7 posts found
5 min read
A noisy capture with one loud port scan hiding the real story. Filtering the noise exposes a WordPress Social Warfare exploit, the HTTP port the attacker served the payload from, and the reverse shell that called home — exactly the two ports the flag wants.
#CTF#Cybersecurity#Network
3 min read
A packet capture of an intrusion against a vsftpd 2.3.4 server. The attacker pops the famous smiley backdoor, lands a root shell, then exfiltrates a JPEG as base64 over a reverse shell. Reassemble the stream and the flag is painted inside the stolen image.
#CTF#Cybersecurity#Forensics
5 min read
A shipped Docker image whose final container looks spotless. Peeling back the OCI layers exposes the build history, a deleted state file hidden behind a whiteout, and an original output the developer thought they overwrote. Two leaks invert a custom block cipher and hand back the flag.
#CTF#Cybersecurity#Forensics
4 min read
A pcap posing as a Bluetooth file transfer actually carries a WAV file split across 459 UDP packets. The audio is not a protocol — it is a Hellschreiber bitmap, and the spectrogram is the decoder.
#CTF#Cybersecurity#Forensics
3 min read
A tiny capture that looks like DNS noise, a decoy ICMP flood and a fake SSH session. The real message is smuggled in two header fields nobody reads: the IP identification field of ICMP echoes and the TCP window size of an HTTP flow.
#CTF#Cybersecurity#Forensics
5 min read
A raw satellite downlink that refuses to auto-frame. Recognize the CCSDS telemetry structure, undo the PN9 pseudo-randomizer, reassemble the space-packet stream, and the flag falls out of a single virtual channel carrying a fragmented message.
#CTF#Cybersecurity#Forensics
4 min read
A packet capture of a data-exfiltration implant that steals images off a Windows desktop, XORs them with a hard-coded key and POSTs them as hex. The served malware ships the key, so the whole capture decrypts back to the stolen files.
#CTF#Cybersecurity#Forensics