Challenges
Break it yourself
The Learn modules explain how these primitives are supposed to work. These challenges are about how they fail: each one hands you ciphertext, a leaked value, or a flawed implementation, and asks you to recover a hidden flag of the form cct{...}. Everything is solved and checked entirely in your browser — no accounts, no server, no leaderboard.
Warm-up
Decode a hex string directly into the flag — no cipher involved, just an encoding.
Another pure encoding — decode base64 back into the flag.
A message XORed with one repeated byte. There's a shortcut hiding in how every flag on this site starts.
Classical Ciphers
Someone on the team still encrypts things the way Julius Caesar did. Read their message.
A polyalphabetic cipher that held its reputation for three centuries. It didn't survive the fourth.
A full substitution cipher — no repeating shift, no keyword. Every letter maps to a different letter, consistently.
Symmetric-key
This time the XOR key repeats instead of being a single byte. Does that actually help?
Two messages, encrypted under what should have been two different one-time keys.
A session cookie is encrypted with AES-CBC. You don't have the key. You don't need it.
RSA
A service encrypts short messages with RSA, e=3, and never bothers with padding. What could go wrong?
An engineer wanted RSA encryption without the performance cost. They found a way.
A flawed key generator picked two primes that are suspiciously close together. This is scriptable in a few lines.
A modulus small enough that "real" RSA security assumptions don't apply at all.
Diffie-Hellman & ECC
You've intercepted a Diffie-Hellman public value. Recover the private exponent behind it.
An active attacker swapped the generator before the exchange completed. The shared secret only has two possible values now.
A toy elliptic curve, a public key, and the private key that produced it — small enough to brute force by hand.