~$ ./advent --year 2026
play in your terminal:
ssh pwn.lowlevel.academy -p 2222
Grab a handle up top to start — you'll get a player token.
FAQ
What is Advent of Pwn?
Twenty-five binary-exploitation challenges, one per day from Dec 1–25, ramping from a first stack smash up to bugs you have to fuzz for under every modern mitigation. Pop the target, read your flag, climb the scoreboard.
How do I play a challenge?
Open a day, download its binary, and find the bug locally. The live target
runs at nc pwn.lowlevel.academy 310NN (the port is 31000 + the day
number). Paste your player token as the first line when you connect,
then throw your exploit — when you pop a shell you can read your flag.
What's my player token, and why do I paste it into nc?
Your account has a stable token shown on every challenge page. The target uses it to mint a flag that belongs only to you for that connection. It's your identity on the wire — treat it like a password.
Can I just share a flag with a friend?
No. Flags are per-connection: a flag minted for your token won't validate for anyone else's account, so a shared flag scores the other person nothing.
Can I play in my terminal instead of the browser?
Yes — ssh pwn.lowlevel.academy -p 2222
drops you into the full TUI: browse challenges, grab your token, and submit flags.
When do challenges unlock?
Each door opens on its December date — Day 1 on Dec 1, Day 2 on Dec 2, and so on. Locked doors show a 🔒 until their day arrives.
What should I have installed?
A Linux box with a debugger (gdb + a plugin like pwndbg/GEF) and pwntools will cover you for the early tiers; later heap and fuzzing days want a matching libc and a fuzzer.
Can I use AI?
Yes — LLMs and AI assistants are fair game, the same as a disassembler or a debugger. Modern exploitation work uses these tools, and learning to drive them well is part of the craft.
That said, the point of Advent of Pwn is to understand the bugs. Flags are per-connection and tied to your account, so pasting a challenge into a model and submitting whatever it spits out mostly cheats you out of the thing you came here for. Use AI to get unstuck, check your reasoning, or speed up the boring parts — then make sure you could do it again without it.
I logged out — how do I get back in?
Log in with your username and password. Your token, solves, and scoreboard spot are tied to your account, so they come right back.