Crypto Cheatsheet for CTFs

Wed, 27 Aug 2025 00:00:00 +0000

Cryptography challenges are one of the most common categories in Capture the Flag (CTF) competitions. This guide provides a focused overview of essential algorithms, how to recognize them, common weaknesses exploited in CTFs, and practical resources for practice.

Common CTF Crypto Patterns

Flags often follow formats like CTF{...}, which can help in known-plaintext scenarios.
Key reuse across ciphertexts can allow XOR analysis.
Small RSA exponents (e = 3) can lead to direct root extraction if the plaintext is small.
Small primes allow for easy factorization of RSA moduli.
Padding issues in AES frequently lead to oracle-style attacks.
Images encrypted with ECB will show visible repeated patterns.

Tools

CyberChef - versatile tool for conversions, encodings, and ciphers.
CacheSleuth MultiDecoder - automated format and cipher detection. Easily my favorite tool.
dCode - classical cipher solvers and crypto utilities.
RsaCtfTool - specialized RSA attack tool.

Core Algorithms

RSA

RSA is an asymmetric encryption algorithm based on modular arithmetic with large primes.

Gaining Interactive Shells

Tue, 26 Aug 2025 00:00:00 +0000

Often when uploading a reverse shell on a webserver we are dealing with non-interactive shell. This means it doesn’t prompt us for user input or display output in real-time in a traditional terminal window.

The biggest problem with a non-interactive shell is that you can’t run su or sudo.

Useful ways to upgrade your shell to an interactive one:

python -c 'import pty; pty.spawn("/bin/sh")'

When to use it: Almost always the first go-to if Python is available on the target. After spawning, run Ctrl-Z and then stty raw -echo; fg on your local terminal to fully fix arrow keys and job control.

Cheatsheet on XSS3cut10n3r

Crypto Cheatsheet for CTFs

Common CTF Crypto Patterns

Tools

Core Algorithms

RSA

Gaining Interactive Shells