$ ctf42

Pwn CTF challenges

3,926 Pwn CTF challenges from 382 CTFs (2011–2026), 1,025 with writeups.

Top pwn techniques

#stack-buffer-overflow 95 #format-string 88 #rop 76 #use-after-free 56 #ret2win 55 #shellcode 48 #ret2libc 37 #heap 35 #heap-overflow 34 #tcache-poisoning 29 #got-overwrite 29 #stack-pivot 25 #buffer-overflow 23 #heap-exploitation 21 #seccomp 19

Challenges

Filter and sort these in the challenge browser →

Challenge CTF Weight Has
easyqemu
#qemu-escape#pmio#heap-overflow
 N1CTF 2022 77.68 files wu 1
Full_Chain_Wall_Maria
#qemu-escape
 HITCON 2023 Quals 99.75 files wu 1
Good_Emulation
#qemu#nx-bypass#shellcode
 TAMUctf 2024 – files wu 1
q3vm
#q3vm-oob
 justCTF 2024 Quals 77.17 files wu 1
seccon_tree
#python-sandbox-escape#c-extension
 SECCON 2021 – files wu 1
finance_calculat0r_2021
#python-sandbox#function-whitelist-bypass#import-alias
 CyberSecurityRumble 2021 41.60 files wu 1
Banking_Issues
#python-negative-index#access-control-bypass
 BxMCTF 2023 – files wu 1
balloon
#python-jail-escape#chroot-sandbox
 Aero 2022 51.22 files wu 1
ordersystem
#python-bytecode
 Hack.lu 2022 93.70 files wu 1
Snaking_Revenge
#pyjnius#type-confusion#jni
 SAS 2026 Quals 31.00 files wu 1
I_want_to_break_free
#pyjail#exec-bypass
 KillerQueen 2021 21.14 files wu 1
RepusPing
#ptr-guard-key-recovery
 MntcrlCTF 2026 25.00 files wu 1
write-flag-where
#proc-self-mem#arbitrary-write
 GoogleCTF 2023 – files wu 1
red40
#proc-pid-mem#rop#gets
 UMassCTF 2024 43.10 files wu 1
lucky
#prng-seed-bruteforce
 TAMUctf 2022 – files wu 1
Game_Changer
#prng-prediction#libc-leak#one-gadget
 TCP1P 2023 97.33 files wu 1
RANDOM
#prng#canary
 TFC 2022 – files wu 1
gambler_baby
#predictable-prng#weak-seeding#binary-patching
 b01lers 2022 33.05 files wu 1
paperweight
#poppler#pdf#heap-overflow#cet#stack-pivot
 Z0d1ak 2026 Quals 25.00 files wu 1
suboptimal_pwning
#pointer-guard-bypass
 hxp 2024 – files wu 1
Zop
#pkzip#zip-format
 Akasec 2024 23.15 files wu 1
PHP_Sandbox_Escape
#php-sandbox-escape#pdo-sqlite#load-extension
 PwnSec 2026 33.89 files wu 1
baby_bypass
#php-sandbox-escape#disable-functions-bypass#oob-read
 0CTF 2020 Quals – files wu 1
ctfhub2
#php-ffi-oob
 N1CTF 2021 53.54 files wu 1
PCI_Config_Mayhem
#pci-config#kernel
 niteCTF 2024 – files wu 1
Payphone
#path-traversal#lfi (local-file-inclusion)#proc-environ
 Haruulzangi 2026 Quals – files wu 1
Directory
#partial-overwrite#ret2win
 BYUCTF 2024 – files wu 1
Gargantuan
#partial-overwrite#ret2plt#ret2libc
 BYUCTF 2024 – files wu 1
vanity_check_ii
#partial-overwrite#got-overwrite
 idekCTF 2021 24.56 files wu 1
messenger
#page-level-uaf
 LA 2025 – files wu 1
trusty_user_diary
#page-cache
 hxp 2021 99.41 files wu 1
babyheap
#overlapping-chunks#fastbin-attack#libc-leak#free-hook
 0CTF 2017 Quals 40.74 files wu 1
plang
#out-of-bounds-write#heap-overlap#tcache-poisoning#malloc-hook-overwrite
 0CTF 2019 Quals – files wu 1
flip-out
#out-of-bounds-read
 TJCTF 2023 – files wu 1
woogie_boogie
#out-of-bounds (oob)#xor-swap#rop
 LA 2024 – files wu 1
CORN
#out-of-bounds (oob)#underflow
 USC 2024 – files wu 1
Music
#out-of-bounds (oob)#soft-bounds-check
 0CTF 2021 Quals – files wu 1
safe_vector
#out-of-bounds (oob)#negative-index#tcache-poisoning#cpp
 zer0pts 2021 24.56 files wu 1
BFS
#out-of-bounds (oob)#heap
 SekaiCTF 2022 24.86 files wu 1
0x00b
#out-of-bounds (oob)#function-pointer
 PwnMe 2022 – files wu 1