A web app that turns raw CTF notes into a clean write-up. Plain HTML + CSS + vanilla JavaScript — no build step, no package manager, no CDN, and it still works with the network switched off.
| Editor | Profile · event and report metadata · many challenges per report, each with description, attachments, hints, tools, recon, numbered steps, solver script, flag, mitigation, lessons learned and references. |
| Markdown | Bold, italic, inline code, strikethrough, headings, lists, quotes, tables, fenced code blocks with lightweight syntax highlighting and copy buttons, links and images. |
| Theme | 7 colour presets · 3 layouts (Modern / Classic / Terminal) · 11 free colours · body, heading and code fonts (system font, a custom name, or an uploaded .ttf/.otf/.woff embedded into the export) · custom CSS. |
| Flags | Plain, spoiler-on-click, partially redacted, or hidden. |
| Export | Self-contained HTML (images and fonts embedded) · print / PDF · Markdown plus images as a ZIP · project .json — with a completeness checklist for every write-up. |
| Privacy | 100% offline — projects autosave to localStorage, nothing is ever uploaded. |
| License | MIT |
Source code · Live app · Usage
Packaged the CTF triage tools into a single installable npm package. Each tool keeps its own dependencies, so you install only what the challenge needs.
| Install | npm install -g the-ultimate-ctf-utils — Node 16+ and Python 3.8+ |
| Commands | ctf-utils dispatcher plus six direct commands: webparamtrace, cryptoattack-triage, pyunpack-trace, heapviz, pcap-stream-extractor, audio-stego-analyzer |
| Web | Hidden parameter discovery by response similarity · SSTI payload matrix for Jinja2, Twig, Freemarker, Velocity, Smarty, ERB, Mako, Handlebars · recursive LFI mapper with PHP wrappers |
| Crypto | RSA triage (small e, small n, Fermat) · common-modulus · Hastad broadcast · ECC parameter checks · ECDSA nonce reuse recovery · LCG state recovery |
| Reverse engineering | PyInstaller / py2exe extraction with PE section info · .pyc decompile with disassembly fallback · AST and pattern scan for string obfuscation, XOR and anti-debug checks |
| Binary exploitation | GDB extension that renders glibc heap chunks, tcache and fastbin chains, unsorted bins, and scans for leaked libc and heap pointers — no pwndbg or GEF required |
| Forensics | TCP/UDP session reconstruction · HTTP, FTP and SMB file carving · DNS exfiltration detection by label length and entropy · non-standard ICMP payload analysis |
| Steganography | LSB extraction with magic-byte detection · spectrogram energy pattern scan · DTMF tone decoding via Goertzel · Morse code detection and decode |
| License | MIT |
Source code · npm package · Usage
A working store front that shipped only as compiled output — no readable source. I recovered the source from the bundle, rebuilt the interface as React + esbuild, and now maintain it as a fork of the original project.
| Problem | 1,800+ games in a working app that shipped as compiled output only — unmaintainable and impossible to change. |
| Approach | Bundle analysis → source recovery → static analysis of the compiled app → reimplementation in a maintainable stack → documented fork. |
| Result | Readable, buildable source again. Browse, search, queue downloads, install and update games from the console UI — no PC required. |
| Engineering | Focus-driven controller navigation · 15 interface languages · RTL-aware layout · resumable download queue across multiple providers. |
| My role | Fork owner and maintainer — source recovery, interface rewrite, localisation, download queue, upstream sync. |
| License | MIT |
Source code · Release v1.1.0 · Fork notes
Maintained as a fork of MyLuxy/overdrive. Every fork-specific change is listed in FORK-NOTES.md.
A browser-based password vault. Every character comes from crypto.getRandomValues — a CSPRNG, not
Math.random — and the result is shuffled with a CSPRNG-driven Fisher–Yates pass, so the output is
neither guessable nor patterned.
| Randomness | crypto.getRandomValues over a 72-character alphabet (A–Z, a–z, 0–9, symbols) · CSPRNG Fisher–Yates shuffle · optional personal salt mixed into the seed. |
| Strength | Live entropy readout in bits with a Standard / Elite verdict · length slider from 12 to 64 characters · 195 bits at the default 32-character length. |
| Privacy | Zero-server — generation and auditing happen entirely in the browser, nothing is transmitted, logged or stored. |
| Interface | Glassmorphism vault UI · wallpaper engine with exposure and focus sliders · single-file, dependency-light build. |
| License | MIT |
Source code · Live app · Usage
The live build sits behind a master key — admin, as published in the repository README.
- WriteUp Forge — offline generator write-up CTF, with HTML / Markdown / PDF export and a completeness checklist.
- MrLowPr/overdrive — the Overdrive fork, with source recovered and every fork-specific delta documented.
- The Ultimate CTF Utils — six CTF triage tools shipped as one npm package.
- Working mostly in Java and Python, deployed with Docker.
- Spending most of my time on reverse engineering.
- GitHub — @MrLowPr
Hand-written Markdown, no trackers, no build step.