtual Library of Babel using a custom Hex bookmark name.
A .wav audio file containing LSB steganography (wavesteg), paired with a hint about Italy's country code (+39) indicating the exact bit/byte length needed for extraction.
An image (new_q4.png) that appears blank, paired with a Cisco Packet Tracer file as a hint. The question text provides three RGB values — those are the font colors of text hidden directly inside the image.
A PNG file (popcorn.png) with a flag hidden in its EXIF comment field. The intended solve is a single exiftool command.
Two images of Russian nesting dolls (doll.jpg and mat_doll.jpg). The theme is literal — one image contains a hidden archive inside itself, which in turn contains another image.
The question gives two binary numbers (1010011001 = 665, 10000011 = 131) and asks 'where does the light of a candle not reach?'. A candle image is attached. The answer is steghide with no password.
RSA with e=3 and no padding. The plaintext cubed is smaller than the modulus, so the ciphertext is just M³ in plain integers — no modular wrapping occurs.
RSA with a small private exponent d. Wiener's theorem says that if d < ⅓·N^(1/4), the continued fraction expansion of e/N leaks d.
A monoalphabetic substitution cipher without the key. Frequency analysis combined with the known flag prefix picoCTF{...} is enough to reconstruct the full alphabet mapping.
Every 3-character block has its third character moved to the front: ABC → CAB. Reversing it restores the plaintext.
Polyalphabetic Vigenère with a known flag prefix. The first 7 characters of plaintext (picoCTF) reveal the full repeating key.
An image of colored nautical signal flags arranged in sequence. Each flag maps to a letter in the International Code of Signals.
Table-based one-time pad where the key is given. Subtract key shifts from ciphertext modulo 26.
A PNG with a zip inside, which contains a PNG with a zip inside, four layers deep. Recursively extract to reach flag.txt.
Flag appended as plain text after the IEND chunk of a JPEG. Image viewers stop at IEND; strings does not.
A cat photo with a base64-encoded flag stuffed into the EXIF License field.
An Android APK containing a hex-encoded flag buried inside the res/color/ directory.
More writeups added as challenges are solved.