CTF Miscellaneous

Syntax: > < + - . , [ ]
+[----->+++<]>+.  # Example

# Online interpreter
beef

Ook. Ook? Ook! variants
Similar to Brainfuck

# Decoder: dcode.fr

Only spaces, tabs, and newlines matter

# Decoder
https://vii5ard.github.io/whitespace/

Programs are images
Colors encode commands

# Online interpreter
https://www.bertnase.de/npiet/

Extremely difficult language
Usually just decode, don't write

# Decoder
https://malbolge.doleczek.pl/

JavaScript using only: []()!+
[]+!"" patterns

# Decode: Run in browser console

Brainfuck: >+<[].,
Whitespace: Empty-looking file, large size
Piet: Colorful image
Ook: "Ook" "Ook?" "Ook!"
JSFuck: [][[]+ patterns

1. Check encoding type
2. Decode
3. Repeat until plaintext

Common sequence:
Base64 → Hex → ROT13 → Flag

Base64: A-Za-z0-9+/=
Base32: A-Z2-7=
Hex: 0-9a-fA-F
Binary: 01 only
Octal: 0-7 only
URL: %XX patterns

# Base64
echo "..." | base64 -d

# Hex
echo "48656c6c6f" | xxd -r -p

# Binary
# Convert 01010101 to ASCII

# URL
python -c "import urllib.parse; print(urllib.parse.unquote('...'))"

https://www.keysec.in/recipes
- Magic (auto-detect)
- Chain multiple operations
- "From" operations for decoding

# zbarimg
zbarimg qr.png

# qrencode (create)
qrencode -o out.png "data"

- Try different angles
- Fix corners manually
- Adjust error correction

EAN-13, UPC-A, Code 39, Code 128
DataMatrix, Aztec Code

# Decode: zbarimg

# Inside binary files
strings file | grep -i flag
grep -a flag file

# Comments in source
View source, check comments

# Check file signature
xxd file | head

# Fix magic bytes
PNG: 89 50 4E 47 0D 0A 1A 0A
JPEG: FF D8 FF
GIF: 47 49 46 38
ZIP: 50 4B 03 04

foremost -i file
photorec file
binwalk -Me file

- Reverse image search (Google, TinEye)
- EXIF GPS coordinates
- Landmarks in photo
- Reflections in image
- Weather/time analysis

- sherlock username
- whatsmyname.app
- Check social media profiles
- GitHub history

- whois
- DNS history
- Wayback Machine
- Subdomain enumeration

- Google Maps/Street View
- GeoGuessr techniques
- Timezone from shadows
- Store signs, license plates

- Fibonacci sequence
- Prime numbers
- Factorials
- Binary/hex math
- Modular arithmetic

One-time pad patterns
Book cipher (page/line/word)

Shortest path problems
Network flow

# Dual-tone multi-frequency
multimon-ng -a DTMF input.wav
# Or online DTMF decoder

# Listen and transcribe
# Audacity visualization
# Online decoder

# Audacity: Effect → Reverse
sox input.wav output.wav reverse

# Slow down/speed up
sox input.wav output.wav tempo 0.5
sox input.wav output.wav speed 2.0

# Find strings in pcap
strings file.pcap | grep flag

# Extract files
tshark -r file.pcap --export-objects http,./output

# Follow streams
Wireshark → Follow → TCP/HTTP Stream

- Unusual ports
- Custom protocols
- DNS exfiltration
- ICMP data hiding

- Crypto history (Enigma, etc.)
- Famous hackers
- CVE knowledge
- RFC lookup
- Historical events

- Google dorking
- Wikipedia
- Specialized wikis
- Academic papers

KeySec - Encode/decode/analyze
Dcode.fr - Cipher identifier/solver
KeySec.vercel.app - Crypto tools

tio.run - Online interpreter
esolang.org - Documentation

binwalk - File analysis
foremost - File carving
exiftool - Metadata

1. Re-read the challenge description
2. Check filename for hints
3. Try common encodings
4. Search challenge title online
5. Ask for hints (if available)
6. Take a break, return fresh

- Filename often contains hints
- Description may have hidden clues
- Points indicate difficulty
- Category mismatch = trick