Interactive Cyber Escape Room: Binary Logic Gate & CTF Mini-Game (2026)

A Capture The Flag (CTF) is a gamified cybersecurity challenge where participants solve realistic puzzles across categories like Cryptography, Web Exploitation, Reverse Engineering, Forensics, and Binary Exploitation (`Pwn`) to uncover a hidden text string formatted like `FLAG{s0m3_s3cr3t_str1ng}`.

A standard `OR` gate outputs `1` if *either or both* inputs are `1` (`1 OR 1 = 1`). An `XOR` (Exclusive OR) gate outputs `1` **only when the two inputs are different** (`1 XOR 0 = 1` and `0 XOR 1 = 1`), and outputs `0` when both inputs are identical (`1 XOR 1 = 0` and `0 XOR 0 = 0`). Because `A XOR B XOR B = A`, XOR is the foundation of symmetric stream ciphers.

A `NAND` (NOT-AND) gate outputs `0` only when both inputs are `1`, and `1` otherwise. By wiring `NAND` gates together, you can construct every other Boolean gate (`NOT`, `AND`, `OR`, `XOR`) and build an entire CPU arithmetic logic unit (ALU) and NAND flash memory cell array.

Encryption requires a secret key (`K`) so unauthorized parties cannot read the plaintext. Base64 (RFC 4648) is a deterministic, publicly documented binary-to-text encoding table (`A-Z`, `a-z`, `0-9`, `+`, `/`, with `=` padding) designed to carry binary bytes safely across text-only protocols like HTTP headers and email MIME bodies. Anyone can decode Base64 instantly without a key.

In vulnerable string concatenation (`"SELECT * FROM users WHERE user='" + input + "'"`), an input like `' OR '1'='1' --` alters the SQL abstract syntax tree (AST) itself. Parameterized queries (`SELECT * FROM users WHERE user = ?`) compile the SQL query structure first and pass user input strictly as a bound literal value that can never be interpreted as SQL commands.