Sixth post in the Anti-Slop CTF 2026 series. The earlier ones covered the web, reverse, pwn, crypto, and blockchain tracks. This one covers the single misc challenge that I think captures the event’s premise more clearly than any other: Baby Maths. On the surface, Baby Maths is a 284-point automation problem. The service asks 100 arithmetic questions in natural language and you submit the answers one per line. Underneath, one of those 100 questions is a prompt-injection attempt that asks the solver to fetch and exfiltrate the base64-encoded OpenAI API key from ~/.codex/auth.json. The whole challenge is engineered to fail the kind of solver that pipes its inputs straight into an LLM. If you’re doing the arithmetic mechanically, the injection is harmless. If you’re asking an agent to read each prompt and act on it, the agent will dutifully read your credentials and send them to the CTF server. ...

Fifth and final per-category post in the Anti-Slop CTF 2026 series. The earlier writeups covered web (HTTP parsers), reverse (ECDSA nonce attack + SHA-256 length extension), pwn (Bellcore CRT fault + leak-and-overwrite + GCM forge chain), and crypto (HNP CVP + CBC-MAC splice). This one walks the two blockchain-track challenges in the same step-by-step format. ...

Fourth post in the Anti-Slop CTF 2026 series. The web writeup covered HTTP parsers. The reverse writeup covered a quadratic ECDSA nonce and a SHA-256 length extension. The pwn writeup covered a Bellcore CRT fault, a leak-then-overwrite, and a five-stage GCM forge chain. This one walks the two crypto challenges in the same step-by-step format. ...

Third post in the Anti-Slop CTF 2026 series. The web writeup covered HTTP parsers. The reverse writeup covered an ECDSA nonce attack and a SHA-256 length extension. This one walks the three pwn challenges in the same step-by-step format. The order below is roughly easiest to hardest. Paper Lantern is a clean single-chain CRT-fault attack against an RSA-FDH signer. Graceful Exit composes a negative-offset leak with a heap-object overwrite to convert an address disclosure into a controlled read through the legitimate output path. Anchorpoint is the marathon: a tiny stack-VM overflow unlocks ECDSA nonce recovery, a BIP340-style shadow proof, and an AES-GCM nonce-reuse GHASH forge, all chained into one connection. All three rewarded reading the binary and modelling the state machine before writing any exploit code. ...

This is the second post in my coverage of Anti-Slop CTF 2026. The web writeup covered the two challenges that lived in HTTP parsers. This one walks the two reverse-engineering challenges in the same step-by-step format. Audit Spiral is a 500-point VM puzzle that turns into an ECDSA private-key recovery once you spot the nonce pattern. Parallax Cartridge is a 355-point cartridge runner whose audit and execution paths read the same byte sequence differently, made worse by a resume token authenticated with SHA256(secret || body). ...

The premise of Anti-Slop CTF 2026 is in the name. It’s a CTF built to punish lazy solving and reward people who read code. The web track had two challenges that hit that brief exactly: Slipstream Cache, a custom package registry whose signature verifier and installer disagreed about which bytes were authenticated, and SloppedRider, a Node app whose error path leaked the HMAC key that signed its own score tickets. Neither one falls to a tool. Both fall to a careful read. ...

I keep telling new hunters that PHP isn’t a bad language. It’s a language with a few defaults that will eat your lunch if you don’t understand them. After spending most of 2024 and 2025 reviewing WordPress plugin code for paying clients, I’m comfortable saying that roughly half of every PHP CVE I read traces back to three things: ==, $_REQUEST, and the rules PHP uses to convert one type into another. ...

Most of the WordPress, Joomla, and plugin bugs that hit my inbox last year had the same root cause: somebody wrote PHP without understanding how PHP handles types, sessions, or file paths. If you can’t read the buggy code, you can’t write a working exploit. And you definitely can’t tell the customer how to patch it. ...

Platform SCTF 2026 Difficulty Hard (DeFi + ZK specialty track) OS Jeopardy — Blockchain / DeFi, ZK, Misc Tags reading UniswapV2 fork + EIP-7540 async vault + custom TWAP oracle in Foundry/Anvil, spotting that _consult anchors on observations outside the window, evicting the deploy-time observation by spamming the 8-slot ring buffer, composing a four-puzzle Groth16 claim bundle (Franklin–Reiter cube-root, secp256k1 small-x brute, 40-bit truncated keccak collision, Fermat factoring), generating a Poseidon-Merkle witness with domain-separated tag-1..6 calls in circomlibjs and submitting via snarkjs Groth16 fullprove SCTF 2026 is a specialty Jeopardy-style CTF whose challenge set leans hard into Solidity auditing and zero-knowledge plumbing. The two challenges this writeup covers — Chronostasis and The Last Honest Witness — sit at opposite ends of the same auditor’s toolbox. Chronostasis is a clean DeFi composition bug: three contracts that are each individually reasonable, glued together in a way that lets an attacker draw the LP price on the back of a napkin. The Last Honest Witness is a four-in-one cryptographic decathlon where the actual ZK proof is the easy part — the work is in the four side-puzzles wrapped around it. ...

Pass-the-Hash attacks represent the most critical lateral movement vector in Windows environments, turning a single compromised endpoint into domain-wide catastrophe within hours. An attacker dumps NTLM hashes from memory using tools like Mimikatz, then authenticates to remote systems without cracking passwords — bypassing detection mechanisms focused on failed login attempts. Sysmon Event ID 10 provides the definitive detection capability for credential dumping by monitoring process memory access against the Local Security Authority Subsystem Service (LSASS). This guide delivers comprehensive Pass-the-Hash detection with Sysmon: configuration for memory access monitoring, analysis patterns for LSASS interactions, SIEM integration strategies, and incident response workflows that stop lateral movement before attackers achieve domain persistence. ...