# The CTF Recipes ## The CTF Recipes - [Introduction](https://www.ctfrecipes.com/readme.md) - [Introduction](https://www.ctfrecipes.com/cryptography/reconnaissance.md) - [General knowledge](https://www.ctfrecipes.com/cryptography/general-knowledge.md) - [Encoding](https://www.ctfrecipes.com/cryptography/general-knowledge/encoding.md): Data standard - [Character encoding](https://www.ctfrecipes.com/cryptography/general-knowledge/encoding/character-encoding.md) - [ASCII](https://www.ctfrecipes.com/cryptography/general-knowledge/encoding/character-encoding/ascii.md) - [Unicode](https://www.ctfrecipes.com/cryptography/general-knowledge/encoding/character-encoding/unicode.md) - [UTF-8](https://www.ctfrecipes.com/cryptography/general-knowledge/encoding/character-encoding/utf-8.md) - [Data encoding](https://www.ctfrecipes.com/cryptography/general-knowledge/encoding/data-encoding.md) - [Base16](https://www.ctfrecipes.com/cryptography/general-knowledge/encoding/data-encoding/base16.md): Hexadecimal encoding - [Base32](https://www.ctfrecipes.com/cryptography/general-knowledge/encoding/data-encoding/base32.md) - [Base64](https://www.ctfrecipes.com/cryptography/general-knowledge/encoding/data-encoding/base64.md) - [Maths](https://www.ctfrecipes.com/cryptography/general-knowledge/maths.md) - [Modular arithmetic](https://www.ctfrecipes.com/cryptography/general-knowledge/maths/modular-arithmetic.md) - [Greatest Common Divisor](https://www.ctfrecipes.com/cryptography/general-knowledge/maths/modular-arithmetic/greatest-common-divisor.md) - [Fermat's little theorem](https://www.ctfrecipes.com/cryptography/general-knowledge/maths/modular-arithmetic/fermats-little-theorem.md) - [Quadratic residues](https://www.ctfrecipes.com/cryptography/general-knowledge/maths/modular-arithmetic/quadratic-residues.md) - [Tonelli-Shanks](https://www.ctfrecipes.com/cryptography/general-knowledge/maths/modular-arithmetic/tonelli-shanks.md) - [Chinese Remainder Theorem](https://www.ctfrecipes.com/cryptography/general-knowledge/maths/modular-arithmetic/chinese-remainder-theorem.md) - [Modular binomial](https://www.ctfrecipes.com/cryptography/general-knowledge/maths/modular-arithmetic/modular-binomial.md) - [Padding](https://www.ctfrecipes.com/cryptography/general-knowledge/padding.md) - [PKCS#7](https://www.ctfrecipes.com/cryptography/general-knowledge/padding/pkcs-7.md) - [Misc](https://www.ctfrecipes.com/cryptography/misc.md) - [XOR](https://www.ctfrecipes.com/cryptography/misc/xor.md) - [Mono-alphabetic substitution](https://www.ctfrecipes.com/cryptography/mono-alphabetic-substitution.md) - [Index of coincidence](https://www.ctfrecipes.com/cryptography/mono-alphabetic-substitution/index-of-coincidence.md) - [frequency analysis](https://www.ctfrecipes.com/cryptography/mono-alphabetic-substitution/frequency-analysis.md) - [Well known algorithms](https://www.ctfrecipes.com/cryptography/mono-alphabetic-substitution/well-known-algorithms.md) - [Scytale](https://www.ctfrecipes.com/cryptography/mono-alphabetic-substitution/well-known-algorithms/scytale.md): Spartan cipher - [ROT](https://www.ctfrecipes.com/cryptography/mono-alphabetic-substitution/well-known-algorithms/rot.md): Caesar & ROT13 - [Polybe](https://www.ctfrecipes.com/cryptography/mono-alphabetic-substitution/well-known-algorithms/polybe.md): Cipher square - [Vigenere](https://www.ctfrecipes.com/cryptography/mono-alphabetic-substitution/well-known-algorithms/vigenere.md) - [Pigpen cipher](https://www.ctfrecipes.com/cryptography/mono-alphabetic-substitution/well-known-algorithms/pigpen-cipher.md): Masonic cipher - [Affine cipher](https://www.ctfrecipes.com/cryptography/mono-alphabetic-substitution/well-known-algorithms/affine-cipher.md) - [Symmetric Cryptography](https://www.ctfrecipes.com/cryptography/symmetric-cryptography.md) - [AES](https://www.ctfrecipes.com/cryptography/symmetric-cryptography/aes.md): The Rijndael scheme - [Block Encryption procedure](https://www.ctfrecipes.com/cryptography/symmetric-cryptography/aes/block-encryption-procedure.md) - [Byte Substitution](https://www.ctfrecipes.com/cryptography/symmetric-cryptography/aes/block-encryption-procedure/byte-substitution.md) - [Shift Row](https://www.ctfrecipes.com/cryptography/symmetric-cryptography/aes/block-encryption-procedure/shift-row.md) - [Mix Column](https://www.ctfrecipes.com/cryptography/symmetric-cryptography/aes/block-encryption-procedure/mix-column.md) - [Add Key](https://www.ctfrecipes.com/cryptography/symmetric-cryptography/aes/block-encryption-procedure/add-key.md) - [Key Expansion / Key Schedule](https://www.ctfrecipes.com/cryptography/symmetric-cryptography/aes/block-encryption-procedure/key-expansion-key-schedule.md) - [Mode of Operation](https://www.ctfrecipes.com/cryptography/symmetric-cryptography/aes/mode-of-operation.md) - [ECB](https://www.ctfrecipes.com/cryptography/symmetric-cryptography/aes/mode-of-operation/ecb.md): Electronic Codebook Block - [Block shuffling](https://www.ctfrecipes.com/cryptography/symmetric-cryptography/aes/mode-of-operation/ecb/block-shuffling.md) - [Challenge example](https://www.ctfrecipes.com/cryptography/symmetric-cryptography/aes/mode-of-operation/ecb/block-shuffling/challenge-example.md): Arbitrary token - [ECB Oracle](https://www.ctfrecipes.com/cryptography/symmetric-cryptography/aes/mode-of-operation/ecb/ecb-oracle.md) - [Challenge example](https://www.ctfrecipes.com/cryptography/symmetric-cryptography/aes/mode-of-operation/ecb/ecb-oracle/challenge-example.md) - [CBC](https://www.ctfrecipes.com/cryptography/symmetric-cryptography/aes/mode-of-operation/cbc.md): Cipher Block Chaining - [Bit flipping](https://www.ctfrecipes.com/cryptography/symmetric-cryptography/aes/mode-of-operation/cbc/bit-flipping.md) - [Challenge example](https://www.ctfrecipes.com/cryptography/symmetric-cryptography/aes/mode-of-operation/cbc/bit-flipping/challenge-example.md) - [Padding oracle](https://www.ctfrecipes.com/cryptography/symmetric-cryptography/aes/mode-of-operation/cbc/padding-oracle.md) - [Challenge example](https://www.ctfrecipes.com/cryptography/symmetric-cryptography/aes/mode-of-operation/cbc/padding-oracle/challenge-example.md) - [OFB](https://www.ctfrecipes.com/cryptography/symmetric-cryptography/aes/mode-of-operation/ofb.md): Output Feedback - [Key stream reconstruction](https://www.ctfrecipes.com/cryptography/symmetric-cryptography/aes/mode-of-operation/ofb/key-stream-reconstruction.md) - [Encrypt to Uncrypt](https://www.ctfrecipes.com/cryptography/symmetric-cryptography/aes/mode-of-operation/ofb/encrypt-to-uncrypt.md): Encrypt + Encrypt = plaintext - [General knowledge](https://www.ctfrecipes.com/pwn/general-knowledge.md): Pwn refers to the exploitation of a vulnerability in a binary to gain access to sensitive data or gain unauthorized control over the service. - [STACK](https://www.ctfrecipes.com/pwn/general-knowledge/operation-of-the-stack.md): The stack is a data structure that operates as a last-in-first-out (LIFO) structure - [Variables storage](https://www.ctfrecipes.com/pwn/general-knowledge/operation-of-the-stack/variables-storage.md) - [Stack frame](https://www.ctfrecipes.com/pwn/general-knowledge/operation-of-the-stack/stack-frame.md) - [PLT and GOT](https://www.ctfrecipes.com/pwn/general-knowledge/plt-and-got.md): Dynamic Linking - [HEAP](https://www.ctfrecipes.com/pwn/general-knowledge/operation-of-the-heap.md) - [HEAP operations](https://www.ctfrecipes.com/pwn/general-knowledge/operation-of-the-heap/heap-operations.md) - [Chunk](https://www.ctfrecipes.com/pwn/general-knowledge/operation-of-the-heap/chunk.md) - [Bins](https://www.ctfrecipes.com/pwn/general-knowledge/operation-of-the-heap/bins.md): Free chunks collections - [Chunk allocation and reallocation](https://www.ctfrecipes.com/pwn/general-knowledge/operation-of-the-heap/chunk-allocation-and-reallocation.md) - [Syscall](https://www.ctfrecipes.com/pwn/general-knowledge/syscall.md): System Call - [Architectures](https://www.ctfrecipes.com/pwn/architectures.md) - [aarch32](https://www.ctfrecipes.com/pwn/architectures/aarch32.md) - [Registers](https://www.ctfrecipes.com/pwn/architectures/aarch32/registers.md) - [Instruction set](https://www.ctfrecipes.com/pwn/architectures/aarch32/instruction-set.md) - [Calling convention](https://www.ctfrecipes.com/pwn/architectures/aarch32/calling-convention.md) - [aarch64](https://www.ctfrecipes.com/pwn/architectures/aarch64.md) - [Registers](https://www.ctfrecipes.com/pwn/architectures/aarch64/registers.md) - [Instruction set](https://www.ctfrecipes.com/pwn/architectures/aarch64/instruction-set.md) - [Calling convention](https://www.ctfrecipes.com/pwn/architectures/aarch64/calling-convention.md) - [mips32](https://www.ctfrecipes.com/pwn/architectures/mips32.md) - [Registers](https://www.ctfrecipes.com/pwn/architectures/mips32/registers.md) - [Instruction set](https://www.ctfrecipes.com/pwn/architectures/mips32/instruction-set.md) - [Calling convention](https://www.ctfrecipes.com/pwn/architectures/mips32/calling-convention.md) - [mips64](https://www.ctfrecipes.com/pwn/architectures/mips64.md) - [Registers](https://www.ctfrecipes.com/pwn/architectures/mips64/registers.md) - [Instruction set](https://www.ctfrecipes.com/pwn/architectures/mips64/instruction-set.md) - [Calling convention](https://www.ctfrecipes.com/pwn/architectures/mips64/calling-convention.md) - [x86 / x64](https://www.ctfrecipes.com/pwn/architectures/x86-x64.md) - [Registers](https://www.ctfrecipes.com/pwn/architectures/x86-x64/registers.md): Main x86 and x64 registers - [Instruction set](https://www.ctfrecipes.com/pwn/architectures/x86-x64/instruction-set.md) - [Calling convention](https://www.ctfrecipes.com/pwn/architectures/x86-x64/calling-convention.md) - [Stack exploitation](https://www.ctfrecipes.com/pwn/stack-exploitation.md) - [Stack Buffer Overflow](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow.md) - [Dangerous functions](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/dangerous-functions.md) - [gets](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/dangerous-functions/gets.md) - [memcpy](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/dangerous-functions/memcpy.md) - [sprintf](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/dangerous-functions/sprintf.md) - [strcat](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/dangerous-functions/strcat.md) - [strcpy](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/dangerous-functions/strcpy.md) - [Basics](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/basics.md): Data overwrite - [Challenge example](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/basics/challenge-example.md) - [Instruction pointer Overwrite](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/instruction-pointer-overwrite.md): Arbitrary Instruction redirection - [Challenge example](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/instruction-pointer-overwrite/challenge-example.md) - [De Bruijn Sequences](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/de-bruijn-sequences.md): "Calculating" offset - [Stack reading](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/stack-reading.md): Bruteforce as stack reader - [Challenge example](https://www.ctfrecipes.com/pwn/stack-exploitation/stack-buffer-overflow/stack-reading/challenge-example.md) - [Format string](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string.md) - [Dangerous functions](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/dangerous-functions.md) - [printf](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/dangerous-functions/printf.md) - [fprintf](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/dangerous-functions/fprintf.md) - [Placeholder](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/specifier.md) - [Data Leak](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/data-leak.md) - [Challenge example](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/data-leak/challenge-example.md) - [Data modification](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/data-modification.md) - [Challenge example](https://www.ctfrecipes.com/pwn/stack-exploitation/format-string/data-modification/data-modification.md) - [Arbitrary code execution](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution.md) - [Shellcode](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/arbitrary-code-execution.md) - [ret2reg](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/ret2reg.md): Using register - [Code reuse attack](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack.md) - [Ret2plt](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/ret2plt.md): ASLR bypass - [Ret2dlresolve](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/ret2dlresolve.md): Resolving an arbitrary libc functions - [GOT Overwrite](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/got-overwrite.md) - [Ret2LibC](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/ret2libc.md) - [Leaking LibC](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/leaking-libc.md): ASLR bypass - [Ret2csu](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/ret2csu.md): Controlling registers - [Return Oriented Programming - ROP](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/return-oriented-programming-rop.md) - [Sigreturn Oriented Programming - SROP](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/sigreturn-oriented-programming-srop.md): A syscall to rule them all - [Blind Return Oriented Programming - BROP](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/blind-return-oriented-programming-brop.md) - [Challenge example](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/blind-return-oriented-programming-brop/challenge-example.md) - [Call Oriented Programming - COP](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/call-oriented-programming-cop.md) - [Jump Oriented Programming - JOP](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/jump-oriented-programming-jop.md) - [One gadget](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/code-reuse-attack/one-gadget.md): Quick win - [Stack pivoting](https://www.ctfrecipes.com/pwn/stack-exploitation/arbitrary-code-execution/stack-pivoting.md): ROP with a small buffer - [Heap exploitation](https://www.ctfrecipes.com/pwn/heap-exploitation.md) - [Heap overflow](https://www.ctfrecipes.com/pwn/heap-exploitation/heap-overflow.md) - [Challenge example](https://www.ctfrecipes.com/pwn/heap-exploitation/heap-overflow/challenge-example.md) - [Use after free](https://www.ctfrecipes.com/pwn/heap-exploitation/use-after-free.md) - [Challenge example](https://www.ctfrecipes.com/pwn/heap-exploitation/use-after-free/challenge-example.md) - [Double free](https://www.ctfrecipes.com/pwn/heap-exploitation/double-free.md): Arbitrary write - [Unlink exploit](https://www.ctfrecipes.com/pwn/heap-exploitation/unlink-exploit.md) - [Protections](https://www.ctfrecipes.com/pwn/protections.md) - [Stack Canaries](https://www.ctfrecipes.com/pwn/protections/stack-canaries.md): Buffer Overflow prevention - [No eXecute](https://www.ctfrecipes.com/pwn/protections/no-execute.md): The shellcode prevention - [PIE](https://www.ctfrecipes.com/pwn/protections/pie.md): Position Independent Executable - [ASLR](https://www.ctfrecipes.com/pwn/protections/aslr.md): Address Space Layout Randomisation - [RELRO](https://www.ctfrecipes.com/pwn/protections/relro.md): Relocation Read-Only - [Integer overflow](https://www.ctfrecipes.com/pwn/integer-overflow.md)