Iscara

I participated under youtiaos again, going from 3rd place JC in 2024 to 3rd place Uni in 2025. Ended up not even mattering all that much because we would’ve won the same amount of money in Pre-U anyway. Shoutout to my team members, I never get tired playing with them. Normally when I give criticism I’ll deliver a compliment sandwich. To mix things up today I shall deliver my writeup in the form of a rant sandwich. Hope you enjoy. Rant session 1Let me open by saying that this CDDC was at...

TISC is a two-week online sequential style CTF competition hosted by CSIT, where participants solve a series of 12 challenges. Over 1300 participants took on the challenges, with the top three levels of challenges having a cash prize pool of $10,000 each to be shared between participants who’ve successfully cleared the respective levels. I was given the opportunity to create the challenge at level 7, a Web3 reverse engineering/binary exploitation challenge. I’ll be sharing the writeup,...

Cyberthon is an annual CTF competition targeted towards JC students in Singapore. This year, I had the opportunity to author a challenge for the web category: The Galaxy’s Best Smuggler. At the end of this writeup are my thoughts on challenge creation. Challenge 📘 Challenge description: “Ever heard of sabacc?” “I’ve played it a couple times.” You eye the stifling pile of credit on Lando’s side of the table, allowing yourself a wry smile. “Having a good day, I reckon.” “Oh, you ain’t seen...

I participated under team youtiaos and we ended 1st place local. I was solving in the web and misc categories. The specific challenges I solved are in the image below. I’ll update this writeup with the flags once the challenges are back up. Web ChallengesBaby WebThe website uses Flask session cookies but the secret key is given unchanged in the source code. Sign another cookie with is_admin=True and proceed to spend 10 minutes finding for a hidden element on the admin page to get the flag....

This CTF happened during my midterms and I didn’t really have the luxury of time to look at some of the later challenges. I participated under team youtiaos, and we ended 97th place out of 5694 teams. Lightning RoundTimeKORP - Trivial command injection in format parameterKORP terminal - SQLmap + bcrypt hash cracking Labyrinth LinguistWe’re given a Java application using the Apache Velocity templating engine. We have user controlled input via textString that we can inject Velocity templates...