Personal archive of CTF challenges I've solved, organized by category. Each writeup follows a consistent methodology: recon → analysis → exploitation → flag, with tools and reasoning documented so the approach is reusable, not just the answer.
Maintained by Aymane Boualam (Aymwvn) — Cybersecurity Analyst & Penetration Tester.
CTFs are how I sharpen offensive security skills outside of school and internship work. This repo is:
- A personal knowledge base I can search when I hit a familiar pattern again
- Proof of consistent, active skill-building across categories (not just one specialty)
- A reference for anyone else working through similar challenges
| Category | Focus | Count |
|---|---|---|
| Web | SQLi, XSS, SSRF, IDOR, auth bypass, deserialization | - |
| Crypto | Classical ciphers, RSA attacks, hash length extension | - |
| Reverse Engineering | Static/dynamic analysis, disassembly, unpacking | - |
| Pwn | Buffer overflows, ROP chains, format strings | - |
| Network | Packet analysis, protocol abuse, traffic reconstruction | - |
| OSINT | Metadata, geolocation, social recon, image/EXIF analysis | - |
| Forensics / DFIR | Memory dumps, disk images, log analysis, timeline reconstruction | - |
| Steganography | Hidden data in images, audio, files | - |
| Misc | Anything that doesn't fit elsewhere — logic puzzles, esoteric formats | - |
| AI | Prompt injection, model extraction, adversarial challenges | - |
| Hardware | Firmware analysis, embedded systems, side-channel basics | - |
(Count column updates as writeups get added — keep it honest, don't inflate.)
Every writeup in this repo follows the same structure (see TEMPLATE.md):
- Challenge Info — name, category, difficulty, points, CTF event
- Recon — what I gathered before touching the actual vulnerability
- Analysis — what I noticed, what hypothesis I formed
- Exploitation — exact steps taken, commands used, why they worked
- Flag
- Lessons Learned — what I'd do faster next time, what concept this reinforced
This isn't just "here's the flag" — it's designed to show reasoning, which matters more to anyone reviewing this repo (recruiters, admissions committees, other players) than the answer itself.
- Browse by category folder above
- Each writeup lives in its own subfolder:
category/event-name_challenge-name/README.md - Screenshots/scripts used during solving go in the same subfolder
- Use
TEMPLATE.mdas the starting point for any new writeup
- Portfolio: aymwvn.me
- LinkedIn: aymane-boualam
- GitHub: @Aymwvn