# 六、题解篇

* Pwn
  * [6.1.1 pwn HCTF2016 brop](/ctf-all-in-one/6_writeup/pwn/6.1.1_pwn_hctf2016_brop.md)
  * [6.1.2 pwn NJCTF2017 pingme](/ctf-all-in-one/6_writeup/pwn/6.1.2_pwn_njctf2017_pingme.md)
  * [6.1.3 pwn XDCTF2015 pwn200](/ctf-all-in-one/6_writeup/pwn/6.1.3_pwn_xdctf2015_pwn200.md)
  * [6.1.4 pwn BackdoorCTF2017 Fun-Signals](/ctf-all-in-one/6_writeup/pwn/6.1.4_pwn_backdoorctf2017_fun_signals.md)
  * [6.1.5 pwn GreHackCTF2017 beerfighter](/ctf-all-in-one/6_writeup/pwn/6.1.5_pwn_grehackctf2017_beerfighter.md)
  * [6.1.6 pwn DefconCTF2015 fuckup](/ctf-all-in-one/6_writeup/pwn/6.1.6_pwn_defconctf2015_fuckup.md)
  * [6.1.7 pwn 0CTF2015 freenote](/ctf-all-in-one/6_writeup/pwn/6.1.7_pwn_0ctf2015_freenote.md)
  * [6.1.8 pwn DCTF2017 Flex](/ctf-all-in-one/6_writeup/pwn/6.1.8_pwn_dctf2017_flex.md)
  * [6.1.9 pwn RHme3 Exploitation](/ctf-all-in-one/6_writeup/pwn/6.1.9_pwn_rhme3_exploitation.md)
  * [6.1.10 pwn 0CTF2017 BabyHeap2017](/ctf-all-in-one/6_writeup/pwn/6.1.10_pwn_0ctf2017_babyheap2017.md)
  * [6.1.11 pwn 9447CTF2015 Search-Engine](/ctf-all-in-one/6_writeup/pwn/6.1.11_pwn_9447ctf2015_search_engine.md)
  * [6.1.12 pwn N1CTF2018 vote](/ctf-all-in-one/6_writeup/pwn/6.1.12_pwn_n1ctf2018_vote.md)
  * [6.1.13 pwn 34C3CTF2017 readme\_revenge](/ctf-all-in-one/6_writeup/pwn/6.1.13_pwn_34c3ctf2017_readme_revenge.md)
  * [6.1.14 pwn 32C3CTF2015 readme](/ctf-all-in-one/6_writeup/pwn/6.1.14_pwn_32c3ctf2015_readme.md)
  * [6.1.15 pwn 34C3CTF2017 SimpleGC](/ctf-all-in-one/6_writeup/pwn/6.1.15_pwn_34c3ctf2017_simplegc.md)
  * [6.1.16 pwn HITBCTF2017 1000levels](/ctf-all-in-one/6_writeup/pwn/6.1.16_pwn_hitbctf2017_1000levels.md)
  * [6.1.17 pwn SECCONCTF2016 jmper](/ctf-all-in-one/6_writeup/pwn/6.1.17_pwn_secconctf2016_jmper.md)
  * [6.1.18 pwn HITBCTF2017 Sentosa](/ctf-all-in-one/6_writeup/pwn/6.1.18_pwn_hitbctf2017_sentosa.md)
  * [6.1.19 pwn HITBCTF2018 gundam](/ctf-all-in-one/6_writeup/pwn/6.1.19_pwn_hitbctf2018_gundam.md)
  * [6.1.20 pwn 33C3CTF2016 babyfengshui](/ctf-all-in-one/6_writeup/pwn/6.1.20_pwn_33c3ctf2016_babyfengshui.md)
  * [6.1.21 pwn HITCONCTF2016 Secret\_Holder](/ctf-all-in-one/6_writeup/pwn/6.1.21_pwn_hitconctf2016_secret_holder.md)
  * [6.1.22 pwn HITCONCTF2016 Sleepy\_Holder](/ctf-all-in-one/6_writeup/pwn/6.1.22_pwn_hitconctf2016_sleepy_holder.md)
  * [6.1.23 pwn BCTF2016 bcloud](/ctf-all-in-one/6_writeup/pwn/6.1.23_pwn_bctf2016_bcloud.md)
  * [6.1.24 pwn HITCONCTF2016 House\_of\_Orange](/ctf-all-in-one/6_writeup/pwn/6.1.24_hitconctf2016_house_of_orange.md)
  * [6.1.25 pwn HCTF2017 babyprintf](/ctf-all-in-one/6_writeup/pwn/6.1.25_pwn_hctf2017_babyprintf.md)
  * [6.1.26 pwn 34C3CTF2017 300](/ctf-all-in-one/6_writeup/pwn/6.1.26_pwn_34c3ctf2017_300.md)
  * [6.1.27 pwn SECCONCTF2016 tinypad](/ctf-all-in-one/6_writeup/pwn/6.1.27_pwn_secconctf2016_tinypad.md)
  * [6.1.28 pwn ASISCTF2016 b00ks](/ctf-all-in-one/6_writeup/pwn/6.1.28_pwn_asisctf2016_b00ks.md)
  * [6.1.29 pwn Insomni'hack\_teaserCTF2017 The\_Great\_Escape\_part-3](/ctf-all-in-one/6_writeup/pwn/6.1.29_pwn_insomnictf2017_the_great_escape3.md)
  * [6.1.30 pwn HITCONCTF2017 Ghost\_in\_the\_heap](/ctf-all-in-one/6_writeup/pwn/6.1.30_pwn_hitconctf2017_ghost_in_the_heap.md)
  * [6.1.31 pwn HITBCTF2018 mutepig](/ctf-all-in-one/6_writeup/pwn/6.1.31_pwn_hitbctf2018_mutepig.md)
  * [6.1.32 pwn SECCONCTF2017 vm\_no\_fun](/ctf-all-in-one/6_writeup/pwn/6.1.32_pwn_secconctf2017_vm_no_fun.md)
  * [6.1.33 pwn 34C3CTF2017 LFA](/ctf-all-in-one/6_writeup/pwn/6.1.33_pwn_34c3ctf2017_lfa.md)
  * [6.1.34 pwn N1CTF2018 memsafety](/ctf-all-in-one/6_writeup/pwn/6.1.34_pwn_n1ctf2018_memsafety.md)
  * [6.1.35 pwn 0CTF2018 heapstorm2](/ctf-all-in-one/6_writeup/pwn/6.1.35_pwn_0ctf2018_heapstorm2.md)
  * [6.1.36 pwn NJCTF2017 messager](/ctf-all-in-one/6_writeup/pwn/6.1.36_pwn_njctf2017_messager.md)
  * [6.1.37 pwn sixstarctf2018 babystack](/ctf-all-in-one/6_writeup/pwn/6.1.37_pwn_sixstarctf2018_babystack.md)
  * [6.1.38 pwn HITCONCMT2017 pwn200](/ctf-all-in-one/6_writeup/pwn/6.1.38_pwn_hitconcmt_pwn200.md)
  * [6.1.39 pwn BCTF2018 house\_of\_Atum](/ctf-all-in-one/6_writeup/pwn/6.1.39_pwn_bctf2018_house_of_atum.md)
  * [6.1.40 pwn LCTF2016 pwn200](/ctf-all-in-one/6_writeup/pwn/6.1.40_pwn_lctf2016_pwn200.md)
  * [6.1.41 pwn PlaidCTF2015 PlaidDB](/ctf-all-in-one/6_writeup/pwn/6.1.41_pwn_plaidctf2015_plaiddb.md)
  * [6.1.42 pwn hacklu2015 bookstore](/ctf-all-in-one/6_writeup/pwn/6.1.42_pwn_hacklu2015_bookstore.md)
  * [6.1.43 pwn 0CTF2018 babyheap](/ctf-all-in-one/6_writeup/pwn/6.1.43_pwn_0ctf2018_babyheap.md)
  * [6.1.44 pwn ASIS2017 start\_hard](/ctf-all-in-one/6_writeup/pwn/6.1.44_pwn_asis2017_start_hard.md)
  * [6.1.45 pwn LCTF2016 pwn100](/ctf-all-in-one/6_writeup/pwn/6.1.45_pwn_lctf2016_pwn100.md)
* Reverse
  * [6.2.1 re XHPCTF2017 dont\_panic](/ctf-all-in-one/6_writeup/reverse/6.2.1_re_xhpctf2017_dont_panic.md)
  * [6.2.2 re ECTF2016 tayy](/ctf-all-in-one/6_writeup/reverse/6.2.2_re_ectf2016_tayy.md)
  * [6.2.3 re CodegateCTF2017 angrybird](/ctf-all-in-one/6_writeup/reverse/6.2.3_re_codegatectf2017_angrybird.md)
  * [6.2.4 re CSAWCTF2015 wyvern](/ctf-all-in-one/6_writeup/reverse/6.2.4_re_csawctf2015_wyvern.md)
  * [6.2.5 re PicoCTF2014 Baleful](/ctf-all-in-one/6_writeup/reverse/6.2.5_re_picoctf2014_baleful.md)
  * [6.2.6 re SECCONCTF2017 printf\_machine](/ctf-all-in-one/6_writeup/reverse/6.2.6_re_secconctf2017_printf_machine.md)
  * [6.2.7 re CodegateCTF2018 RedVelvet](/ctf-all-in-one/6_writeup/reverse/6.2.7_re_codegatectf2018_redvelvet.md)
  * [6.2.8 re DefcampCTF2015 entry\_language](/ctf-all-in-one/6_writeup/reverse/6.2.8_re_defcampctf2015_entry_language.md)
* Web
  * [6.3.1 web HCTF2017 babycrack](/ctf-all-in-one/6_writeup/web/6.3.1_web_hctf2017_babycrack.md)
* Crypto
* Misc
* Mobile


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://firmianay.gitbook.io/ctf-all-in-one/6_writeup.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.