Web and Crypto Challenges

Web and crypto are the two most common entry points into CTF.

• Web challenges hand you a running web application and ask you to find a flaw in how it handles input, authentication, or trust.
• Crypto challenges hand you ciphertext, a scheme, and sometimes source code, and ask you to recover plaintext or a key by exploiting a flaw in how the cryptography was used.

Both reward methodical observation. This lesson covers the recurring puzzles in each.

Before exploiting anything, map the application. View the source, inspect responses, and probe hidden content.

SQL injection happens when user input is concatenated into a database query without separation between code and data.

A login that builds a query like SELECT * FROM users WHERE name='INPUT' can be subverted by input that closes the string and alters the logic:

CTF teaches you to break injection so you can defend it. The correct defense is parameterized queries (prepared statements), which keep user data out of the query structure entirely.

XSS occurs when an app reflects or stores attacker-controlled input and a browser executes it as script. In CTF, an XSS challenge often involves a bot that visits your payload while holding the flag in a cookie.

• Reflected — payload in the request is echoed straight back.
• Stored — payload is saved and runs for later visitors.
• DOM-based — client-side JavaScript writes input into the page unsafely.

The defense is context-aware output encoding plus a Content-Security-Policy. A test probe like <script>alert(1)</script> confirms whether input is escaped.

Two more web staples:

• Server-Side Request Forgery (SSRF) — you trick the server into making requests on your behalf, often to internal-only addresses like http://127.0.0.1 or a cloud metadata endpoint, to reach the flag.
• Path traversal — you escape an intended directory with sequences like ../ to read files outside the web root, for example ../../../../etc/passwd.

Both stem from trusting user input to choose a resource. Defenses are strict allowlists and canonicalizing then validating paths before use.

The most common crypto trap for beginners: confusing encoding with encryption. Encoding is reversible by anyone with no key, so it provides zero confidentiality.

Learn to recognize the formats on sight:

• Base64 — letters, digits, + /, often = padding.
• Hex — only 0-9 a-f.
• ROT13 / Caesar — readable structure, shifted letters.

Many crypto challenges use weak historical ciphers or sloppy modern ones:

• Caesar / Vigenere — shift ciphers broken by frequency analysis or trying all 25 shifts.
• Single-byte XOR — the whole message XORed with one byte; brute-force all 256 keys and pick the readable output.
• Repeating-key XOR — broken by finding the key length, then solving each key byte as a single-byte XOR.

The lesson: a custom or classical cipher offers no real security against an analyst.

RSA is secure only when its parameters are chosen correctly. CTF crypto loves to hand you a broken instance:

• Small modulus — if n is small enough, factor it directly to recover the private key.
• Tiny exponent, no padding — with e=3 and a short message, the ciphertext may be a perfect cube, recoverable by an integer cube root.
• Shared factors — if two public keys share a prime, the greatest common divisor of their moduli reveals it instantly.

The defense in the real world: use a vetted library with large keys and proper padding (OAEP), never roll your own.

When a challenge gives you a password hash, the goal is to recover the original input. You cannot reverse a hash, but you can guess inputs and compare.

Tie it together with a consistent loop for both categories:

• Observe — read the prompt, view source, identify the encoding or scheme.
• Hypothesize — name the likely vulnerability family.
• Test small — send one probe payload, watch the exact response.
• Exploit — escalate the working probe into a full payload that yields the flag.
• Document — record the payload and reasoning while it is fresh.

This loop keeps you out of rabbit holes and produces a writeup almost for free.

Test your grasp of web and crypto fundamentals.

You covered the recurring web and crypto puzzles:

• Web: map first, then probe for SQL injection, XSS, SSRF, and path traversal - each rooted in unsafe trust of user input, each fixed by separating code from data.
• Crypto: distinguish encoding from encryption, break weak classical and XOR ciphers, exploit RSA parameter mistakes, and crack hashes with wordlists.
• A single observe, hypothesize, test, exploit, document loop works for both.

Next, you move to reverse engineering and binary exploitation.