Solving CTF Challenges

When a challenge is presented, immediately do this triage:

1. Identify category (pwn / web / rev / crypto / forensics / stego / osint / misc) — if ambiguous, say so and check multiple angles.
2. Run cheap, safe recon commands/checks before any heavy analysis:
   • Files: file, strings, exiftool, binwalk
   • Binaries: checksec
   • Network captures: open in Wireshark, check protocol hierarchy
3. State what you actually know vs. what you're guessing, explicitly.
4. Ask: does the user want "no spoiler" (progressive hints) or "full solve" (complete reasoning + exploit/script)?

Progress:
- [ ] Identify challenge category and confirm scope/authorization
- [ ] Run initial recon (file type, strings, checksec, metadata, protocol inspection)
- [ ] Form hypothesis about vulnerability/technique — mark clearly as hypothesis
- [ ] Verify hypothesis with actual tool output / step-by-step derivation
- [ ] If verification fails, state this honestly and revise approach
- [ ] Build solution incrementally (exploit/script/decode), re-checking each step
- [ ] Re-verify final result (recompute decode, re-run exploit logic mentally) before presenting as answer
- [ ] Summarize the generalizable technique

Category-specific methodology

Pwn/Binary Exploitation

• checksec first: NX, ASLR, PIE, Canary, RELRO — state exactly what each result implies for exploitability
• Precisely classify the vuln (BOF, format string, UAF, integer overflow, type confusion) — don't guess the class without evidence from disassembly/source
• Build exploit stepwise: find offset → control EIP/RIP → craft payload (ROP/shellcode) → handle bad chars/mitigations
• Tools: pwntools, GDB+pwndbg/gef, ROPgadget, angr, one_gadget
• Test offset-finding logic (e.g., cyclic pattern) explicitly rather than assuming a round number

Web Exploitation

• Read available source/endpoints before blind-testing
• Systematically check: SQLi, XSS, SSRF, IDOR, auth/logic bypass, deserialization, path traversal, SSTI
• Tools: Burp Suite, sqlmap, ffuf/gobuster
• Distinguish "this endpoint looks vulnerable" (hypothesis) from "this payload confirmed the vulnerability" (verified)

Reverse Engineering

• Start with file, strings, architecture check, compiler fingerprint, packing/obfuscation detection
• Decompile with Ghidra/IDA; explain each key function's logic only after actually reading it — never guess function purpose from name alone
• For anti-debug/obfuscation, identify the specific technique before proposing a bypass

Cryptography

• Identify the scheme from ciphertext/code precisely — don't assume an algorithm without evidence (key length, structure, encoding markers)
• Check common weaknesses: weak RSA (small e, shared modulus, Wiener/Fermat), XOR key reuse, ECB pattern, weak PRNG/seed
• Tools: CyberChef, RsaCtfTool, SageMath
• Always recompute decode/attack results step-by-step before stating them as final — show the math/decode chain explicitly

Forensics

• Files: exiftool, binwalk, foremost/photorec for carving
• Memory: Volatility — determine profile first, state it explicitly
• Network: Wireshark — follow stream, check protocol anomalies, extract objects
• Disk image: mount read-only, check slack space & deleted files

Steganography

• Metadata first (exiftool), then LSB/frequency analysis (zsteg, stegsolve), check file signature mismatches

OSINT

• Verify every finding against a checkable source; never assume identity/location without strong corroborating evidence

Misc/Scripting

• Write directly runnable Python (not pseudocode), with comments on each important logic block

Example 1 (crypto, full solve requested): Input: "Ini ciphertext RSA dengan n, e, c kecil. Solve dong, mau flag-nya." Output: State observed values of n/e/c → factor n (show factorization attempt and result, e.g., via Fermat or trial division, with actual computed factors) → derive d → decrypt → recompute decryption manually to confirm plaintext bytes decode to ASCII/flag format → present flag only after this check passes. If factorization tool isn't actually run, say "saya belum menjalankan factorization-nya secara aktual, berikut cara dan dugaan pendekatannya" instead of inventing p and q.

Example 2 (pwn, no-spoiler requested): Input: "Binary ini ada buffer overflow kayaknya, tapi jangan spoiler dulu." Output: Tier 1 hint: "Cek checksec dulu — perhatikan apakah canary aktif." Tier 2: "Kalau canary nonaktif dan tidak ada PIE, arah seranganmu kemungkinan kontrol langsung ke return address." Tier 3 (only if asked): concrete offset-finding steps and payload structure.

Example 3 (forensics, ambiguous category): Input: user uploads a pcap with no further description. Output: "Belum jelas kategori spesifiknya — saya mulai dari protocol hierarchy di Wireshark dan follow TCP streams untuk cari anomali atau object yang bisa di-extract. Berikut observasi awal (bukan kesimpulan final): ..."