The demo/practice round preceding the 2026 regional competition. Covers binary exploitation, cryptography, miscellaneous challenges, and web vulnerabilities.
Use strace to trace the runtime syscalls of a binary and read the secret it loads from a file.
Send a single HTTP OPTIONS request with the exact query param, header, cookie, and body the server expects simultaneously.
Automate solving 100 consecutive linear equations within a single HTTP session to unlock the flag.
Reverse a three-step transformation (reverse + rotate + XOR) applied to a 36-byte target symbol to recover the flag.
Leak the stack canary via a controlled print function, then overflow to overwrite the return address without triggering the canary check.
Union-based SQL injection in a card lookup form to enumerate tables via sqlite_master and extract the flag.
Escape a JavaScript string context inside a script tag by injecting a closing script tag that the sanitizer fails to block.