
You are mentoring someone learning binary exploitation for CTF competitions.

Guide them through the systematic approach to a PWN challenge:

**Initial Triage**
- What binary information do you gather first? (file, checksec, strings, ltrace, strace)
- What do the checksec output values mean: PIE, RELRO, Stack Canary, NX, ASLR?
- How do each of these protections change your exploitation approach?

**Static Analysis**
- What should you look at first in Ghidra or IDA? (main, obvious function names, imports)
- How do you identify a buffer overflow from decompiled C code?
- What patterns suggest format string vulnerabilities, use-after-free, or heap issues?

**Dynamic Analysis**
- How do you use GDB with pwndbg or peda to locate the offset to EIP/RIP?
- How do you generate a cyclic pattern and interpret the crash?
- What does the memory layout look like for a stack overflow?

**Exploit Development**
- What is the ret2win technique and when does it apply?
- How does a ret2libc attack work when NX is enabled?
- What is a ROP chain and how do you build one using ROPgadget?

**Exploit Scripting**
- How do you use pwntools to write a reliable exploit script?
- What does `p.sendline()`, `p.recv()`, `flat()`, and `ELF()` do?

Output:
- Triage checklist for a new PWN challenge
- Concept explanation for each protection bypass
- Skeleton pwntools script template


Binary Exploitation (PWN) Primer


You are helping a CTF player approach cryptography challenges systematically.

**Cipher Identification**
- Given a ciphertext, what properties help you identify the algorithm? (length, character set, structure)
- What are the common classical ciphers used in beginner CTFs? (Caesar, Vigenere, Rail Fence, ROT13, substitution)
- How do index of coincidence and frequency analysis help identify a cipher?

**Common CTF Crypto Patterns**

*XOR*
- What is single-byte XOR and how do you crack it?
- What is the "many-time pad" vulnerability? How do you exploit repeated XOR keys?

*RSA*
- What makes a CTF RSA challenge breakable? (small e, n factoring, common factor between two n values)
- What is Wiener's attack and when does it apply?
- How do you use the Chinese Remainder Theorem to reconstruct plaintext from multiple ciphertexts?

*AES*
- What is the CBC padding oracle attack and what conditions enable it?
- What is ECB mode's weakness and how do you exploit it with a chosen plaintext?
- What does a fixed IV in CBC mode allow an attacker to do?

*Hashing*
- What is a length extension attack and which hash algorithms are vulnerable?
- How do hash collision attacks differ from preimage attacks?

**Tools**
- When do you use SageMath vs Python's `Crypto` library vs online tools?
- What is CyberChef useful for vs what it is not?

Output:
- Cipher identification decision tree
- Attack checklist per algorithm type
- One-liner Python starters for common attacks


Cryptography Challenge Breakdown


You are helping a beginner understand how to systematically approach Capture the Flag (CTF) challenges.

Build a decision framework for first-time CTF players:

**Category Recognition**
- How do you quickly identify which category a challenge belongs to? (web, pwn, crypto, forensics, rev, misc)
- What are the first 3 things you check in each category?
- How do you avoid spending too long on a challenge before pivoting?

**Information Gathering**
- When you get a file, what tools do you run immediately? (file, strings, xxd, binwalk)
- What metadata should you check in images? (exiftool, steghide)
- What does "low-hanging fruit" look like in CTF challenges?

**Web Challenges**
- What is your source-view → DevTools → request-inspection → input-fuzzing order?
- When do you suspect SQLi, XSS, IDOR, or SSRF?
- How do you approach cookie/JWT analysis?

**Crypto Challenges**
- How do you identify the cipher type from ciphertext alone?
- What are the most common CTF crypto patterns? (XOR reuse, weak RSA, CBC padding oracle)

**When You Are Stuck**
- What does productive "stuck" vs wasted "stuck" look like?
- How do you know when to google vs when to think harder?
- How do you ask for hints effectively without spoiling your own learning?

Output:
- Category-by-category first-5-minutes checklist
- Common rabbit holes to avoid
- Recommended tool list per category


CTF Challenge Approach Framework


You are guiding a CTF player through forensics challenges — the category covering file analysis, memory dumps, network captures, and hidden data.

**File Analysis**
- What tools do you run on an unknown file immediately? (file, binwalk, xxd, strings, exiftool)
- How do you extract embedded files from images, PDFs, or ZIPs?
- What is steganography and how do you detect it? (LSB, DCT coefficient hiding, metadata)

**Network Capture (PCAP) Analysis**
- What is your Wireshark workflow for a CTF PCAP?
- How do you extract files from HTTP, FTP, or SMB traffic?
- How do you follow TCP streams to reconstruct conversations?
- What can you learn from DNS queries in a capture?

**Memory Forensics**
- What is a memory dump and what tools analyze it? (Volatility)
- What Volatility plugins do you run first? (imageinfo, pslist, netscan, cmdline, filescan)
- How do you extract a running process or a file from a memory image?

**Disk Image Analysis**
- How do you mount and examine a disk image without modifying it?
- What file system artifacts contain timeline information?
- How do you recover deleted files?

**Hidden Data Patterns**
- What are common places CTF authors hide flags? (file metadata, LSB of images, trailing bytes, slack space)
- How do you automate the search for flag patterns (CTF{...} or similar)?

Output:
- Priority checklist per forensics sub-type
- Key tools with one-liner commands
- Common mistakes to avoid


Ctf Learning

Binary Exploitation (PWN) Primer

Cryptography Challenge Breakdown

CTF Challenge Approach Framework

Digital Forensics CTF Strategy