Added CTFlearn writeups

Binary/Favorite Color/README.md

@@ -0,0 +1,15 @@
+## Favorite Color
+The main idea finding the flag is exploiting the Buffer Overflow of the Binary file.
+
+#### Step-1:
+After logging into the remote access with `ssh color@104.131.79.111 -p 1001` and password as `guest`,
+my system got completely crashed due to several DDoS attacks. So, I directly looked up for solution and understood from there.
+
+https://www.embeddedhacker.com/2020/01/hacking-walkthrough-ctflearn-binary-medium/
+
+
+
+#### Step-2:
+
+Finally the flag becomes:
+`flag{c0lor_0f_0verf1ow}`

Binary/Lazy Game Challenge/README.md

@@ -0,0 +1,22 @@
+## Lazy Game Challenge
+The main idea finding the flag is thinking differently to break the logic in binary file.
+
+#### Step-1:
+After pwning into the given machine: `nc thekidofarcrania.com 10001`, we are asked to play a betting game.
+
+#### Step-2:
+I input <strong>Y</strong> and proceed to see the game. According to given scenario, I seemed to lose every bet of 100$. So I had to do something differently.
+
+#### Step-3:
+This time I placed a bet of a hefty number like 1000000$ which I didn't even possess. I spit out errors. :(
+
+#### Step-4:
+But the main idea in pwning lies in abnormal thinking and that's where you focus. I tried out negative number this time for the bet like -100000$. I still could play, it shows there was a program logic flaw there.
+
+Now I went wild to give all numbers (which I had to guess below 10) greater than 10. Finally it gave me flag.
+
+<img src="Flag.png">
+
+#### Step-3:
+Finally the flag becomes:
+`CTFlearn{d9029a08c55b936cbc9a30_i_wish_real_betting_games_were_like_this!}`

Cryptography/5x5 Crypto/Flag.py

@@ -0,0 +1,14 @@
+import numpy as np
+
+arr = np.arange(65,90).reshape(5, 5) # Array of alphabet
+arr = np.where(arr <75, arr, arr+1)  # Array without 'K' 
+
+cells = ["1-3","4-4","2-1","{","4-4","2-3","4-5","3-2","1-2","4-3","_","4-5","3-5","}"] 
+for i in cells:
+	if(ord(i[0])>=48 and ord(i[0])<=57):
+		x=int(i[0])-1
+		y=int(i[2])-1
+		print(chr(arr[x][y]),end="")
+	else:
+		print(i[0],end="")
+print("\n")

Cryptography/5x5 Crypto/README.md

@@ -0,0 +1,47 @@
+## 5x5 Crypto
+The main idea finding the flag is by simple pairs.
+
+#### Step-1:
+After reading the given text:
+
+`Ever heard of the 5x5 secret message system? If not, basically it's a 5x5 grid with all letters of the alphabet in order, without k because c is represented to make the k sound only. Google it if you need to. A letter is identified by Row-Column. All values are in caps. Try: 1-3,4-4,2-1,{,4-4,2-3,4-5,3-2,1-2,4-3,_,4-5,3-5,}`
+
+#### Step-2:
+So, basically the table is:
+
+<img src="Table.png">
+
+We can decode the message according to given inputs in message above to get the flag.
+
+#### Step-3:
+Instead I wrote a `Flag.py` script to get the flag.
+
+```
+import numpy as np
+
+arr = np.arange(65,90).reshape(5, 5) # Array of alphabet
+arr = np.where(arr <75, arr, arr+1)  # Array without 'K' 
+
+cells = ["1-3","4-4","2-1","{","4-4","2-3","4-5","3-2","1-2","4-3","_","4-5","3-5","}"] 
+for i in cells:
+	if(ord(i[0])>=48 and ord(i[0])<=57):
+		x=int(i[0])-1
+		y=int(i[2])-1
+		print(chr(arr[x][y]),end="")
+	else:
+		print(i[0],end="")
+print("\n")
+```
+
+#### Step-4:
+
+If we execute this script by `python3 Flag.py`, I got the following output:
+
+```
+CTF{THUMBS_UP}
+
+```
+#### Step-5:
+
+Finally the flag becomes:
+`CTF{THUMBS_UP}`

Cryptography/ALEXCTF CR2_ Many time secrets/README.md

@@ -0,0 +1,29 @@
+## ALEXCTF CR2: Many time secrets
+The main idea finding the flag is decomposing the Hex dump and finding the public key.
+
+#### Step-1:
+After we download `msg(4)` from the cloud, we get the following data.
+
+`0529242a631234122d2b36697f13272c207f2021283a6b0c79082f28202a302029142c653f3c7f2a2636273e3f2d653e25217908322921780c3a235b3c2c3f207f372e21733a3a2b37263b3130122f6c363b2b312b1e64651b6537222e37377f2020242b6b2c2d5d283f652c2b31661426292b653a292c372a2f20212a316b283c0929232178373c270f682c216532263b2d3632353c2c3c2a293504613c37373531285b3c2a72273a67212a277f373a243c20203d5d
+243a202a633d205b3c2d3765342236653a2c7423202f3f652a182239373d6f740a1e3c651f207f2c212a247f3d2e65262430791c263e203d63232f0f20653f207f332065262c31683137223679182f2f372133202f142665212637222220733e383f2426386b`
+
+Working out:
+https://youtu.be/p4DIab6NKOY?t=307
+
+The link for this tool is below:
+https://github.com/SpiderLabs/cribdrag
+
+#### Step-2:
+
+I didn't have complete idea on proceeding on this challenge, so I took help from online and got this.
+
+https://youtu.be/p4DIab6NKOY?t=307
+
+#### Step-3:
+Alternatively, same flag can be approached in another way also.
+
+https://www.embeddedhacker.com/2020/01/hacking-walkthrough-ctflearn-crypto-medium/
+
+#### Step-4:
+Finally the flag becomes:
+`ALEXCTF{HERE_GOES_THE_KEY}`

Cryptography/ALEXCTF CR2_ Many time secrets/cribdrag.py

@@ -0,0 +1,104 @@
+#!/usr/bin/python
+
+##########################
+# cribdrag - An interactive crib dragging tool
+# Daniel Crowley
+# Copyright (C) 2013 Trustwave Holdings, Inc.
+# This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
+# This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+# You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.
+##########################
+
+
+import sys
+import re
+import argparse
+
+def sxor(ctext,crib):    
+    # convert strings to a list of character pair tuples
+    # go through each tuple, converting them to ASCII code (ord)
+    # perform exclusive or on the ASCII code
+    # then convert the result back to ASCII (chr)
+    # merge the resulting array of characters as a string
+    results = []
+    single_result = ''
+    crib_len = len(crib)
+    positions = len(ctext)-crib_len+1
+    for index in xrange(positions):
+        single_result = ''
+        for a,b in zip(ctext[index:index+crib_len],crib):
+            single_result += chr(ord(a) ^ ord(b))
+        results.append(single_result)
+    return results
+
+def print_linewrapped(text):
+    line_width = 40
+    text_len = len(text)
+    for chunk in xrange(0,text_len,line_width):
+        if chunk > text_len-line_width:
+            print str(chunk) + chr(9) + text[chunk:]
+        else:
+            print str(chunk) + chr(9) + text[chunk:chunk+line_width]
+
+
+
+parser = argparse.ArgumentParser(description='cribdrag, the interactive crib dragging script, allows you to interactively decrypt ciphertext using a cryptanalytic technique known as "crib dragging". This technique involves applying a known or guessed part of the plaintext (a "crib") to every possible position of the ciphertext. By analyzing the result of each operation and the likelihood of the result being a successful decryption based on the expected format and language of the plaintext one can recover the plaintext by making educated guesses and adaptive application of the crib dragging technique.')
+parser.add_argument('ciphertext', help='Ciphertext, encoded in an ASCII hex format (ie. ABC would be 414243)')
+parser.add_argument('-c', '--charset', help='A regex-style character set to be used to identify best candidates for successful decryption (ex: for alphanumeric characters and spaces, use "a-zA-Z0-9 ")', default='a-zA-Z0-9.,?! :;\'"')
+args = parser.parse_args()
+
+ctext = args.ciphertext.decode('hex')
+ctext_len = len(ctext)
+display_ctext = "_" * ctext_len
+display_key = "_" * ctext_len
+
+charset = '^['+args.charset+']+$'
+
+response = ''
+
+while response != 'end':
+	print "Your message is currently:"
+	print_linewrapped(display_ctext)
+	print "Your key is currently:"
+	print_linewrapped(display_key)
+
+	crib = raw_input("Please enter your crib: ")
+	crib_len = len(crib)
+
+	results = sxor(ctext, crib)
+	results_len = len(results)
+
+	#Generate results
+	for result_index in xrange(results_len): 
+            if (re.search(charset,results[result_index])):
+		    print '*** ' + str(result_index) + ': "' + results[result_index] + '"'
+            else:
+		    print str(result_index) + ': "' + results[result_index] + '"'
+
+	response = raw_input("Enter the correct position, 'none' for no match, or 'end' to quit: ")
+
+	#Replace part of the message or key
+	try:
+		response = int(response)
+		if (response < results_len):
+			message_or_key = ''
+			while (message_or_key != 'message' and message_or_key != 'key'):
+				message_or_key = raw_input("Is this crib part of the message or key? Please enter 'message' or 'key': ")
+				if(message_or_key == 'message'):
+					display_ctext = display_ctext[:response] + crib + display_ctext[response+crib_len:]
+					display_key = display_key[:response] + results[response] + display_key[response+crib_len:]
+				elif(message_or_key == 'key'):
+					display_key = display_key[:response] + crib + display_key[response+crib_len:]
+					display_ctext = display_ctext[:response] + results[response] + display_ctext[response+crib_len:]
+				else:
+					print 'Invalid response. Try again.'
+
+	except ValueError:
+		if (response == 'end'):
+			print "Your message is: " + display_ctext
+			print "Your key is: " + display_key
+		elif (response == 'none'):
+			print "No changes made."
+		else:
+			print "Invalid entry."
+

Cryptography/ALEXCTF CR2_ Many time secrets/msg (4)

@@ -0,0 +1,11 @@
+0529242a631234122d2b36697f13272c207f2021283a6b0c7908
+2f28202a302029142c653f3c7f2a2636273e3f2d653e25217908
+322921780c3a235b3c2c3f207f372e21733a3a2b37263b313012
+2f6c363b2b312b1e64651b6537222e37377f2020242b6b2c2d5d
+283f652c2b31661426292b653a292c372a2f20212a316b283c09
+29232178373c270f682c216532263b2d3632353c2c3c2a293504
+613c37373531285b3c2a72273a67212a277f373a243c20203d5d
+243a202a633d205b3c2d3765342236653a2c7423202f3f652a18
+2239373d6f740a1e3c651f207f2c212a247f3d2e65262430791c
+263e203d63232f0f20653f207f332065262c3168313722367918
+2f2f372133202f142665212637222220733e383f2426386b

Cryptography/Base 2 2 the 6/README.md

@@ -0,0 +1,20 @@
+## Base 2 2 the 6
+The main idea finding the flag is $2^6$ = 64.
+
+#### Step-1:
+After we read the message given,
+
+`Q1RGe0ZsYWdneVdhZ2d5UmFnZ3l9`
+
+It is clearly Base64 encrypted.
+
+#### Step-2:
+I tried to decode it online here: https://www.base64decode.org/
+
+I got the following result:
+
+<img src="Decode.png">
+
+#### Step-3:
+Finally the flag becomes:
+`CTF{FlaggyWaggyRaggy}`

Cryptography/BruXOR/README.md

@@ -0,0 +1,26 @@
+## BruXOR
+The main idea finding the flag is XOR Bruteforce.
+
+#### Step-1:
+After reading the message in the question,
+
+`There is a technique called bruteforce. Message: q{vpln'bH_varHuebcrqxetrHOXEj No key! Just brute .. brute .. brute ... :D`
+
+
+The first thing I searched online was XOR Bruteforce and I got some helpful results.
+
+#### Step-2:
+I followed the URL:  https://www.dcode.fr/xor-cipher
+
+Since in the message, it is clearly that there is no key, my inputs were as follows: (Only Bruteforce xP)
+
+<img src="Input.png">
+
+#### Step-3:
+After decrypting, we get the following results, amidst which I found the flag.
+
+<img src="Flag.png">
+
+#### Step-4:
+Finally the flag becomes:
+`flag{y0u_Have_bruteforce_XOR}`

Cryptography/Character Encoding/README.md

@@ -0,0 +1,16 @@
+## Character Encoding
+The main idea finding the flag using simple Hex to text conversion.
+
+#### Step-1:
+Generally, I don't criticize any challenge, but this one crossed limits. It was too Ez. xP.
+
+We have been given simple Hex code: `41 42 43 54 46 7B 34 35 43 31 31 5F 31 35 5F 55 35 33 46 55 4C 7D`
+
+#### Step-2:
+Convert it online here to text:
+http://www.unit-conversion.info/texttools/hexadecimal/
+
+#### Step-3:
+
+Finally the flag becomes:
+`ABCTF{45C11_15_U53FUL}`

Cryptography/Hextroadinary/README.md

@@ -0,0 +1,29 @@
+## Hextroadinary
+
+The main idea finding the flag is to read the question properly and interpret.
+
+#### Step-1:
+
+After we read the given message:
+
+`Meet ROXy, a coder obsessed with being exclusively the worlds best hacker. She specializes in short cryptic hard to decipher secret codes. The below hex values for example, she did something with them to generate a secret code, can you figure out what? Your answer should start with 0x.`
+
+`0xc4115` `0x4cf8`
+
+#### Step-2:
+
+`Meet ROXy` - This should give us a simple idea that we have to XOR the 2 given Hex numbers.
+
+#### Step-3:
+
+So I tried it online here:
+
+http://xor.pw/#
+
+<img src="xor.png">
+
+Note: Do not forget `0x` before flag.
+
+#### Step-7:
+Finally the flag becomes:
+`CTFlearn{0xc0ded}`

Cryptography/HyperStream Test #2/README.md

@@ -0,0 +1,27 @@
+## HyperStream Test #2
+The main idea finding the flag is to know Baconian Cipher.
+
+#### Step-1:
+After reading the challenge properly, 
+
+```
+I love the smell of bacon in the morning! 
+
+ABAAAABABAABBABBAABBAABAAAAAABAAAAAAAABAABBABABBAAAAABBABBABABBAABAABABABBAABBABBAABB 
+```
+#### Step-2:
+It is clear that it has to be Baconian Cipher. Those who are unaware of it, can refer here:
+https://en.wikipedia.org/wiki/Bacon%27s_cipher
+
+I then quickly looked for online Baconian Cipher decoders.
+
+#### Step-3:
+I followed URL: https://www.dcode.fr/bacon-cipher.
+
+I got the following results:
+
+<img src="Flag.png">
+
+#### Step-4:
+Finally the flag becomes:
+`ILOUEBACONDONTYOU`

Cryptography/Morse Code/README.md

@@ -0,0 +1,24 @@
+## Morse Code
+The main idea finding the flag is just having knowledge about Morse Code.
+
+#### Step-1:
+
+This is the message given to us:
+
+`..-. .-.. .- --. ... .- -- ..- . .-.. -- --- .-. ... . .. ... -.-. --- --- .-.. -... -.-- - .... . .-- .- -.-- .. .-.. .. -.- . -.-. .... . . ...`
+
+#### Step-2:
+I used this URL to decode our answer:
+https://cryptii.com/pipes/morse-code-to-text
+
+#### Step-3:
+This was my output:
+
+<img src="Flag.png">
+
+That's it. That's our flag.
+
+#### Step-4:
+
+Finally the flag becomes:
+`flagsamuelmorseiscoolbythewayilikechees`

Cryptography/RSA Beginner/Flag.py

@@ -0,0 +1,17 @@
+import gmpy2
+from gmpy2 import mpz
+
+e=mpz(3)
+c=mpz(219878849218803628752496734037301843801487889344508611639028)
+n=mpz(245841236512478852752909734912575581815967630033049838269083)
+
+#use factordb
+q=mpz(416064700201658306196320137931)
+p=mpz(590872612825179551336102196593)
+
+phi=gmpy2.mul(p-1,q-1)
+d=gmpy2.invert(e,phi)
+f=gmpy2.powmod(c,d,n)
+g=bytes.fromhex(hex(f)[2:])
+
+print("[+] Flag is : ",g)

Cryptography/RSA Beginner/README.md

@@ -0,0 +1,48 @@
+## RSA Beginner
+The main idea finding the flag using RSA function and its operations.
+
+#### Step-1:
+After we download `rsa (1).txt` from the cloud, we try to understand what is the content.
+
+If anyone is unaware of RSA Encryption, they can checkout here:
+
+https://en.wikipedia.org/wiki/RSA_(cryptosystem)
+
+#### Step-2:
+The contents of `rsa (1).txt` are as follows:
+
+```
+e: 3
+c: 219878849218803628752496734037301843801487889344508611639028
+n: 245841236512478852752909734912575581815967630033049838269083
+```
+#### Step-3:
+We run a simple `Flag.py` script to get the flag.
+
+```
+import gmpy2
+from gmpy2 import mpz
+
+e=mpz(3)
+c=mpz(219878849218803628752496734037301843801487889344508611639028)
+n=mpz(245841236512478852752909734912575581815967630033049838269083)
+
+#use factordb
+q=mpz(416064700201658306196320137931)
+p=mpz(590872612825179551336102196593)
+
+phi=gmpy2.mul(p-1,q-1)
+d=gmpy2.invert(e,phi)
+f=gmpy2.powmod(c,d,n)
+g=bytes.fromhex(hex(f)[2:])
+
+print("[+] Flag is : ",g)
+```
+#### Step-4:
+The output of `python3 Flag.py` is as follows:
+
+`[+] Flag is :  b'abctf{rs4_is_aw3s0m3}'`
+
+#### Step-5:
+Finally the flag becomes:
+`abctf{rs4_is_aw3s0m3}`

Cryptography/RSA Beginner/rsa (1).txt

@@ -0,0 +1,3 @@
+e: 3
+c: 219878849218803628752496734037301843801487889344508611639028
+n: 245841236512478852752909734912575581815967630033049838269083

Cryptography/RSA Noob/Flag.py

@@ -0,0 +1,19 @@
+from Crypto.Util.number import inverse
+import binascii
+
+e = 1
+c = 9327565722767258308650643213344542404592011161659991421
+n = 245841236512478852752909734912575581815967630033049838269083
+
+# From factordb
+
+p = 416064700201658306196320137931
+q = 590872612825179551336102196593
+
+phi = (p-1) * (q-1)
+
+d = inverse(e,phi)
+m = pow(c,d,n)
+
+hex_str = hex(m)[2:] # Removing '0x'
+print(binascii.unhexlify(hex_str))

Cryptography/RSA Noob/README.md

@@ -0,0 +1,65 @@
+## RSA Noob
+The main idea finding the flag using RSA function and its operations.
+
+#### Step-1:
+After we download `rsanoob(1).txt` from the cloud, we try to understand what is the content.
+
+If anyone is unaware of RSA Encryption, they can checkout here:
+
+https://en.wikipedia.org/wiki/RSA_(cryptosystem)
+
+#### Step-2:
+The contents of `rsa (1).txt` are as follows:
+
+```
+e: 1
+c: 9327565722767258308650643213344542404592011161659991421
+n: 245841236512478852752909734912575581815967630033049838269083
+```
+#### Step-3:
+'e' and 'n' - Public key.
+'c' - Cipher text.
+
+Given `n` to us, we try to find `p` & `q` online from http://factordb.com/index.php
+ 
+#### Step-4:
+We get the `p` & `q` online as follows:
+<img src="Factorize.png">
+
+Now we can feed inputs manually to yield flag.
+
+#### Step-5:
+
+Running this `Flag.py` script:
+
+```
+from Crypto.Util.number import inverse
+import binascii
+
+e = 1
+c = 9327565722767258308650643213344542404592011161659991421
+n = 245841236512478852752909734912575581815967630033049838269083
+
+# From factordb
+
+p = 416064700201658306196320137931
+q = 590872612825179551336102196593
+
+phi = (p-1) * (q-1)
+
+d = inverse(e,phi)
+m = pow(c,d,n)
+
+hex_str = hex(m)[2:] # Removing '0x'
+print(binascii.unhexlify(hex_str))
+```
+
+#### Step-6:
+We get the flag by `python3 Flag.py`
+
+We get this output:
+`b'abctf{b3tter_up_y0ur_e}'`
+
+#### Step-7:
+Finally the flag becomes:
+`abctf{b3tter_up_y0ur_e}`

Cryptography/RSA Noob/rsanoob (1).txt

@@ -0,0 +1,3 @@
+e: 1
+c: 9327565722767258308650643213344542404592011161659991421
+n: 245841236512478852752909734912575581815967630033049838269083

Cryptography/Reverse Polarity/README.md

@@ -0,0 +1,25 @@
+## Reverse Polarity
+The main idea finding the flag is Binary to ASCII conversion.
+
+#### Step-1:
+After seeing the text, we get the following:
+`I got a new hard drive just to hold my flag, but I'm afraid that it rotted. What do I do? The only thing I could get off of it was this: `
+
+```
+01000011010101000100011001111011010000100110100101110100010111110100011001101100011010010111000001110000011010010110111001111101
+```
+
+I tried to convert the given Binary text to ASCII.
+
+#### Step-2:
+I followed the URL:  https://www.convertbinary.com/to-text/
+
+I got the following result:
+
+<img src="Covert.png">
+
+Voila, we have it.
+#### Step-3:
+
+Finally the flag becomes:
+`CTF{Bit_Flippin}`

Cryptography/Substitution Cipher/README.md

@@ -0,0 +1,27 @@
+## Substitution Cipher
+The main idea finding the flag is using Substitution Cipher.
+
+#### Step-1:
+After downloading `Substitution.txt` from the cloud, we get the following data from it:
+
+```
+MIT YSAU OL OYGFSBDGRTKFEKBHMGCALSOQTMIOL. UTFTKAMTR ZB DAKQGX EIAOF GY MIT COQOHTROA HAUT GF EASXOF AFR IGZZTL. ZT CTKT SGFU, MIT YSACL GF A 2005 HKTLTFM MODTL MIAF LMADOFA GK A CTTQSB LWFRAB, RTETDZTK 21, 1989 1990, MIT RKTC TROMGKL CAL WHKGGMTR TXTKB CGKSR EAF ZT YGWFR MIT EGFMOFWTR MG CGKQ AM A YAOMIYWS KTHSOTL CITKT IGZZTL, LMBST AOD EASXOF, AMMAEQ ZGMI LORTL MG DAKQL, "CIAM RG EGFMKGSSOFU AF AEMWAS ZGAKR ZGVTL OF MIT HKTHAKTFML FADT, OL ODHWSLOXT KADHAUTL OF CIOEI ASCABL KTYTKTFETL MIT HALLCGKR, CIOEI DGFTB, AFR MITB IAR SOMMST YKGFM BAKR IOL YKWLMKAMTR EGSGK WFOJWT AZOSOMB COMI AFR OFROLHTFLAMT YGK MTAEI GMITK LMWROTL, AKT ACAKRL ZARUTL, HWZSOLITR ZTYGKT CTSS AL A YOKT UKGLL HSAFL CTKT GKOUOFASSB EIAKAEMTKL OF MIT LMKOH MG CIOEI LTTD MG OM CITF MTDHTKTR OF AFR IASSGCOFU MITB'KT LODHSB RKACOFU OF UOXTL GF" HKOFEOHAS LHOMMST ROLMGKM, KTARTKL EGDOEL AKT WLT, CAMMTKLGF MGGQ MCG 16-DGFMIL AYMTK KTLOLMAQTL A DGKT EKTAM RTAS MG EASXOF GYMTF IGZZTL MG ARDOML "LSODB, "ZWM OM'L FADTR A FOUIM GWM LIT OL HGOFM GY FGM LTTF IGZZTL MIT ZGGQL AM MIAM O KTDAOFOFU ZGGQ IADLMTK IWTB AKT AHHTAKAFET: RTETDZTK 6, 1995 DGD'L YKADTL GY EASXOF UOXTF A CAUGF, LGDTMODTL MIAM LG OM'L YAMITKT'L YADOSB FG EAFETSSAMOGFLIOH CAL HKTLTFML YKGD FGXTDZTK 21, 1985 SALM AHHTAK AZLTFET OF AFGMITKCOLT OM IAHHB MG KWF OM YGK MIOL RAR AL "A SOMMST MG MGSTKAMT EASXOF'L YADOSB RKACF ASDGLM EGDDTFRTR WH ZTOFU HTGHST OFLMAFET, UTM DAKKOTR ZB A RAFET EASXOF'L GWMSAFROLOFU MIT FTCLHAHTK GK MAZSGOR FTCLHAHTK ZWLOFTLL LIGC OL GF!" AFR LHKOFML GY EIOSRKTF'L RAR'L YKWLMKAMTR ZB MWKF IWDGK, CAL HWZSOE ROASGU MITKT'L FGM DWEI AL "'94 DGRTKFOLD" CAMMTKLGF IAL RTSOUIML GY YAFMALB SOYT CAMMTKLGF LABL LTKXTL AL AF AKMOLML OL RTLMKWEMOGF ZWLOFTLL, LHAETYAKTK GY MIT GHHGKMWFOMOTL BGW ZGMI A MGHOE YGK IOL IGDT MGFUWT-OF-EITTQ HGHWSAK MIAM OM CAL "IGF" AFR JWAKMTK HAUT DGKT LHAEOGWL EAFETSSAMOGF MIT HAOK AKT ESTAKSB OF HLBEIOE MKAFLDGUKOYOTK'L "NAH" LGWFR TYYTEM BGW MIOFQTK CAMMTKLGF ASLG UKTC OFEKTROZST LHAET ZWBL OF EGDDGFSB CIOST GMITKCOLT OM'L FADT OL FGMAZST LMGKBSOFT UAXT MIT GHHGKMWFOMOTL BGW EAFETSSAMOGF MIT "EASXOF GYYTK MG DAQT IOD OFEGKKTEM AFLCTKL CAMMTK AKMCGKQ GMITK GYMTF CIOEI OL TXORTFM MG GMITK LMKOH OL MG MITOK WLT GY KWSTL MIAM LIGCF GF LAFROYTK, CIG WLTL A EKGCJWOSS ZT LTTF "USWTR" MG MIT GFSB HTKL AFR IOL YAMITK LWHHGKM OL SWFEISOFT UAXT MITLT MIOF A BTAK OF DWSMODAMTKOAS AFR GZMAOF GF LAFMALB, IOL WLT, CAMMTKL ROASGUWT OL AF "AKMOLM'L LMAMWL AL "A ROD XOTC OF MIT TLLTFMOASSB MG DAQT IOD LTTD MG OFESWRTR MIAM EASXOF OL AF GRR ROASGUWT DGLM GY MIT ESWZ IAL TVHKTLLOGF GWMLORT AXAOSAZST MG
+```
+
+#### Step-2:
+So, I tried to decode here: https://www.dcode.fr/monoalphabetic-substitution
+
+My inputs are as follows:
+
+<img src="Input.png">
+
+#### Step-3:
+I got the output as follows:
+
+<img src="Flag.png">
+
+There we have it. Our flag.
+
+#### Step-4:
+Finally the flag becomes:
+`IFONLYMODERNCRYPTOWASLIKETHIS`

Cryptography/Substitution Cipher/Substitution.txt

@@ -0,0 +1 @@
+MIT YSAU OL OYGFSBDGRTKFEKBHMGCALSOQTMIOL. UTFTKAMTR ZB DAKQGX EIAOF GY MIT COQOHTROA HAUT GF EASXOF AFR IGZZTL. ZT CTKT SGFU, MIT YSACL GF A 2005 HKTLTFM MODTL MIAF LMADOFA GK A CTTQSB LWFRAB, RTETDZTK 21, 1989 1990, MIT RKTC TROMGKL CAL WHKGGMTR TXTKB CGKSR EAF ZT YGWFR MIT EGFMOFWTR MG CGKQ AM A YAOMIYWS KTHSOTL CITKT IGZZTL, LMBST AOD EASXOF, AMMAEQ ZGMI LORTL MG DAKQL, "CIAM RG EGFMKGSSOFU AF AEMWAS ZGAKR ZGVTL OF MIT HKTHAKTFML FADT, OL ODHWSLOXT KADHAUTL OF CIOEI ASCABL KTYTKTFETL MIT HALLCGKR, CIOEI DGFTB, AFR MITB IAR SOMMST YKGFM BAKR IOL YKWLMKAMTR EGSGK WFOJWT AZOSOMB COMI AFR OFROLHTFLAMT YGK MTAEI GMITK LMWROTL, AKT ACAKRL ZARUTL, HWZSOLITR ZTYGKT CTSS AL A YOKT UKGLL HSAFL CTKT GKOUOFASSB EIAKAEMTKL OF MIT LMKOH MG CIOEI LTTD MG OM CITF MTDHTKTR OF AFR IASSGCOFU MITB'KT LODHSB RKACOFU OF UOXTL GF" HKOFEOHAS LHOMMST ROLMGKM, KTARTKL EGDOEL AKT WLT, CAMMTKLGF MGGQ MCG 16-DGFMIL AYMTK KTLOLMAQTL A DGKT EKTAM RTAS MG EASXOF GYMTF IGZZTL MG ARDOML "LSODB, "ZWM OM'L FADTR A FOUIM GWM LIT OL HGOFM GY FGM LTTF IGZZTL MIT ZGGQL AM MIAM O KTDAOFOFU ZGGQ IADLMTK IWTB AKT AHHTAKAFET: RTETDZTK 6, 1995 DGD'L YKADTL GY EASXOF UOXTF A CAUGF, LGDTMODTL MIAM LG OM'L YAMITKT'L YADOSB FG EAFETSSAMOGFLIOH CAL HKTLTFML YKGD FGXTDZTK 21, 1985 SALM AHHTAK AZLTFET OF AFGMITKCOLT OM IAHHB MG KWF OM YGK MIOL RAR AL "A SOMMST MG MGSTKAMT EASXOF'L YADOSB RKACF ASDGLM EGDDTFRTR WH ZTOFU HTGHST OFLMAFET, UTM DAKKOTR ZB A RAFET EASXOF'L GWMSAFROLOFU MIT FTCLHAHTK GK MAZSGOR FTCLHAHTK ZWLOFTLL LIGC OL GF!" AFR LHKOFML GY EIOSRKTF'L RAR'L YKWLMKAMTR ZB MWKF IWDGK, CAL HWZSOE ROASGU MITKT'L FGM DWEI AL "'94 DGRTKFOLD" CAMMTKLGF IAL RTSOUIML GY YAFMALB SOYT CAMMTKLGF LABL LTKXTL AL AF AKMOLML OL RTLMKWEMOGF ZWLOFTLL, LHAETYAKTK GY MIT GHHGKMWFOMOTL BGW ZGMI A MGHOE YGK IOL IGDT MGFUWT-OF-EITTQ HGHWSAK MIAM OM CAL "IGF" AFR JWAKMTK HAUT DGKT LHAEOGWL EAFETSSAMOGF MIT HAOK AKT ESTAKSB OF HLBEIOE MKAFLDGUKOYOTK'L "NAH" LGWFR TYYTEM BGW MIOFQTK CAMMTKLGF ASLG UKTC OFEKTROZST LHAET ZWBL OF EGDDGFSB CIOST GMITKCOLT OM'L FADT OL FGMAZST LMGKBSOFT UAXT MIT GHHGKMWFOMOTL BGW EAFETSSAMOGF MIT "EASXOF GYYTK MG DAQT IOD OFEGKKTEM AFLCTKL CAMMTK AKMCGKQ GMITK GYMTF CIOEI OL TXORTFM MG GMITK LMKOH OL MG MITOK WLT GY KWSTL MIAM LIGCF GF LAFROYTK, CIG WLTL A EKGCJWOSS ZT LTTF "USWTR" MG MIT GFSB HTKL AFR IOL YAMITK LWHHGKM OL SWFEISOFT UAXT MITLT MIOF A BTAK OF DWSMODAMTKOAS AFR GZMAOF GF LAFMALB, IOL WLT, CAMMTKL ROASGUWT OL AF "AKMOLM'L LMAMWL AL "A ROD XOTC OF MIT TLLTFMOASSB MG DAQT IOD LTTD MG OFESWRTR MIAM EASXOF OL AF GRR ROASGUWT DGLM GY MIT ESWZ IAL TVHKTLLOGF GWMLORT AXAOSAZST MG

Cryptography/Vigenere Cipher/README.md

@@ -0,0 +1,33 @@
+## Vigenere Cipher
+The main idea finding the flag is just having knowledge about Vigenere Cipher.
+
+#### Step-1:
+
+Its very easy if you have basic idea of Vigenere Cipher. If you don't know, please refer : 
+https://en.wikipedia.org/wiki/Vigen%C3%A8re_cipher
+
+So this is what is given in the message of challenge:
+
+```
+The vignere cipher is a method of encrypting alphabetic text by using a series of interwoven Caesar ciphers based on the letters of a keyword.<br />
+
+I’m not sure what this means, but it was left lying around: blorpy
+
+gwox{RgqssihYspOntqpxs}
+```
+#### Step-2:
+One thing is important to know that Vigenere Cipher requires a <strong>key</strong> to decode any message. 
+I used this URL to decode my message and used given key as : `blorpy`
+https://cryptii.com/
+
+#### Step-3:
+This was my output:
+
+<img src="Flag.png">
+
+That's it. That's our flag.
+
+#### Step-4:
+
+Finally the flag becomes:
+`flag{CiphersAreAwesome}`

Forensics/07601/README.md

@@ -0,0 +1,364 @@
+## 07601
+The main idea finding the flag using basic forensics techniques.
+
+#### Step-1:
+After we download the given image `AGT.png` from the cloud, we just try simple techniques.
+
+<img src="AGT.jpg">
+
+#### Step-2:
+I first tried a very basic `strings AGT.png` &  `strings AGT.png | grep {`.
+
+I got the following output, through which I came to know about existing hidden directories.
+```
+v{n,	
+n.l{
+qYv{
+,nO{
+2[{oO
+{^UH
+i{WY*
+ABCTF{fooled_ya_dustin}
+{u4j,\
+B-{4B
+}UXG{
+{`(k
+cB{V,
+7{Ul
+{$48
+~9{;b
+ECG{~'8
+{Rf:
+M}fS{
+{{*7'
+cGc{qlt'5
+DD2{
+{f8-Z
+{R[7
+UJL{
+ez	{Rz
+,K{^b
+WL{?
+1?{M
+YJ{.
+E{'+
+ZQ9{
+1{@S
+\s{)
+mDEH{
+qz{*
+{d"&
+{QuH%
+,97{{
+.~>{
+F{E`{;
+46B{
+Le*{
+HrZl{T
+^{K>
+_4={
+EHLl{V
+{Wh>
+ {:4
+B{Cl
+g{:i
+Z{e&
+:{S/\
+{:%|Ium#
+_E{Wj
+S{5U
+S{Eh
+r{}%
+ht{{
+;Xc{
+ST{{
+{>eG
+2eN{
+A{b5
+wu{@
+y.V{j0^
+8~x{
+{;F#
+.{|6m	
+{%0[
+{~u(
+TB{b
+i{Hhm
+=Z{"4
+v.aa{
+j-@l{
+DsB{
+4{C$v`
+"Y1!{I
+	B{^
+X>{I
+KNzO{
+_I{[-
+%{*e
+B-{4B
+}UXG{
+{`(k
+cB{V,
+7{Ul
+{$48
+~9{;b
+ECG{~'8
+{Rf:
+M}fS{
+{{*7'
+cGc{qlt'5
+DD2{
+{f8-Z
+{R[7
+UJL{
+ez	{Rz
+,K{^b
+WL{?
+1?{M
+YJ{.
+E{'+
+ZQ9{
+1{@S
+\s{)
+mDEH{
+qz{*
+{d"&
+{QuH%
+,97{{
+.~>{
+F{E`{;
+46B{
+Le*{
+HrZl{T
+^{K>
+_4={
+EHLl{V
+{Wh>
+ {:4
+B{Cl
+g{:i
+Z{e&
+:{S/\
+{:%|Ium#
+_E{Wj
+S{5U
+S{Eh
+r{}%
+ht{{
+;Xc{
+ST{{
+{>eG
+2eN{
+A{b5
+wu{@
+y.V{j0^
+8~x{
+{;F#
+.{|6m	
+{%0[
+{~u(
+TB{b
+i{Hhm
+=Z{"4
+v.aa{
+j-@l{
+DsB{
+4{C$v`
+"Y1!{I
+	B{^
+X>{I
+KNzO{
+_I{[-
+%{*e
+Dwnc{E
+B-{4B
+}UXG{
+{`(k
+cB{V,
+7{Ul
+{$48
+~9{;b
+ECG{~'8
+{Rf:
+M}fS{
+{{*7'
+cGc{qlt'5
+DD2{
+{f8-Z
+{R[7
+f{KR
+,K{^b
+WL{?
+1?{M
+YJ{.
+E{'+
+ZQ9{
+1{@S
+\s{)
+mDEH{
+qz{*
+{d"&
+{QuH%
+,97{{
+.~>{
+F{E`{;
+46B{
+Le*{
+HrZl{T
+^{K>
+_4={
+EHLl{V
+daIj{
+fz{]
+{gy5
+i{1"Aj
+rr@{
+C_,{
+WoIx{
+<6\`{
+%{-N(
+|B{~
+{t^l
+dNDM'{
+k/{|
+{_ G
+);bW{
+?XG>z{
+=k{-
+{Y6g
+K5g{2
+mz{S
+2eF{
+{y4^(
+GB{%
+E{/Y
+{p`w?
+mE-{
+~*{+
+.{|6m	
+{%0[
+{~u(
+TB{b
+i{Hhm
+=Z{"4
+v.aa{
+j-@l{
+DsB{
+4{C$v`
+"Y1!{I
+	B{^
+X>{I
+KNzO{
+_I{[-
+%{*e
+```
+#### Step-3:
+I tried this `ABCTF{fooled_ya_dustin}` flag, but it showed incorrect. So let's explore the hidden folders.
+
+#### Step-4:
+I tried `binwalk -e AGT.png`. I get a new directory called `_AGT.png.extracted`. Let's get into this.
+
+#### Step-5:
+The contents of which are some of the images and directory. I directly, tried
+`strings I Warned You.jpeg | grep {`
+
+#### Step-6:
+
+I got this output:
+```
+{P|I
+{zRhc
+{>ch
+^|){O
+rU<o{
+R3w{x
+o	 {p
+=d{]i
+w{3)Z:
+uYz}{
+{uBH
+*}{MD
+}"W{
+:Ja{
+.?{M$f
+!0{8
+{/!s
+tM,o{
+{tLL
+q{dG
+b[{MTF
+{Y1W
+ABCTF{Du$t1nS_D0jo}1r
+1{wl
+{Y,x
+6fr{+
+q{:zG
+Nv{%M#
+{+	-"
+Qa{+
+tx"{
+{!f'WkQV
+XUg{
+!{;xV
+?Khh{
+w#{]U#
+JGdD{n
+W]L{`g
+{Z.W\
+r"w{
+.$A{
+)cn_P{V
+ b{5
+:\7{{
+gk{|(qwC
+Vv{;t[Tjy#r
+NR{{]
+Pv{]JS
+{'R-
+${zT
+Ac{*:]#
+{Mj9
+.	6{4
+w{Y[8o
+{zY\4
+q{:g#g
+roO{
+F{Dfx$
+mJ{#
+OgRZho{
+Ug3{x
+'{u^n
+b%{l^
+r&*$b{
+M|vMH{.
+[R'{_
+{P7v+
+b{+W
+/{+w
+F{~aLVF
+{:el
+sIS{
+8r:s{
+I{M5
+e%K#{
+u5{1j
+Bww{
+{XW+
+$v{/O
++6,{~aV
+iNc{
+{R8c
+y)8{{0q
+1{]'%<B
+R{.x
+{533
+1{ue
+:?{#&2B
+{%c]2U
+;#Y{
+```
+
+Luckily, here the flag worked.
+#### Step-7:
+Finally the flag becomes:
+`ABCTF{Du$t1nS_D0jo}1r`

Forensics/A CAPture of a Flag/README.md

@@ -0,0 +1,36 @@
+## A CAPture of a Flag
+The main idea finding the flag is exploring the given PCAP file in Wireshark.
+
+#### Step-1:
+After downloading `flag (4)` (a PCAP file) from the cloud, I directly opened it in Wireshark application.
+
+For those, who are unaware om how to filter streams or use this application, please do your homework here:
+
+https://www.wireshark.org/
+
+#### Step-2:
+
+I tried to check TCP stream for some clues and then I tried UDP streams for some clues. Finally, I used the filter to get only HTTP requests.
+
+<img src="HTTP.png">
+
+#### Step-3:
+
+I went through all requests and this request caught my eye. 
+`247	2.270670	10.50.203.75	185.21.216.190	HTTP	504	GET /?msg=ZmxhZ3tBRmxhZ0luUENBUH0= HTTP/1.1 `
+
+It has a Base64 encrypted message.
+
+#### Step-4:
+
+So finally, I decoded it online at: https://www.base64decode.org/
+
+I got the flag there:
+
+<img src="Base64.png">
+
+Voila, we have it here.
+
+#### Step-4:
+Finally the flag becomes:
+`flag{AFlagInPCAP}`

Forensics/Binwalk/README.md

@@ -0,0 +1,32 @@
+## Binwalk
+The main idea finding the flag using Binwalk commands and its extensions.
+
+#### Step-1:
+After downloading `PurpleThing.jpeg` from the cloud, I tried `strings PurpleThing.jpeg | grep {`.
+
+I couldn't find anything special.
+
+#### Step-2:
+
+So I tried `binwalk PurpleThing.jpeg` as the question suggests.
+
+It showed me following output:
+
+```
+DECIMAL       HEXADECIMAL     DESCRIPTION
+--------------------------------------------------------------------------------
+0             0x0             PNG image, 780 x 720, 8-bit/color RGBA, non-interlaced
+41            0x29            Zlib compressed data, best compression
+153493        0x25795         PNG image, 802 x 118, 8-bit/color RGBA, non-interlaced
+```
+
+Clearly, there is hidden data in there, let's extract that.
+#### Step-3:
+I input a command of `binwalk -D 'image:png' PurpleThing.jpeg` and I get a directory named `_PurpleThing.jpeg.extracted`. 
+
+The contents are different files. In it `25795.png` has the flag.
+
+#### Step-4:
+
+Finally the flag becomes:
+`ABCTF{b1nw4lk_is_us3ful}`

Forensics/Digital Camouflage/README.md

@@ -0,0 +1,36 @@
+## Digital Camouflage
+The main idea finding the flag is Network Interception and some Crytographic Techniques.
+
+#### Step-1:
+After downloading `data.pcap` from the cloud, I directly opened it in Wireshark.
+
+For those, who are unaware of how to use this tool for Network Interception, can refer here:
+https://www.wireshark.org/
+
+I tried to check the Hex Dump, but couldn't find something special.
+
+#### Step-2:
+So, I tried to check the TCP stream in different frames. For those, who are unaware on how to do this:
+
+- Open `data.pcap` in Wireshark.
+- In the filters, put on TCP and then Enter to get all the TCP traffic of the network.
+<img src="TCP_Stream.png">
+- I wanted to check each and every frame as question is somewhat hinting in that direction, so to check that, Analyse -> Follow -> TCP Stream
+<img src="TCP_Stream_Eq_0.png">
+- We can alter streams by changing the counter in bottom right corner.
+- As I reached 3rd stream, I observed some credentials there.
+<img src="TCP_Stream_Eq_3.png">
+
+`userid=hardawayn&pswrd=UEFwZHNqUlRhZQ%3D%3D`
+#### Step-3:
+So, it is clear that password is Base64 encrypted and in web URLs, %3D is to be replaced by =.
+
+So I tried to decode the Base64 encryption online at: https://www.base64decode.org/
+
+<img src="Base64.png">
+
+It had the flag in it. Voila.
+
+#### Step-4:
+Finally the flag becomes:
+`PApdsjRTae`

Forensics/Dumpster/Decryptor.java

@@ -0,0 +1,44 @@
+import java.security.MessageDigest;
+import java.util.Arrays;
+import java.util.Base64;
+
+import javax.crypto.Cipher;
+import javax.crypto.spec.SecretKeySpec;
+
+public class Decryptor
+{
+	public static final String FLAG = "S+kUZtaHEYpFpv2ixuTnqBdORNzsdVJrAxWznyOljEo=";
+	private static class Password
+	{
+		private byte[] passHash;
+
+		public Password(char[] pass) throws Exception
+		{
+			MessageDigest digest = MessageDigest.getInstance("SHA-256");
+			this.passHash = Arrays.copyOf(digest.digest(new String(pass).getBytes("UTF-8")), 16);
+		}
+		
+		public byte[] encrypt(byte[] msg) throws Exception
+		{
+			SecretKeySpec spec = new SecretKeySpec(passHash, "AES");
+			Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
+			cipher.init(Cipher.ENCRYPT_MODE, spec);
+			return cipher.doFinal(msg);
+		}
+		
+		public byte[] decrypt(byte[] msg) throws Exception
+		{
+			SecretKeySpec spec = new SecretKeySpec(passHash, "AES");
+			Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
+			cipher.init(Cipher.DECRYPT_MODE, spec);
+			return cipher.doFinal(msg);
+		}
+	}
+	
+	public static void main(String[] args) throws Exception
+	{
+		Password pass = new Password(System.console().readPassword("Enter password to decrypt flag: "));
+		System.out.println(new String(pass.decrypt(Base64.getDecoder().decode(FLAG.getBytes()))));
+		Thread.sleep(5000); //We did a heap dump right here.
+	}
+}

Forensics/Dumpster/README.md

@@ -0,0 +1,12 @@
+## Dumpster
+The main idea finding the flag is Java coding.
+
+#### Step-1:
+I tried hard to understand the question and solve it, but I couldn't do it, so I had to look up for writeup.
+
+https://github.com/EladBeber/CTFlearn-Writeups/tree/master/Forensics/Medium/DUMPSTER
+
+#### Step-2:
+
+Finally the flag becomes:
+`stCTF{h34p_6ump5_r_c00l!11!!}`

Forensics/Exif/README.md

@@ -0,0 +1,62 @@
+## Exif
+The main idea finding the flag is to have Exiftool.
+
+#### Step-1:
+After I downloaded `Computer-Password-Security-Hacker - Copy.jpg`, I immediately tried to open it using Exiftool.
+
+<img src="Computer-Password-Security-Hacker - Copy.jpg">
+
+#### Step-2:
+If you have some experience in CTF before, [Exiftool](https://exiftool.org/) is quite widely used. So I input `exiftool Computer-Password-Security-Hacker\ -\ Copy.jpg`
+
+Output:
+
+```bash
+ExifTool Version Number         : 11.88
+File Name                       : Computer-Password-Security-Hacker - Copy.jpg
+Directory                       : .
+File Size                       : 54 kB
+File Modification Date/Time     : 2020:07:31 14:04:06+05:30
+File Access Date/Time           : 2020:07:31 14:04:06+05:30
+File Inode Change Date/Time     : 2020:07:31 14:04:06+05:30
+File Permissions                : rw-r--r--
+File Type                       : JPEG
+File Type Extension             : jpg
+MIME Type                       : image/jpeg
+JFIF Version                    : 1.02
+X Resolution                    : 100
+Y Resolution                    : 100
+Exif Byte Order                 : Big-endian (Motorola, MM)
+Resolution Unit                 : None
+Y Cb Cr Positioning             : Centered
+Exif Version                    : 0231
+Components Configuration        : Y, Cb, Cr, -
+Flashpix Version                : 0100
+Owner Name                      : flag{3l1t3_3x1f_4uth0r1ty_dud3br0}
+GPS Latitude Ref                : South
+GPS Longitude Ref               : East
+Quality                         : 60%
+DCT Encode Version              : 100
+APP14 Flags 0                   : [14], Encoded with Blend=1 downsampling
+APP14 Flags 1                   : (none)
+Color Transform                 : YCbCr
+Image Width                     : 660
+Image Height                    : 371
+Encoding Process                : Baseline DCT, Huffman coding
+Bits Per Sample                 : 8
+Color Components                : 3
+Y Cb Cr Sub Sampling            : YCbCr4:4:4 (1 1)
+Image Size                      : 660x371
+Megapixels                      : 0.245
+GPS Latitude                    : 77 deg 17' 2.62" S
+GPS Longitude                   : 44 deg 4' 7.30" E
+GPS Position                    : 77 deg 17' 2.62" S, 44 deg 4' 7.30" E
+```
+
+#### Step-3:
+
+Voila! I got the flag there. I don't have any idea why this challenge was in hard.
+
+#### Step-5:
+Finally the flag becomes: 
+`flag{3l1t3_3x1f_4uth0r1ty_dud3br0}`

Forensics/Forensics 101/README.md

@@ -0,0 +1,143 @@
+## Forensics 101
+The main idea finding the flag using basic forensics training.
+
+#### Step-1:
+After we download the given image `95f6edfb66ef42d774a5a34581f19052.jpg` from the cloud, we just try simple techniques.
+
+<img src="95f6edfb66ef42d774a5a34581f19052.jpg">
+
+#### Step-2:
+I first tried a very basic `strings 95f6edfb66ef42d774a5a34581f19052.jpg`
+
+#### Step-3:
+It just gave me this output:
+```
+JFIF
+ , #&')*)
+-0-(0%()(
+((((((((((((((((((((((((((((((((((((((((((((((((((
+L?~f
+:UwR
+y>2|
+*'?-
+yhH_&
+Lmz'
+ +f[
+!"1$246B`35A
+au>	
+~b*D
+F_X:D
+[ElC
+him8
+lr|.
+L{2^
+]]te
+tBfE
+j_s7Os/[i
+W="'
+"fkO
+G&,ke:
+eM_F
+8O:J
+9)/m>&
+[P{!
+}EI5#
+a~Wt,1
+]<e<
+g:rc
+"1Pa
+ujM^P
+P#3a
+vFGO
+ZniFi
+%a	?}
+2AQaq 0B#@r
+\xr>
+\37g
+4=i#N
+F:Jx
+.`Ot
+v[xU
+|='u
+{~T{@
+LX.9
+?mBx
+L1QG
+lIYB+
+|] %
+QTj?:
+$*,-
+pk4D
+4R gX
+$mmk
+_QSK
+b)^L
+a[T=
+mpj<N;
+!1AQaq
+x'<L
+we|C{
+iiR8
+"'A*
+aZ(4
+cj}+
+NL7'4
+u-kF3n
+x	cd
+s}F3_Y
+$+Ym
+zrsq
+f}]@
+L&/F
+&F'$,
+| *	
+ktWxn
+ yLX*s]
+pT)J
+eR-3
+SG=3\Y
+JK%0
+h"(p
+!01Q
+%^cJ
+H|cO
+!10AQ
+'([P
+!1AQaq
+s`%"
+X`3d'
+'P]!
+;#_l
+ABx=~
+"r&"
+0YAP	
+ch-h
+XoXrl
+l0Je
+V^_W
+xp7p
+v{*{8
+=k"$TW3G
+1)j!
+7y}U
+<~0GD
+n%CeoQ=m8
+`"n<P
+ i}\D
+X`(	
+8kF=
+~9%]Tn
+flag{wow!_data_is_cool}
+$lqU
+AG{u