FIELD NOTES / 14
Recognize the clue.
Choose the right tool.
Repeatable reasoning for common CTF inputs. Every guide includes a worked example, failure cases, verification method, and a clear next step.
How to Identify Base64
Use alphabet, length, padding, and decoded structure instead of guessing from appearance alone.
GUIDE 02 / WEBJWT Analysis Checklist
Inspect headers, claims, timestamps, and signatures without confusing decoding with verification.
GUIDE 03 / WORKFLOWHow to Untangle Encoding Chains
Track evidence one layer at a time and know when a transformation should be reversed.
GUIDE 04 / FORENSICSA Repeatable File Forensics Workflow
Preserve the original, hash it, inspect signatures and metadata, then document every action.
GUIDE 05 / FORENSICSFile Signatures and Hex
Recognize common magic bytes and separate a misleading extension from the actual file format.
GUIDE 06 / INTEGRITYVerify Files with SHA-256
Compare digests correctly, preserve evidence, and understand what a matching hash proves.
GUIDE 07 / TIMELINEUnix Timestamp Analysis for CTF Logs
Distinguish seconds from milliseconds, normalize UTC, and reconstruct a defensible event timeline.
GUIDE 08 / CLASSICALROT13 and Caesar Cipher Identification
Recognize shift-cipher signals, test ROT13 quickly, and require readable evidence before proceeding.
GUIDE 09 / TEXTHow to Extract CTF Flags with Regex
Build bounded patterns, avoid greedy matches, and verify extraction against noisy negative cases.
GUIDE 10 / TOOLINGA Focused CyberChef Alternative
Choose a small local-first workflow for quick transforms and know when a broader workbench is warranted.
GUIDE 11 / WEBPercent-Encoding in CTF Challenges
Decode URL components without exposing structural delimiters or losing the original evidence.
GUIDE 12 / ENCODINGHow to Identify Binary Text
Test byte boundaries, UTF-8 assumptions, bit order, and offsets with reproducible round trips.
GUIDE 13 / INTEGRITYHow to Identify Common Hash Formats
Use length and prefixes as filters, then confirm candidates with context and known-input vectors.
GUIDE 14 / WORKFLOWA Reproducible CTF Evidence Notes Workflow
Separate observations, hypotheses, actions, dead ends, and verification into a reviewable solve record.