🎃
The Haunted Badge
WebMedium
JWT algorithm confusion straight from Blackwood Manor. Guaranteed to open the séance room. No refunds, only regrets.
Why solve it
when you can BUY IT
FlagMart is the internet's #1 marketplace for genuine, hand-picked CTF flags. Skip the all-nighter. Skip the stack traces. Just pay and paste. It's that easy, and definitely not against the rules.
⭐ 4.9 / 5 (0 real reviews)⚡ Instant delivery*🔒 100% unverified💸 Scan to pay
🔥 Hot flags this season
Limited stock. Prices rise as the clock hits midnight. (They do not.)
👻
Two Parsers, One Cache
WebInsane
Premium request-smuggling + cache-deception combo. For the player who has given up on sleep.
💀
Spirit Token (Genuine)
PwnHard
Header-normalization bypass in a bottle. Whisper it with underscores and the crypt opens.
🔮
Séance SSRF Deluxe
WebHard
Make the server call the dead on your behalf. Internal services sold separately.
🕯️
alg:none (Clearance Bin)
WebEasy
Our cheapest flag. Does not actually work on any good challenge. You get what you pay for.
🪦
Mystery boo{} Box
MiscInsane
Could be a flag. Could be a cursed portrait. Could be nothing. Spooky!