KPMG CTF 2026
Cybersecurity write-ups, technical analysis, and lessons learned.
A collection of CTF write-ups spanning web and API security, reverse engineering, cryptography, OSINT, and more. Documenting the approach, the dead ends, and the lessons behind each challenge.
Categories
-
API
Authorization, business-logic and race-condition flaws in modern back-ends.
3 write-ups -
Cryptography
Layered encodings, classical ciphers and file-format steganography.
2 write-ups -
Infra
Linux privilege escalation, injection filters, cron hijacking and weak keys.
3 write-ups -
IR
Log, packet-capture and artifact forensics: reconstructing an intrusion.
2 write-ups -
LLM
Prompt-leak, excessive-agency and agentic-SSRF attacks on AI assistants.
3 write-ups -
Mobile
Android APK static analysis, client-side trust and injection.
1 write-up -
OSINT
Metadata, steganography, git history and geolocation investigations.
2 write-ups -
RE
ELF triage, anti-analysis defeat and bytecode / MBA deobfuscation.
3 write-ups -
Web
Injection, auth bypass, JWT abuse and chained server-side exploitation.
4 write-ups