🧩 Puzzle catalog
Nine self-contained, offline-solvable challenges. Each artifact is derived from its flag at import time, so data can never drift out of sync with the answer.
Active-recall cybersecurity training
Solve CTF challenges. Remember what you learn.
Capture a flag and the puzzle’s concept cards flow straight into your FSRS-scheduled review deck — so what you learn actually sticks. Nine offline-solvable challenges across crypto, web, forensics, reversing, network, and misc.
Run the backend locally
$ cd backend $ python -m venv .venv && .venv\Scripts\activate $ pip install -r requirements.txt $ uvicorn app.main:app --reload $ open http://localhost:8000/docs
What it is
CTF Flashcards is a cybersecurity active-recall app. It pairs HackTheBox-style capture-the-flag puzzles with spaced-repetition flashcards, so every concept you uncover in a challenge gets scheduled back into your memory at the moment you’re about to forget it.
🗂️ FSRS review deck
Solving a puzzle unlocks its concept cards into your deck. Type your answer from memory, self-rate Again/Hard/Good/Easy, and FSRS reschedules each card.
📥 Review inbox
Candidate cards from a local monitor land in an inbox. Nothing enters the real deck without your explicit approval.
How it works
1. Solve
Work the artifact (Base64, hex, XOR, Caesar, log analysis, SQL injection, JWT…) and submit the flag.
2. Unlock
A correct flag reveals the solution and adds the puzzle’s concept cards to your review deck.
3. Recall
Review cards on an FSRS schedule — the algorithm spaces each review right before you’re likely to forget.
Puzzle categories
Nine challenges across six categories. Each one teaches a real cybersecurity concept and unlocks flashcards for it.
Crypto
Base64, Caesar, MD5 hash cracking — encoding vs encryption, classical ciphers, broken hashes.
Web
SQL injection spotting, JWT “none” algorithm — injection root cause, unsigned token forgery.
Forensics
Hex dump reversal — bytes back to ASCII text.
Reversing
Single-byte XOR — known-plaintext key recovery, XOR reversibility.
Network
SSH brute-force log detective — counting failed logins per source IP.
Misc
Binary-to-ASCII decoding — bits to bytes to characters.
Flags never reach the client. The solution and concept cards are revealed only after a correct submission.
Review
Topic-filtered queues, due-counts, and a full card lifecycle — create, review, delete, and manage your deck.
Quick start
Backend (FastAPI + SQLite)
$ cd backend $ python -m venv .venv && .venv\Scripts\activate $ pip install -r requirements.txt $ uvicorn app.main:app --reload $ # optional: seed starter cards $ python seed.py $ python test_api.py
Frontend (React + Vite)
$ cd web $ npm install $ npm run dev # :5173
The shared backend is
backend/ (FastAPI + SQLite, local-dev twin). Production runs on Cloudflare Worker + D1 in worker/. The two stay behavior-identical.