There's a puzzle hidden somewhere on coinbase's website (I think it's just for applying to an internship which I'm not applying for). Anyone have any suggestions on how to solve it? I've done one CTF before for Ramp but that one had a lot clearer of a starting point.

Thank you!

Hi everyone, I was trying a ctf challenge where multiple random 5 byte keys are XORed with the flag to produce the final encrypted ciphertext. A total of 1955 keys are used. If anyone has any pointers, please help

I just started doing ctf last month , although web ctfs are a pain but are fun to solve , have a couple of doubts

1. Couple of challenges had hardcoded values of the database but no way to access them using the remote server ( also one of them being wordpress site)
2. How do you connect from the localhost, some challenges wanted me to connect to

Or hit certain end points where they are expecting it to come from local host but they are hosted to some ip? How to deal with such situations?

Is anyone actively participating in this event?

Hi everybody

I'm a beginer in ctf, I just learned about sql injection, so can anyone please help me solve this level.

this is source code:

include "flag.php";
if (isset($_POST["username"]) && isset($_POST["password"])) {
  try {
include "db.php";
$sql = "SELECT username, password FROM users WHERE username='" . $_POST["username"] . "'";
$db_result = $database->query($sql);
if ($db_result->num_rows > 0) {
$row = $db_result->fetch_assoc(); 
$password = $row["password"];
if ($password === $_POST["password"]) {
$username = $row["username"];
if ($username === "admin") {
$message = "Wow you can log in as admin, here is your flag $flag4, but how about <a href='level5.php'>THIS LEVEL</a>!";
} else
$message = "You log in as $username, but then what? You are not an admin";
} else
$message = "Wrong username or password";
} else {
$message = "Username not found";

I am looking for a tool that I can use to take screenshots of steps I take during a CTF challenge. I want this to help me reduce having to manually take and crop screenshots for my write up document. Does such a tool exist?

Hello!

We're excited to invite you to r/ChileCTF, a brand-new community dedicated to Spanish-speaking enthusiasts interested in hacking, CTF challenges, write-ups, resources, and more. Whether you’re a beginner or experienced in cybersecurity, this is a place to share insights, ask questions, and learn from others in the community.

Join us in building a collaborative space for everyone passionate about cybersecurity and CTFs. Let’s grow and learn together – ¡nos vemos en r/ChileCTF!

Hey everyone I am a beginner in CTF so can anyone please guide me where to start and how to solve first CTF.

As a beginner , i am Struggling with this ctf challenge . Tried many things but still not able to figure out what will be done .So the challenge goes as below.

"A5UrB1/sBXUkS1AIA5UnBH/sBKMkS1QrA5UnCH/sAnlkS1JaA5UqBH/sAnYkS1ApA5UrCH/sBKMI1Q mA5UqCH/sBXQkS1MsA5UrB.=="

Anyone's help would be appreciated .

Hi everyone!

I’m a software developer currently studying AI and data science. Recently, I participated in a beginner CTF competition and surprisingly took 3rd place, even without any prior knowledge or preparation in this field. This experience sparked my interest in CTF challenges, and I’m eager to learn more about them as a side hobby.

I’m reaching out to the community for guidance on how to get better at CTFs. Specifically, I’d like to know:

1. Where should I start? Are there any recommended platforms, tutorials, or courses for beginners?
2. What are the essential skills or topics I should focus on? (e.g., cryptography, web security, reverse engineering, etc.)
3. How can I practice effectively? Should I focus on specific challenges, tools, or techniques?

I’m really excited about diving deeper into this area and would appreciate any advice or resources you can share. Thank you!

Hi!

For a CTF challenge I am asked to find the source (IP address) of a malware I have found in a previous challenge,

For the previous challenge I used volatility3 to analyse the memory dump they provided and since they provided me with the same memory dump for this challenge I expect it to be done in the same way...

Since this memory dump is like a snapshot in time I do not know how they expect me to find the source of the malware, what kind of report could I ask volatility to produce to find the source of the malware I identified in the previous challenge?

Thank you for any suggestions...

Be part of the best all-offensive security conference in Asia!

Submit your talk today at: https://typhooncon.com/call-for-papers-2025/

We’ve placed in the top 3% of recent CTFs like IRON CTF, SunshineCTF & Top 5% on SpookyCTF and are currently among the Top 100 teams on HackTheBox. We're pushing for even more!

What We’re Looking For:

• Intermediate to Advanced Players ready to level up.
• Team Players who enjoy collaborating on CTFs and HackTheBox challenges.
• Passionate Juniors eager to learn and grow.

If you're serious about improving and competing with a motivated team, DM me!!

there is a ctf and this osint challange is testing patient, i got the solution from an excel "48447.77" i got the values from "Florida Breweries Report - OneDrive" but it is wrong, i am almost ready to give up on this challange, can someone guide me through it or any clue, hints?? even the answer itself is appreciated.

Challange:

beer sales

In August 2024, a lot of beer was sold in Orlando, Florida. But how much, exactly? Lucky for us, they left the exact number on a PDF on an open FTP server! Include the total number of gallons of beer.

For example: CYBORG{712931.12}

Note: this challenge is limited to 10 attempts to prevent brute-forcing.

I'm really interested in the reconnaissance phase. I know recon is essential for a solid start, but there’s so much out there that it can be overwhelming!

1. What does your recon process look like? – How do you start? Do you follow a set checklist, or is it more dynamic?
2. What tools are must-haves for you? – From asset discovery to vulnerability scanning, I’d love to know which tools you find the most reliable and why. Any lesser-known tools you think should be on everyone's radar?
3. How do you make recon more efficient? – Bug hunting can be time-consuming, so any tips to speed up or automate the recon phase would be amazing!
4. Are there common pitfalls or things that often get overlooked? – What should newbies like me watch out for to avoid missing critical assets or vulnerabilities?
5. How do you ensure full coverage? – Especially for large scopes, what are your strategies to ensure nothing is missed?

Any personal experiences, examples, or advice on recon would be incredibly helpful. Thanks a ton for sharing your knowledge! 🙏

So I am trying to exploit this gets() for a CTF to modify the stack and return to a target address of 0x080a010b. But when I overflow the stack and put this address in the end, which should spill into EBP+0x4, the gets() function interprets 0x0A as a newline '\n' character and messes up the input.

Hello, r/securityCTF ! I'm excited to invite you to a growing Discord server tailored for cybersecurity enthusiasts and tech lovers. This isn’t just another promo – our server is dedicated to:

• Resources & Learning: We’ve curated a resource library where members can access a variety of tools and guides for building cybersecurity skills.
• Capture The Flag (CTF): Join our CTF team! Whether you're experienced or just starting, you'll find opportunities to train, compete, and grow.
• Discussions & Hackathons: Dive into discussions on your favorite tech topics and connect with peers for online and in-person hackathons. (Singapore events included!)

Come be part of a team that learns and innovates together. https://discord.gg/FfSjr6k8NH

Looking forward to welcoming some of you there!

Hi!

I am having trouble with a CTF challenge offered by a company my employer does business with...

Using foremost I was able to get a PNG out of the file they provided.

Unfortunately the flag is not readable because some areas are, as far as I can tell, transparent as I am shown the checkerboard pattern many programs use to show that a section of an image is transparent.

I tried a few things which were supposedly supposed to remove transparencies but what I ended up with was either white or black blocks on the image instead of the checkerboard pattern.

PNG does not apparently support layers but my guess is that they messed with something on that picture to make some areas transparent and there must be a way to revert that....

Any ideas?

Thank you!

Very lost, ive installed the ctf git repository onto vs code and my desktop, unsure how to actually run any of these py files and just even start the game without my own bot.

Hi all,

I am a beginner and solving a Steganography CTF challenge where initially I got a file, figured it out to be docx format and then renamed to .zip and now I am trying to unzip it but its' asking for password.

Is there some online tools which will be fast and ry to decrypt passwords comparing with rockyou.txt, also any guidance on getting the password and ultimately the CTF will be great

hi! I'm currently looking for a CTF team.

• decent amount of experience with Linux, backend development, front-end frameworks (next.js, astro, react etc.)

• worked with python, golang, rust, js and c++ in the past

• previously participated in 3-4 CTFs and won 2 local uni/high school CTFs.

• I'm good with forensic and web exploitation challenges.

• been practicing on hackthebox & tryhackme for a while now.

I'm willing to learn more and participate in more CTFs with a team. If you're interested in taking me in your team - shoot a DM.

Hi there, I’m in my fourth year of undergraduate study, and about two months ago, I finally decided to change my major (from AI) to cybersecurity.

I’m quite interested in Web Security, and I’m a beginner in CTF. However, I find it difficult for me to find or join a CTF team because the people around me are mostly not not interested in these stuffs, so I come to the Internet.

I want to find some partners to learn CTF and take part in competitions together. I’ll mainly focus on Web challenges, but I can also contribute to Misc problems and simple RE problems. There‘s currently only me alone, and I hope to find others who are interested in CTF to eventually form a team of 4 - 6 teammates. If you are interest in, plz DM me 🙏!!!!

If anyone already has a team and is recruiting for Web teammates, plz DM me as well !!!!

About me:

• I’m chinese and currently in China.
• I am familiar with C/C++, Python, and JavaScript, and I’m learning Java recently.
• I have experience in front-end development （I use React）, and I have learned web crawlers (Python requests).
• For CTFs, I have learned some basic sqli/ssti/PHP-related attacks/XSS/… and have participated in 2 recruitment competitions for CTF university clubs in China (I ranked both top 10%).

Please forgive me for not being very familiar with the social media platforms you guys usually use for communication. I have Telegram, X (formerly Twitter), Reddit, and Discord accounts. If you're interested, feel free to message me on Reddit, and we can exchange contact information further!!!

I just completed level 15 and I think I got the correct password (at least checking through the database given in 15) but for some reason I can't get into natas16 - is anyone else able to get in?

well i am playing Kerberos - Authentication lab from root-me.org , i given with a pcapng file of kerberos authentication ,i extracted the pasword hash using bruteshark , i tried cracking it with hashcat hashmode 19700, i tried different wordlists but still nothing , i am struck ,i need help .

the hash that i extracted from pcapng file :

$krb5tgs$18$william.dupond$CATCORP.LOCAL$*cifs/DC01.catcorp.local*$15a0981a1c14990b85babef4$168d462fef2c82289dbac48f37954672bc3d27737d960a36b22f0f5276a5a8d0838c34830458455072fdb4afb52671371a1d9d0904b417a5eddcdcf8caf66e8133cb27c6f6c217256f11983840828b328224201bf0e3a33cf5b6af807371b2d8557bcf3012d6902f46d3c116862bbdd03e01ede8959c579f24a4d4dd23853a84a73f33814d57b895ec5176b41c9b44a5c0cdf3523f9b0baa22a1c5b7da2915192e8a1b02de7f75acf26cbd1913223a87ad278addf18e03812b691d48410f9cf580480293a3d8d9987813635c294b68a21b7473056fd4ee536778b9655cb4909436793078570b88128ba27736c45f286be7817e7a55e1414ba5557d9ea5483c6588cca870d8dbff7c00d05709701fd46d8f5274ea581c8805e03fcf34541046523639e6cf05a76e15036abed561af63657cf56fa8b4497018adf9ba2c58161fa721e9aad63892ee6f43d54ea43a2dc0c70dc30c72cc9fee5380096b402ddf06a73a057ab22e1a8e16579a5e86aa50a1465dd3eaa01e82b5d85b4228b92d86ce4c888f0af894bb7f798df1f737d417470ecf57e386e2175a8ebda7b24e1497cc1ef5b3240fcaa179ab82ec363b5720bc745e87637530f624aeed88ef8a3c51fc8b5297e88c8a63d07a923c261457e57610f6a95bbb172415ad0cbbe252739d63705bde5aec6e0f5a0fda66b52a2a39c26375216f1faee70a06a1fd24175d305eccc3c7266e2dba5f4931068f115ea2c05ca078302ebfa87a9a9142b5d7823f296ef032a530311f9f44be76d98990e808fe5bcc9668e9c119e2e9c185f0dfa2f1376387890515c6699a1924046553aa40091e318434ac7d69819c2a15bd0996de1ed52f26dba215783a4fe89e45d3df30be35e747db2143d9dda6024c8312b0279bd2ebc287a20741ba2d7934c34fe5b4c3a3b14adb9e5f937fcfc37f59eab2efeb1933743e690de864ce397e13c2f0f99cfb8fa8d16028357b2473cdddefe131b2fac3951edcfbf2b78fb62afab33a9ad6c8c58c798fe286954fd74660209439c604f4138913a62dec067b4a14248bf4f9704712b4a2555231d4ec174a65d8c7948e9f240e1fb7ddca6d987ee695d38e3273517c8d27cb06809d476c7ff49e31ba1fec80bd9c0c8da1ae4107de3b3153453080a37c30626495a775b17c1d4a408d992592bf0f928e25d309e1af496aba19d512d341f1b0d070ee455f7ac15a52c58c36554703c4367213478e3f65d2e7329dc4f76c20fd894dbbe04bbe4847d71f16e03704f97254db29bcc1e0c2c97fc74a8929d45ec5c5bde371c723f6aaa0e2cde3365ed5f7def0a7ae6798ac0cff1ef717d7cec57ccc230f8f0b5f616d6b4572467e2453ee4ff6b2327ff5e11571dc009bb9cfa4a9722e120d641b2d488b280d4b44865d320178dea7a6e1a02bb03c244dca39e201a6266c76378c911c80aec40090abbbdb11bedb4795d436157b2a8f9e7b9f6aa913a4eb2e1e8fb79d6ee911bcb0d6b78a43312d7548d13861563e74be13749a0172622924328a0a8dcc476248adb3197bf83eb209314cba0e655ee024e106c6a9db4a441acaee20a15455921b342496272550b44186a5

New vulnerable VM aka "Smol" is now available at hackmyvm.eu :)

Hi everyone,

I'm currently facing a SQL injection challenge, and I'm certain it's SQLi-related. The challenge is on the following site: hlabs.helb-prigogine.be:6543/patrick.php

For most other challenges involving SQL injection, I just had to bypass simple filters, but in this case, I'm completely stuck. Every time I perform an SQL injection, the server responds with the message "cot ?" and I can't figure out how to proceed from here.

I've also tried using SQLmap as a last resort, but it didn't return anything conclusive.

Any help or pointers would be really appreciated!

Thanks in advance!

i am quite new in ctf and got not that much connection and network so is there any blog or social media that posts ctf competitions for beginners or intermediates?

Hey everyone. So I've started getting into CTFs recently. When I read writeups of others, the majority of time, 99% of the time, I see them solve it using Python scripts. They use custom libraries and other stuff (mainly pwntools) for the scripts.

I've picked up the basics of Python. Now I'm looking forward to learning the CTF-specific Python knowledge so I can start reading other's code more comfortably and craft my own scripts. Video, and text content all are welcome. Thank you.

Hello there I'm new to ctf and on task is to find the flag from a image. I'm having trouble as to what to do ive used exif and seen the hex dump but i dont know what to do.

the image in question.