CTF Arena
Challenges
Capture-the-flag puzzles across web, crypto, forensics, OSINT and reversing, plus coding problems you solve in Python, Java, PHP or JavaScript. Flags look like ss{…}; code is graded against hidden tests in an isolated sandbox.
- Challenges
- 57
- Flags
- 30
- Coding
- 27
Events
Capture the flag30
- Warmup: Not Encryption100 pts0 solves
- Warmup: Half a Caesar100 pts0 solves
- Hex Marks the Spot100 pts0 solves
- Caesar's Day Off100 pts0 solves
- Cookie Jar100 pts0 solves
- EXIF Whisper100 pts0 solves
- Plaintext Login100 pts0 solves
- Certificate Trail100 pts0 solves
- Deleted, Not Gone100 pts0 solves
- Gatekeeper.py100 pts0 solves
- Morse Beacon100 pts0 solves
- Binary Talk100 pts0 solves
- Needle in the Haystack150 pts0 solves
- Log Hunt150 pts0 solves
- Trust Nothing Signed Badly150 pts0 solves
- Headers Talk Too200 pts0 solves
- Lookalikes Lurk in Unicode150 pts0 solves
- History Never Forgets150 pts0 solves
- XOR Layers200 pts0 solves
- The Cloud's Worst Endpoint200 pts0 solves
- Slow Leak200 pts0 solves
- Known Prefix200 pts0 solves
- Keygen.js200 pts0 solves
- Blind but Not Deaf200 pts0 solves
- Off by One Slash200 pts0 solves
- History Never Forgets200 pts0 solves
- Vigenère Postcard200 pts0 solves
- Neighbourly Primes300 pts0 solves
- Timing Oracle300 pts0 solves
- Bytecode Peek300 pts0 solves
Coding challenges27
Read from standard input, print to standard output. Python · Java · PHP · JavaScript.
- Warm-up: Add Two Numbers50 pts0 solves
- FizzBuzz50 pts0 solves
- Palindrome Check75 pts0 solves
- Caesar Decoder75 pts0 solves
- Balanced Brackets100 pts0 solves
- Run-Length Encoding75 pts0 solves
- SHA-256 Fingerprints100 pts0 solves
- Top Words150 pts0 solves
- Strict IPv4 Validator150 pts0 solves
- Password Policy Checker150 pts0 solves
- Brute-Force Report175 pts0 solves
- Safe Query Parser175 pts0 solves
- Merge Maintenance Windows150 pts0 solves
- Escape the Datacenter250 pts0 solves
- Sliding-Window Rate Limiter250 pts0 solves
- Escape It Before You Render It75 pts0 solves
- Defuse a Spreadsheet Export100 pts0 solves
- Base64url Without the Padding100 pts0 solves
- Card Number Sanity Check75 pts0 solves
- Session Cookie Audit125 pts0 solves
- Verify the Webhook Signature150 pts0 solves
- Keep Secrets Out of the Logs150 pts0 solves
- Stop the Open Redirect150 pts0 solves
- Path Traversal Guard175 pts0 solves
- Parameterize the Query150 pts0 solves
- JWT: Trust Nothing in the Header225 pts0 solves
- SSRF: Spot the Sneaky Localhost275 pts0 solves