Backdrop
An x86_64-only Flutter challenge that forces Impeller down a broken emulator path, then turns the APK signing certificate into the key for revealing its flag.
37 articles
8 min read
Four minutes, thirty-two seconds
We cleared an entire CSAW wave in 4 minutes and 32 seconds. We were using AI agents ourselves, and it left me questioning what online CTFs are measuring.
Securinets Friendly CTF 2026: the challenges I built
Twenty-six challenges I shipped for Securinets INSAT's beginner CTF: one Android app holding the whole Mobile track, and a reverse engineering ladder from ltrace to Cheat Engine.
AntiDbg
An anti-debug check refuses to run under a debugger, so you let it run, let it get its answer, then change that answer in a register before the program reads it.
Doorman
The badge code is stored scrambled so strings finds nothing, but the program checks your input with strcmp, and ltrace prints both sides of that comparison.
DOR
The profile endpoint takes any valid token and hands back whichever account id you ask for, so you change the id in the request and read someone else's record.
Echoes
The app writes a sensitive value to logcat during normal use; capture it with adb while driving the screen.
Face to Face
The biometric prompt's success callback is trusted client-side with no CryptoObject, so hooking it opens the vault with no fingerprint.
Final Countdown
Five times to hit in a row, each counted only while the app genuinely reads that time, verified by the server, so you hook the exact clock the checker reads and feed it each target.
First Contact
A hardcoded account name and an MD5 of its password ship in the APK; crack the hash, then let the server verify the plaintext.
Forged Papers
The JWT is signed correctly with HS256 but the secret is a rockyou.txt word, so you crack it offline, mint a token that says role admin, and re-sign it.
L0gIn
The login form builds a SQL query by pasting your input into a string, so a single quote breaks out and you log in as admin without the password.
License
The paid-or-not decision runs entirely on the device, so you patch the smali that makes it (or hook it) to return licensed, and the app computes the flag for you.
Nobody Called
A native library still exports the unseal routine for a note format the UI dropped, and nothing in the app calls it, so you call it yourself with the live nonce from the server.
Off the Map
A diagnostics screen was dropped from the app's navigation but is still exported in the manifest, so it can be launched directly with adb.
Open Lines
The login talks over plain HTTP and the response carries an extra field the app never shows, so anything sitting on the wire reads the flag out of the body.
Paper Trail
A 10 MB Linux binary that is really a PyInstaller bundle, so you extract it, decompile the Python bytecode, and read the passphrase and flag unsealing straight out of the source.
Patch&Go
A licence check hashes a file against a constant you are not meant to match, so instead of passing it you patch the function to return 1, or set its return value in gdb.
PINNED
The app pins its server certificate so an ordinary proxy fails, so you disable the pinning on the device with Frida and read the audit response the app never shows.
Plain Sight
The flag is a plain string resource inside the APK; decoding the app's resources reads it straight out.
Relay
The binary checks in with a server that does not exist, so you read the hostname out of its DNS query with strace, point that name at yourself, and answer its HTTP request with the token it sends you.
Shift
The key check is a hand-written XOR-and-rotate loop compared against a table in .rodata, so there is no library call to trace and you have to read the loop and run it backwards.
Straight Key
Triage an unfamiliar Windows executable, trace its runtime API calls, and build a receiver for the behavior you uncover.
Strangers
A bundled analytics SDK the app didn't write ships telemetry to its own server on a different host and port, and the reply carries a value the app never shows.
Warmup
The app encrypts a value with AES but ships the key and IV right beside the ciphertext, so you decrypt it yourself.
Water Run: Revenge
A Sekiro-inspired fly-hacking challenge: find live vertical velocity with Cheat Engine, or recover the flag offline by reversing the native DLL.
Water Run
Two ways through a Godot runner: edit jump power with Cheat Engine, or reverse the native DLL and recover the encrypted flag offline.
What Remains
A value the app saved to its own private SQLite database stays on disk after the screen stops showing it; read it off the data directory.
WideOpen
The Firebase database has its read rule left open, so the whole customer table dumps over REST and one password hash in it is crackable.
GoCipher: Elite Go Reversing
Brute-forcing an obfuscated Go binary by targeting instruction alignment vulnerabilities.
Warmup: ELF Header Recovery
Repairing a corrupted ELF header and bypassing multiple layers of ptrace anti-debugging.
Slow: GDB-Python Automation
Bypassing massive function-pointer obfuscation and usleep slowdowns via GDB scripting.
PFF: Artifact Forensic Leak
Reversing embedded PDF JavaScript and brute-forcing Steganographic image layers.
Mojo-Vault: Integrity Bypass
Race-condition extraction of temporary runtime scripts and self-integrity MD5 patching.
13337: The Final Boss
A multi-stage challenge involving self-modifying code, network handshakes, and cryptographic brute-forcing.
GreenGuard: Building a Resilient Smart Greenhouse
Connecting ESP32 firmware, MQTT, and FastAPI to monitor a greenhouse and keep local control running during network outages.
Building an AI-Powered Driver Assistant
A deep dive into building a real-time ML pipeline for road safety with sub-300ms latency.