Solutions and notes from the CTFs I play.
Written by Roma476: 17-year-old CS student and cybersecurity enthusiast.
55 write-ups across web, binary/pwn, crypto, network, misc and OSINT, from OliCyber, m0leCon, ITSOS CTF and Team Radium training.
This repository is where I write down how I solved each challenge. I try to focus on the reasoning, not just the flag: how I read the challenge, what I tried, why it worked, and what I would do differently next time. Some write-ups are short because the challenge was short; the longer ones are the ones where I learned the most.
| Write-ups | 55 |
| Events | 14 (2021-2026) |
| Categories | web 25, binary/pwn 17, crypto 4, network 4, misc 3, OSINT 2 |
| First blood | 1 - HTTP Cats (ITSOS CTF 2026) |
If you only read a few, these are the ones I would pick:
| Write-up | Event | Category | Why start here |
|---|---|---|---|
| HTTP Cats | ITSOS CTF 2026 | web | First blood; the solution is hidden in HTTP status codes. |
| mappa | OliCyber 2026 - Territorial selection | binary | Longest write-up: reversing a flag checker step by step. |
| MIC | OliCyber 2024 - National final | binary | Binary exploitation at the national final, with mitigations enabled. |
| Age Calculator Pro | OliCyber 2024 - Territorial selection | pwn | Format string leak plus ret2win: a clean first pwn chain. |
| Emergency Call | OliCyber Training | binary | Static binary, no libc, hand-written syscalls: a lesson in reading assembly. |
Every write-up, grouped by year and event. The text in parentheses next to each link is the category and the number of solves from the original event.
| Year | Event | Write-ups |
|---|---|---|
| 2021 | m0leCon 2021 - Beginner CTF | how lucky you are (binary, 181) |
| 2023 | OliCyber 2023 - Training Camp 1 | runme (binary, 499) Gabibbo Says (web, 864) |
| OliCyber 2023 - Training Camp 2 | SSH login (network, 427) | |
| OliCyber 2023 - Training Camp 3 | obbibag (binary, 317) È tutto solo una convenzione (web, 470) |
|
| OliCyber 2023 - Territorial selection | Frasi basate (binary, 665) Gabibbo's friend (web, 675) Gabibbo Innovazione Tecnologica (misc, 331) |
|
| HighSchools CTF Workshop 2023 - Bari | CookieC(TF)liker1 (web, 656) CookieC(TF)liker2 (web, 573) ITASECshop - 1mln$ Flag (web, 611) ITASECshop - Fridge Flag (web, 400) HEXacly 5 t1mes (crypto, 400) X0rland1a (crypto, 267) Suonano al citofono... (osint, 455) Un giro sugli "alberi" (osint, 293) |
|
| HighSchools CTF Workshop 2023 - Perugia | calcolatrice (web, 253) trova_le_soluzioni (web, 437) trova_le_soluzioni2 (web, 291) trova_le_soluzioni3 (web, 216) Bautiful Content (network, 213) |
|
| HighSchools CTF Workshop 2023 - Verona | find-me (web, 223) Weird Device (web, 253) My briefcase (network, 218) |
|
| m0leCon 2023 - Beginner CTF | The Wall (binary, 120) | |
| 2024 | OliCyber 2024 - Territorial selection | Age Calculator Pro (pwn, 131) section31 (pwn, 328) Pretty please (web, 889) |
| OliCyber 2024 - National final | MIC (binary, 90) Guess the Flag! (web, 352) |
|
| 2025 | OliCyber 2025 - Territorial selection | Baity5 (binary, 211) La pazienza è la virtù dei forti (web, 617) Insecure Passphrase Generator (crypto, 235) |
| 2026 | OliCyber 2026 - Territorial selection | mappa (binary, 54) Trace the void (binary, 93) Useless login (web, 143) |
| ITSOS CTF 2026 | HTTP Cats (hard) (web, 1, first blood) | |
| N/A | OliCyber Training | Emergency Call (binary, 216) Formatted (binary, 420) Hidden Variable (binary, 1127) Super Market (binary, 1177) Click Me (web, 3362) Flag Shop (web, 2156) Headache (web, 3362) No Robots Here (web, 3249) Password Changer 3000 (web, 1838) Tutte le strade portano a Roma (crypto, 2409) G4tto (network, 2000) 2048 (misc, 1355) Byte-flag (misc, 2600) |
| Team Radium training | Banca Benty (binary, 25) Binario Sus (binary, 8) Includimi (web, 6) Spaccami Easy (web, 29) |
N/A marks the training collections, which are not tied to a single year.
Each write-up lives at a predictable path:
<platform>/<event>/<category>/<challenge>.md
For example:
olicyber/2024-national/binary/MIC.md
team-radium-training/web/http-cats.md
The repository contains write-ups only. No challenge binaries or files.
New write-ups follow this structure:
# Challenge name
| | |
|---|---|
| **Section** | Event name |
| **Category** | web |
| **Solves** | 123 |
## Overview
What the challenge gives you and what it asks for.
## Solve
The reasoning, the commands, and the payloads, in the order I actually used them.
- Solves comes from the original challenge metadata and is kept for context, not as a ranking.
- Flags are intentionally omitted: some platforms may consider publishing them flag sharing.
- Language: write-ups are in English; some challenge titles are in Italian because that was the original name.
Everything here is for educational purposes. Do not use these techniques on systems you do not own or have permission to test.