The writeup archive

Base64-decodes to tw1n_f4c3s_4r3_h4rd ("twin faces are hard").

Organization: Beacon Data Systems Incident Date: 2024-03-14 Analysis Date:** 2024-03-16

We are provided with a packet capture file welcomecall.pcap.

The storefront offers a Founder’s Vault deed as lot 4042 for 1,000,000 credits. New FutureBank accounts only receive 500 credits, so the intended path is to find a discount code that is…

1. Open the challenge site in Chrome. 2. Press F12 and open the Console tab. 3. Paste and run the following script:

Challenge Overview Category: Forensics / Memory Analysis Provided Files: - memory.lime.zst (Compressed LiME memory dump) - Q3_patient_records.pdf.locked (Encrypted document, 672 bytes)…

The binary is a "coprocessor" simulator. A 32×32 lattice of bits is grown for 7 generations of a linear (XOR) cellular automaton, and the result is bit-packed into a 128-byte page that…

Reverse engineering of the countersign PIE binary and a protocol-only solver that recovers the 24-byte RUN payload for any live instance.

A Sparrow Freight developer insisted the production carrier token never made it into a commit, and that the history was spotless. It was — the repository was pulled before anyone had a…

An Android password-manager APK (onyx-locker-2.4.0.apk, package com.onyx.locker) plus a live backend at https://web-f328e5c854ffc583.web.h7tex.com. The app's UI only ever prints bullet…

MURMUR is the control channel used between gateways and guest nodes in the Halcyon industrial mesh. This note is the fielded v1.2 profile. It is enough to read a link if you already hold…

It fetches arbitrary URLs and returns their content, making it vulnerable to SSRF.

Endpoint: https://web-dac032e81309a592.web.h7tex.com Start creds: AKIAANALYST0000000000 / wJalrAnalystSecretKeyEXAMPLEbPxRfiCY (region us-east-1) Start identity:**…

Nothing incriminating — the suspect's story holds. But notice the rowid gap: _id 4 is missing while 1,2,3,5,6,7 are present. Message 4 was deleted, not never-existed.

The home page exposed a CherryPic image-metadata feature:

No sleuthkit and no root on this box, but debugfs / dumpe2fs read the image read-only straight from the file, which is all this needs.

A PNG image (case_evidence.png) containing multiple layers of hidden data.

The program starts with a balance of 10 and lets us place roulette wagers. A successful spin doubles the wager, while a losing spin subtracts it from the balance. The flag is printed…

The crew's inside man left a note taped under a desk, written for someone who "already knew the rotation." No key was given — but old habits die hard, and this cipher has exactly 25…

The Blackout Gateway is a simulated API security console with a server-side fetch simulator, JWT token workbench, and an admin console. The goal is to bypass an SSRF filter, forge a JWT,…

A beginner web exploitation challenge focusing on IDOR (Insecure Direct Object Reference) vulnerabilities.

We land on a machine at 10.10.10.66 with arpspoof and tcpdump available. The network contains:

Dont you dare to enter here. You thought it would be this easy ? huh.

The challenge is a Kubernetes container-registry portal. From a highly restricted service-account, the goal is to reach full cluster admin (system:masters) and read a secret containing…