> For the complete documentation index, see [llms.txt](https://heapbytes.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://heapbytes.gitbook.io/notes/ctf-writeups/2025-ctfs.md).

# 2025 CTFs

- [Pico CTF](https://heapbytes.gitbook.io/notes/ctf-writeups/2025-ctfs/pico-ctf.md)
- [3v@l](https://heapbytes.gitbook.io/notes/ctf-writeups/2025-ctfs/pico-ctf/3v-l.md)
- [WebSockFish](https://heapbytes.gitbook.io/notes/ctf-writeups/2025-ctfs/pico-ctf/websockfish.md)
- [Payatu CTF](https://heapbytes.gitbook.io/notes/ctf-writeups/2025-ctfs/payatu-ctf.md)
- [Infrastructure](https://heapbytes.gitbook.io/notes/ctf-writeups/2025-ctfs/payatu-ctf/infrastructure.md)
- [Web](https://heapbytes.gitbook.io/notes/ctf-writeups/2025-ctfs/payatu-ctf/web.md)
- [Secure Upload](https://heapbytes.gitbook.io/notes/ctf-writeups/2025-ctfs/payatu-ctf/web/secure-upload.md): File upload bypass - Magic bytes
- [Travel Agency](https://heapbytes.gitbook.io/notes/ctf-writeups/2025-ctfs/payatu-ctf/web/travel-agency.md): LFI + RFI
- [Blind Trust](https://heapbytes.gitbook.io/notes/ctf-writeups/2025-ctfs/payatu-ctf/web/blind-trust.md): NOSQLi