CTF Forensics and Steganography Analysis: Practical Solution Methods
Binary String EnumerationExamining the downloaded file in a hex editor (such as 010 Editor) allows for a direct search of specific signatures. By querying the string "CATCTF", the hidden credential can be directly retrieved.Credential: CatCTF{EFI_1sv3ry_funn9}Image Color Channel Analysis and Morse DecodingWhen standard hex inspection and metada ...
Posted on Sun, 17 May 2026 19:56:59 +0000 by Bramme
Capture the Flag: Hacker_Kid Machine Exploitation Guide
Platform: VirtualBox
Attacker System: Kali Linux (IP: 10.0.2.15)
Target System: Hacker_Kid (IP: 10.0.2.42)
Objective: Obtain root privileges and capture the flag.
Reconnaissance and Scanning
Initial host discovery was performed using Nmap to identify the target IP address. Subsequently, a port scan revealed three open services:
Port 53 (DNS)
P ...
Posted on Fri, 15 May 2026 03:23:57 +0000 by beanwebb
Upload-Labs File Upload Bypass Techniques and Implementation Strategies
Overview
File upload vulnerabilities arise when web applications inadequately validate or sanitize user-supplied files before storing and serving them. Exploiting these flaws allows attackers to inject executable code—such as PHP webshells—into the server’s filesystem, often leading to remote code execution. Upload-Labs is a deliberately vulner ...
Posted on Thu, 14 May 2026 14:50:47 +0000 by jrforrester
Red Team Assessment Lab 4: Complete Penetration Testing Walkthrough
Environment Setup
Network Configuration
Two network adapters required:
External network: 192.168.157.0/24
Internal network: 192.168.183.0/24
Windows 7 Configuration
Start the Win7 VM and the Domain Controller first. Do not start the web server yet.
Credentials: Dotest123
Navigate to Control Panel → Power Options
Set all power-saving features ...
Posted on Wed, 13 May 2026 12:11:20 +0000 by Joe689
RCTF 2015 EasySQL: Exploiting Error-Based Injection via User Registration
The login form itself remains unresponsive to basic authentication attempts. After registering an arbitrary account and signing in, the application redirects to a path containing a title parameter and exposes a password-change feature. Attempting to inject inside the password-reset interface produces no discernible output, indicating the vulner ...
Posted on Sun, 10 May 2026 10:30:11 +0000 by MeOnTheW3