I built and deployed the first complete version of CTF Replay Lab, a local-first browser workspace that helps CTF players understand how an investigation is solved instead of simply copying a finished writeup.

The problem I wanted to solve is that beginners often have to switch between several unfamiliar tools, manually track evidence, and guess whether a discovered flag-shaped string is real or just a decoy. CTF Replay Lab brings that workflow into one guided interface while keeping the uploaded artifact inside the browser.

I implemented magic-byte file detection, SHA-256 hashing, Shannon entropy analysis, printable-text statistics, metadata parsing, ASCII and UTF-16LE string extraction, an offset-aware hex viewer, file carving, and appended or embedded ZIP detection. It supports analysis of formats including PNG, JPEG, PDF, ZIP, ELF, PE, WAV, PCAP, and text artifacts.

I also built a multi-stage decoder workbench for Base64, hex, ROT13, Caesar cipher, URL decoding, reversed text, and repeating-key XOR. Users can pass one decoder’s output directly into the next operation, preserve findings in an evidence ledger, write investigation notes, replay their actions, follow progressive hints, and export Markdown reports or JSON evidence.

The three biggest quality-of-life improvements are:

No setup or artifact uploading: analysis runs locally in the browser, files are not sent to a backend, and uploaded executables are never run.
A guided investigation workflow: the timeline, progressive hints, evidence ledger, and built-in demo make the reasoning process easier to follow.
Reliable flag verification: discovered flag-shaped strings remain unverified until a trusted challenge manifest confirms their SHA-256 hash.

The hardest part was preventing every flag-looking string from being treated as the correct answer. I solved this with provenance tracking, manifest-backed verification, and optional artifact hashes so a flag cannot be verified against the wrong challenge file.

I also added archive safety controls, including upload and extraction limits, compression-ratio checks, safe filenames, and rejection of unsupported compression methods.

I am most proud that the project does not only show analysis results—it preserves the steps that produced them, helping newer players learn a repeatable investigation process.

Please test the built-in demo or upload authorized CTF artifacts, especially files with misleading extensions, appended archives, encoded payloads, or multiple flag-shaped decoys. I would especially appreciate feedback about false detections, confusing hints, broken extraction or decoder workflows, browser performance, and mobile responsiveness.

Next, I plan to test more malformed files and complete challenge flows, fix remaining bugs, improve the mobile experience, and record a short demonstration video.

Github: https://github.com/FluxKnight/CTF-Replay-Lab

Live demo: https://fluxknight.github.io/CTF-Replay-Lab/