$HOME

So I’ve been writing on this blog for a while now, and to be honest it was a really nice experience, even though I know nobody read any of my writings I still find it fulfilling to have my own history get put somewhere for other to see. Most of the articles I’ve been written are about ctf and writeups. Writing writeups are not bad or boring, it’s just I don’t feel I put much feeling and creativity in it. Plus I use LLM to make the writeups more “professional” and efficient. ...

This is a forensics challenge from picoCTF (challenge ID 519). The goal is to recover a corrupted image file and extract the flag. The walkthrough includes exact commands, outputs, and common pitfalls encountered during solving. Challenge Setup Platform: picoCTF Practice Category: Forensics Difficulty: Beginner-Intermediate File: Download the provided “file” (no extension) Work in a fresh directory: mkdir picoctf-519 && cd picoctf-519 Initial File Analysis Run the basic file type check: $ file file file: data The “data” result indicates the file command cannot identify the format. Use hexdump for deeper inspection: ...

Hey folks, quick writeup on this PicoCTF challenge (ID 520) that was a solid reminder of how devs leave backdoors hanging out. It’s a web thing on their playground – nothing fancy, but it shows the classic “forgot to clean up” fuckup. Spoilers: Caesar cipher + sneaky header = flag. Let’s dive in. The Setup Head over to https://play.picoctf.org/practice/challenge/520, launch the instance. You’re supposed to log in with ctf-player@picoctf.org and some password. I try it – boom, “invalid request.” Lame. No brute-force vibes here; it’s not that kind of challenge. ...

Challenge: Flag in Flame This picoCTF challenge demonstrates how easily data can be disguised by simple encoding. The “log file” provided is not a log at all, but a Base64-encoded PNG image that contains the flag written as hexadecimal text. Download and initial inspection Start by downloading the provided file (for example, with wget or curl): wget https://challenge-files.picoctf.net/c_saffron_estate/<filename>/logs.txt or curl -O https://challenge-files.picoctf.net/c_saffron_estate/<filename>/logs.txt Before assuming it’s truly a text log, inspect it with a quick cat: ...

Challenge: Hidden in Plainsight Short summary: the image contains a Base64-encoded hint in its JPEG comment. That hint decodes to a string which itself is Base64-encoded — the result is the passphrase for steghide. Use steghide to extract flag.txt, then cat the file to read the flag. Fetch the challenge file If you haven’t downloaded the file yet, use curl or wget: # with curl curl -O https://challenge-files.picoctf.net/c_saffron_estate/25925d893c04723f46e8d1412559b15ef58509751801aac366c65441fed3e40e/img.jpg # or with wget wget https://challenge-files.picoctf.net/c_saffron_estate/25925d893c04723f46e8d1412559b15ef58509751801aac366c65441fed3e40e/img.jpg What this does: ...

Challenge: Log Hunt Short version: a plain text server log contained the flag split across repeated log entries. A few simple POSIX utilities (grep, awk, uniq, head, tr) and a tiny bit of shell plumbing reveal the flag. Below is a clean, reproducible walk-through with explicit command explanations so you know not only what to run, but why each step works. Setup and file inspection Download the provided file: https://challenge-files.picoCTF.net/c_saffron_estate/1a0b2a2a67149850cd0e6d34da005c381bbbed4c558e529fec8b3be3f8619046/server.log Open a terminal and inspect the file with some basics: ...

Challenge: Riddle Registry Every digital file has a story to tell — some louder than others. In this picoCTF forensics challenge, our mission was simple on paper (pun intended): find the flag hidden inside a PDF file. Of course, as any seasoned Linux user knows, “simple” often means “prepare for several hours of creative command-line archaeology.” The Setup Challenge: A suspicious-looking PDF file Goal: Find the flag Category: Forensics Opening the file showed nothing but Lorem Ipsum text and some odd blank spaces. That’s usually a hint in CTFs — if you can’t see it, it’s probably hidden somewhere else. ...

Challenge: Flag Hunters This challenge provides a Python script that at first glance looks like a quirky program for singing along to a set of lyrics. Buried inside, however, is the real objective: a flag hidden within the program’s text handling logic. Here is the full source code. import re import time # Read in flag from file flag = open('flag.txt', 'r').read() secret_intro = \ '''Pico warriors rising, puzzles laid bare, Solving each challenge with precision and flair. With unity and skill, flags we deliver, The ether’s ours to conquer, '''\ + flag + '\n' song_flag_hunters = secret_intro +\ ''' [REFRAIN] We’re flag hunters in the ether, lighting up the grid, No puzzle too dark, no challenge too hid. With every exploit we trigger, every byte we decrypt, We’re chasing that victory, and we’ll never quit. CROWD (Singalong here!); RETURN [VERSE1] Command line wizards, we’re starting it right, Spawning shells in the terminal, hacking all night. Scripts and searches, grep through the void, Every keystroke, we're a cypher's envoy. Brute force the lock or craft that regex, Flag on the horizon, what challenge is next? REFRAIN; Echoes in memory, packets in trace, Digging through the remnants to uncover with haste. Hex and headers, carving out clues, Resurrect the hidden, it's forensics we choose. Disk dumps and packet dumps, follow the trail, Buried deep in the noise, but we will prevail. REFRAIN; Binary sorcerers, let’s tear it apart, Disassemble the code to reveal the dark heart. From opcode to logic, tracing each line, Emulate and break it, this key will be mine. Debugging the maze, and I see through the deceit, Patch it up right, and watch the lock release. REFRAIN; Ciphertext tumbling, breaking the spin, Feistel or AES, we’re destined to win. Frequency, padding, primes on the run, Vigenère, RSA, cracking them for fun. Shift the letters, matrices fall, Decrypt that flag and hear the ether call. REFRAIN; SQL injection, XSS flow, Map the backend out, let the database show. Inspecting each cookie, fiddler in the fight, Capturing requests, push the payload just right. HTML's secrets, backdoors unlocked, In the world wide labyrinth, we’re never lost. REFRAIN; Stack's overflowing, breaking the chain, ROP gadget wizardry, ride it to fame. Heap spray in silence, memory's plight, Race the condition, crash it just right. Shellcode ready, smashing the frame, Control the instruction, flags call my name. REFRAIN; END; ''' MAX_LINES = 100 def reader(song, startLabel): lip = 0 start = 0 refrain = 0 refrain_return = 0 finished = False # Get list of lyric lines song_lines = song.splitlines() # Find startLabel, refrain and refrain return for i in range(0, len(song_lines)): if song_lines[i] == startLabel: start = i + 1 elif song_lines[i] == '[REFRAIN]': refrain = i + 1 elif song_lines[i] == 'RETURN': refrain_return = i # Print lyrics line_count = 0 lip = start while not finished and line_count < MAX_LINES: line_count += 1 for line in song_lines[lip].split(';'): if line == '' and song_lines[lip] != '': continue if line == 'REFRAIN': song_lines[refrain_return] = 'RETURN ' + str(lip + 1) lip = refrain elif re.match(r"CROWD.*", line): crowd = input('Crowd: ') song_lines[lip] = 'Crowd: ' + crowd lip += 1 elif re.match(r"RETURN [0-9]+", line): lip = int(line.split()[1]) elif line == 'END': finished = True else: print(line, flush=True) time.sleep(0.5) lip += 1 reader(song_flag_hunters, '[VERSE1]') Although the file looks long and perhaps intimidating, most of the code is simply song lyrics wrapped in string variables and some straightforward branching logic to print them out. The actual vulnerability lies in how the script processes user input during the “crowd participation” parts of the song. ...

こんにちは～ このブログで、私のラノベ感想シリーズを始めます。日本語力をもっと上達させるために、このシリーズを書くことにしました。もともと日本語を勉強し始めたきっかけは、ただラノベを読みたかったからです。もちろん英語や他の言語でもラノベを読むことはできますが、日本語で読むと特別な感触がありますね。作者と直接つながっているような気持ちになります。 ラノベはそれなりに読んでいますが、その感想や自分の意見を書くことはほとんどありません。頭の中で思っていることを言葉にするのが難しいんです。だからこそ、これは練習しなければと思いました。でも「どこで感想を書く練習をすればいいかな」と迷っていたときに、このシリーズを思いつきました。 この記事は序章なので、まだラノベの感想はありませんが、次回の記事を楽しみにしていてください。それでは、今回はこのへんで。

As someone coming from linux, there is one thing that I miss when trying to daily driving windows, and that is the terminal. Windows has great terminal emulator nowadays, with powershell being windows’ most powerful shell. You see, it’s really natural for me to spend most of my time in the terminal when I’m using linux, it’s just much more simple and more focused. Not only that, the commands in linux are really short consisting of 2-6 letters on average, and once you know your way, you can combine any of that commands to make everything even more concise and quick. ...