ISFCR CTF 2026

The evidence fields, in the required order, are:

The site is a hash-routed SPA (nothing renders from the server). The useful surface is all in the JavaScript:

The employee directory exposed internal employee records without enforcing that the requested record belonged to the logged-in user. The leaked debug_reference for another employee led…

The recovered evidence passes the AES-GCM authentication check supplied in the challenge.

server.py is a blind Schnorr signing service over secp256k1. On connect it sends its public key for that connection:

The input to enter into the app's "whisper" field is:

The supplied mosaic_0417.png is a 256 × 300 indexed-color PNG. It contains a palette, two text chunks, nine IDAT chunks, and no data after IEND. The picture looks like colorful noise.

The challenge page identifies the target as the legacy problem search. The Problems page shows that searches are sent to:

Attack chain:** Jinja2 SSTI (RCE as webapp) → forged TPM attestation against the internal vault (VAULT-114) → leaked tpm-admin SSH key → TOCTOU symlink race in the measure-and-run sudo…

The capture is plain, unencrypted MQTT from a dozen smart-home devices. Two devices hide data in covert channels:

The capture is plain, unencrypted MQTT from 12 smart-home devices. Two devices hide data in covert channels:

A small industrial controller exposes a line-oriented ASCII maintenance service over TCP. Factory service mode is supposed to be reachable only by on-site technicians with a dedicated…

This flag was confirmed accepted by the challenge submission system.

The attachment is an Android diagnostic app for the LumoWise LW-7 smart bulb. Its UI accepts a 16-byte challenge response as 32 hexadecimal characters. The actual validation and flag…

The box protects its flags with a warden (/opt/warden/warden.py, runs as root). The real flag files live in /var/lib/warden/real/, while the decoys live in /var/lib/warden/decoy/. The…