A repository of CTF challenges I've created for various competitons. I try to make challenges as creative and expressive as possible. Any feedback is appreciated.
Author writeups can be found at https://iscaraca.github.io/
| CTF | Challenge | Difficulty | Description |
|---|---|---|---|
| Cyberthon 2023 | Astockalypse | ★☆☆☆☆ | A data science challenge that involves participants stealing a black-box stock prediction model |
| TISC 2023 | Blind SQL Injection | ★★★★☆ | WASM pwn cunningly disguised as a normal web challenge through an AWS lambda function |
| Cyberthon 2024 | The Galaxy's Best Smuggler | ★★☆☆☆ | HTTP request smuggling to force a losing hand for your opponent in a game of blackjack where you're up against a cheater |
| TISC 2024 | Baby Flagchecker | ★★★⯪☆ | Novel instruction counting attack using gas estimates of a flagchecker EVM contract deployed to a private network |
| Welcome CTF 2025 | This Is Just One Of Those Classic Web Challenges | ★☆☆☆☆ | SQLi, but the injectable parameter is overwritten by variable name reuse |
| Welcome CTF 2025 | This Is Just Another One Of Those Classic Web Challenges | ★⯪☆☆☆ | SVG XSS |
| Singapore AI CTF 2025 | Well Well Well | ★★★☆☆ | Reversing RoPE and finding pre-normalised embeddings from a KV cache |
| A.YCEP x Greycademy 2025 | Sandbox | ★☆☆☆☆ | Tutorial SQL injection, XSS, and SSRF |
| A.YCEP x Greycademy 2025 | Command Injection | ★☆☆☆☆ | Tutorial command injection |
| A.YCEP x Greycademy 2025 | How to solve a CTF challenge | ★☆☆☆☆ | Tutorial inspect element |
| A.YCEP x Greycademy 2025 | Local File Inclusion | ★☆☆☆☆ | Tutorial LFI |