NULLSEC CTF

NULLSEC // ACCESS

Personal build for %%PLAYER_HTML%%. Your flags are unique to this copy, so flags copied from anyone else will not work. Nothing is sent anywhere.

NULLSECSINGLE-FILE CTF · v3

0of 0 pts · 0/0 flags

♪ MUSIC70%

SFX70%

M toggles music · Esc closes

NSCTF{}

CAPTURE THE FLAG

WEBCRYPTOSTEGOREVERSINGMISCV3

CAPTURED

01Under the Hood

50 ptsWEBtrivial

Every hunter starts by reading what the browser doesn't show. The first flag is written in this page's HTML for anyone who bothers to look.

Right-click → Inspect (or F12) and look at the very top of the Elements panel. View Source (Ctrl+U) shows the sign-in page, not your game. In the console, document.documentElement.outerHTML works too.

CAPTURED

02Now You See Me

75 ptsWEBeasy

Something is in this card that you cannot see. CSS is a curtain, not a lock.

Inspector tab, expand this section, look for display:none.

CAPTURED

03Sixty-Four Shades

100 ptsCRYPTOeasy

A developer left a "secure token" on the submit button. They believe it is encrypted. It is not.

Inspect the SUBMIT button's attributes. Then atob("...") in the console.

CAPTURED

04Et Tu, Brute?

100 ptsCRYPTOeasy

An intercepted transmission. The sender rotated every letter by a fixed amount, as emperors do.

%%F4_ROT13%%

Plaintext starts with CTF. P→C is a shift of 13. Digits don't move.

CAPTURED

05Cookie Monster

125 ptsWEBmedium

This page remembers you. When it loaded, it set something it shouldn't have. The flag is in the jar, but someone twisted the lid.

document.cookie in the console. The value is URL-encoded and reversed.

CAPTURED

06Admin Panel

150 ptsREVERSINGmedium

The admin panel is "protected" by a login form. The check runs in your browser, which is hardware you own.

Find the login handler in the script. The password is built from pieces. Or call the reveal function directly.

CAPTURED

07Console Cowboy

150 ptsMISCmedium

Not everything is in the DOM. Something has been talking to you in the console since the page loaded. It wants you to answer back.

Open the Console tab. Read. There is a global function waiting for the right argument.

CAPTURED

08Exclusive Or

200 ptsCRYPTOhard

XOR-encrypted with a repeating 4-byte lowercase key. The key is simply what you have been doing for the last seven challenges.

%%F8_XOR%%

Known plaintext: the first four bytes decrypt to CTF{, so key[i] = c[i] ^ "CTF{".charCodeAt(i).

CAPTURED

09Ghost Writer

75 ptsSTEGOeasy

An intern left a note. They swear they deleted the sensitive part. They did not; they just made it match the wallpaper.

MEMO: Rotate all credentials before Friday. The old API key was %%F9%% and should no longer be used anywhere.

Ctrl+A on the page. Or drag-select across the note. Text with the same color as its background is still text.

CAPTURED

10Least Significant

175 ptsSTEGOhard

This looks like random noise. It is 99% random noise. The remaining 1% is the lowest bit of each red channel value, read left to right, top to bottom, 8 bits per character.

const d=steg.getContext("2d").getImageData(0,0,64,64).data; then collect d[i*4]&1 for each pixel, group by 8, convert to chars until you hit a null byte.

CAPTURED

11Cheat Code

100 ptsMISCeasy

Thirty extra lives. Ten keystrokes. Gamers born before 1995 need no hint. Click anywhere on the page first so it hears you.

↑ ↑ ↓ ↓ ← → ← → B A. Type it with the page focused, not inside an input.

CAPTURED

12Hovercraft

100 ptsWEBeasy

Every tile holds one character. Sweep your cursor across the grid and read in order. Or be lazy and read the attributes.

Tiles are arranged left-to-right, top-to-bottom. Grey tiles are decoys, amber ones are real. Or: [...hgrid.querySelectorAll("i:not([data-d])")].map(i=>i.dataset.c).join("").

CAPTURED

13Guest Shell

150 ptsMISCmedium

You have a guest shell on the NULLSEC box. No sudo for you. But guests get careless about what they leave in their home directory.

Type help. Files starting with a dot don't show up in a plain ls.

CAPTURED

14Don't Blink

125 ptsWEBmedium

The status display is stable. Mostly. Every few seconds it glitches for a fraction of a frame and shows something it shouldn't.

SYSTEM STABLE

Pause the animation in DevTools (Animations panel), or just inspect the element and look at where the ::before gets its content from.

CAPTURED

15Backdoor

125 ptsWEBmedium

Developers leave debug switches in production all the time. This page has one. You just need to ask for it in the address bar.

Search the script for location.search and see which parameter and value it wants. Then reload with ?that=this.

CAPTURED

16Ten Thousand

175 ptsCRYPTOhard

A 4-digit PIN protects the vault. We only store its SHA-256. That's secure, right? There are only ten thousand possibilities, and you have a loop.

%%PIN_HASH%%

The page exposes sha256(str) globally. for(let i=0;i<10000;i++){const p=String(i).padStart(4,"0"); if(sha256(p)===pinhash.textContent) console.log(p)}. Then tryPin("....").

CAPTURED

17Shattered

150 ptsMISCmedium

The flag was rendered as an image and then shattered into nine tiles. Drag tiles onto each other to swap them. Reassemble it, or find a shortcut.

Each tile has a data-pos attribute saying where it belongs. Or just solve the puzzle; it's only nine pieces.

CAPTURED

18Look Away

125 ptsMISCmedium

This page gets lonely when nobody is watching. It says things it would never say to your face. Switch to another tab and glance back at this one's title.

👁

Open a second tab, then look at this tab's title in the tab strip. Or search the script for visibilitychange.

BLAST DOOR · TIER 2 · UNLOCKS AT 12 FLAGS

CAPTURED

19Dits and Dahs

150 ptsSTEGOmedium

A numbers station, but shorter. Press play and listen. The transmission spells the inside of the flag in a very old alphabet. Gaps between words are underscores. Lowercase.

Morse code. Short beep = dot, long beep = dash. The message is four words. Digits are in it. The flag is CTF{word_word_word_word}.

CAPTURED

20Undocumented

150 ptsWEBmedium

This page ships an internal API. Only one route is documented. The others are a fetch() away, and one of them wants a header.

// GET /api/v1/health   → service status
// everything else      → undocumented

Try the API root /api/v1. It lists routes. One route leaks a token, another route demands it as X-API-Token.

CAPTURED

21Binary Vault

250 ptsREVERSINGhard

The flag bytes are XOR-encrypted and the key schedule lives inside a WebAssembly module, not in JavaScript. The module is loaded and its exports are on window.__wasm. The ciphertext is on window.__vault.

loading module…

The export takes a byte index and returns the key byte for that position. __vault.map((b,i)=>String.fromCharCode(b ^ __wasm.key(i))).join(""). Or disassemble the 47-byte module by hand and work out the formula.

CAPTURED

22The Answer

125 ptsMISCeasy

The flag is displayed below for exactly one second every minute. Which second? The one that is the answer to life, the universe and everything.

--:--:--

Wait for :42. Or be impatient and override Date.prototype.getSeconds in the console.

CAPTURED

23None Shall Pass

200 ptsCRYPTOhard

You hold a signed JWT that says you are a guest. The verifier checks the signature with a secret you'll never get. But it also honours whatever algorithm the token claims to use.

Build a header {"alg":"none","typ":"JWT"} and a payload with "role":"admin", base64url both, join with a dot, and leave the signature empty: header.payload.

CAPTURED

24Tab Bar Pixels

150 ptsSTEGOmedium

Look at this tab's icon. Sixteen by sixteen pixels of noise. Each pixel carries three characters of the flag in its red, green and blue channels, in reading order, until a zero byte.

The icon is a data URL on link[rel=icon]. Load it into an Image, draw it on a canvas, read the pixels.

The preview canvas above is the same image. const d=favbig.getContext("2d").getImageData(0,0,16,16).data; then take d[i], d[i+1], d[i+2] for every i+=4.

BLAST DOOR · TIER 3 · UNLOCKS AT 20 FLAGS

CAPTURED

25Side Channel

200 ptsCRYPTOhard

The vault wants a 6-character hex access code. It never says how close you are. But it checks one character at a time, and it lingers over every character it likes. It also tells you exactly how long it took.

Each correct leading character adds about 40 ms. Try all 16 values for position one and keep the slowest, then move on. There is a little jitter, so if two guesses look close, measure them again. The console has await tryCode("a00000") returning {ok, ms}.

CAPTURED

26Split Key

250 ptsCRYPTOhard

This flag is sealed with AES-256-GCM. The key was never stored. It is the SHA-256 of two flags you may already own, joined by a pipe: flag 21 | flag 23, as raw bytes.

iv = %%AES_IV%%
ct = %%AES_CT%%
(both base64 · tag is the last 16 bytes of ct)

The page's global sha256() returns hex: sha256(flag21 + "|" + flag23). Paste that into the key box. No separators, no spaces, both full flags including CTF{}.

CAPTURED

27Behind You

150 ptsMISCmedium

Someone painted a flag on the wall behind the corridor entrance. Everyone walks straight past it, because nobody ever turns around. The camera rig can turn. Nobody told you how.

Read the corridor's keydown handler. One letter turns the camera 180°. Go back to the entrance first, then press it with nothing focused.

CAPTURED

28Draw Calls

175 ptsREVERSINGhard

The flag is painted onto this canvas every time it redraws. You will never see it: it is drawn at almost zero opacity, buried under decoys and noise. Pixels lie. Function calls don't.

Wrap CanvasRenderingContext2D.prototype.fillText to log text, x and this.globalAlpha, then press REDRAW. Keep only the nearly invisible calls and sort them by x.

CAPTURED

29Breadcrumbs

150 ptsMISCmedium

Someone left a trail through this corridor, one glowing glyph at a time, up near the ceiling. You have flown under all of it. Read the glyphs in the order you pass them, from the entrance onward.

Fly slowly and look up. Or inspect the .crumb elements: their DOM order is shuffled, but each one's depth is in its --z style. Sort by depth.

CAPTURED

30Shadow Realm

125 ptsWEBmedium

The vault below is a custom element with a closed shadow root. Page scripts cannot reach inside it. Your browser's own tools play by different rules.

Open the Elements panel and expand null-vault. DevTools shows #shadow-root (closed). Inside is a template, whose content never renders.

THE CORE · UNLOCKS AT 27 FLAGS

DEFEATED

31NULL // The Core

500 ptsBOSSfinal

NULL

100%

STANDBY

%%BOSS_CIPHER%%

Phase 1 is a Vigenère cipher and the key is the boss's signature. Phase 2 is a memory game: repeat the 8 flashes, keys 1–4 work. Phase 3 is a hex dump: each block is "NULL", a length byte, a key byte, then that many bytes XORed with the key. Only the last block is real. The timer pauses when you leave the arena or hide the tab.

ALL FLAGS CAPTURED

Source, DOM, Base64, ROT13, cookies, client-side auth, console, XOR, ghost text, LSB steganography, cheat codes, hover grids, a fake shell, a flicker, a backdoor, a PIN brute-force, a puzzle, a lonely tab, Morse code, a hidden API, a WebAssembly vault, a timed reveal, a forged JWT, a favicon, a timing leak, a split key, the wall behind you, invisible draw calls, a breadcrumb trail, a closed shadow root, and you took down NULL itself. All in one HTML file.

END OF CORRIDOR
NULLSEC CTF v3 · everything is client-side

DEPTH 0000 m · SECTOR 00

◀ REAR VIEW ▶press T to face forward

SCROLL ▼ TO ENTER THE CORRIDOR · J / K TO JUMP

🏆 LEADERBOARD

Everyone who signed up in this browser, plus anyone whose verification code you imported. No server: codes are signed hashes you trade by hand.

#	handle	flags	pts	time	last capture

#	challenge	time	hint