Cyborg 🔍 Initial Scan & Hash Cracking 🕵️ First, I performed an nmap scan: 💻 It returned some interesting ports, so I fetched the hash: music_archive:$apr1$BpZ.Q.1m$F0qqPwHSOG50URuOVQTTn. ...

ZeroDay 2026 - Phisher-man Caught 🎯 Challenge Info Type: Web Challenge – A realistic phishing email analysis challenge Even though this is labeled as a phishing challenge, it is actually a b...

Checkmate 🔍 Hydra Brute Force 🕵️ I used Hydra and found the password: 🔑 For the second password, it says: I tried these tags with the username marco: 💡 I found it. I tried manually first,...

All In One 🔍 Port & Path Discovery 🕵️ First, I tried to discover web paths: As you can see, it says it is waiting for moderation. 🕵️ Exploiting SSRF / LFI 💻 The next step is to test fo...

Mkingdom 🔍 Port Scanning 🕵️ As always, let’s start with an nmap scan: Yes, only one port is open. Well, it’s cute. Yes, time to explore! Checking the app URL, when we click ‘jump’, we are red...

ZeroDay CTF 2026 - Overview Day Zero: Stepping into the Arena This is where it all begins. As an 18-year-old, first-year university student, I recently participated in my very first Capture The F...

ZeroDay 2026 - Holiday Scam Challenge Info Type: Web Challenge – A realistic scam site with hidden elements and encoded flag So it is a web challenge, basically a scam site designed like rea...

Library 🔍 Reconnaissance & Enumeration 🕵️ Let’s check the FTP and HTTP paths: 💻 I think we can try brute-forcing SSH. Now we need to find a username: And we found one: 🕵️ User Access ...

Ide 🔍 Port Scanning & FTP Enumeration 🕵️ First, run an nmap scan: 💻 As you can see, it is running Codiad 2.8.4. I searched for vulnerabilities, but we need login credentials to exploit th...

Easy Peasy 🔍 Initial Discovery 💻 Let’s check the source of the page: view-source:http://10.49.169.155:65524/n0th1ng3ls3m4tt3r/ 🚩 Found flag 3! 🕵️ Extracting the Hidden Path 💡 Reme...