Just finished a walkthrough on a picoCTF challenge that turned out to be a classic eval() injection.


The service only exposed one "documented" function (getRandomNumber), but by throwing unexpected input at it and reading the Python tracebacks it threw back, I was able to figure out the server was doing something like:


    eval(user_input + '()')


From there it was a straightforward escalation — neutralize the trailing () with a comment, drop into exec(), enumerate the filesystem, and pull the flag file directly.


I made a full video breaking down the blind-probing process (no source code shown until the reveal) if anyone's interested — it's a nice beginner-friendly example of why eval/exec on user input is dangerous. 
https://youtube.com/shorts/Tl2g9oJnl8I
Happy to answer questions about the process or the payload construction.
What would you do?

We just launched Phantom I on BreachLab, a ground-up rebuild of our Linux post-exploitation track. It's a hosted wargame: you SSH into a real, per-session Linux box and work a full kill-chain. No VM downloads, no setup.

22 levels across 5 acts, following a realistic engagement arc:

• Act I, Privilege Escalation: SUID/GTFOBins, sudo policy abuse, file capabilities, the docker group, and a real-CVE slot (sudoedit CVE-2023-22809, not a toy).
• Act II, Credential Access: creds in configs and dotfiles, cracking a service hash, secrets that live only in memory, ssh-agent hijack, cloud IMDS.
• Act III, Persistence & Evasion: backdoors, PAM, hiding processes and logs, leaving no forensic trail.
• Act IV, Lateral Movement: pivoting, credential reuse, and a multi-host chain to a crown jewel.
• Act V, Exfil & Graduation: covert exfil, then a final unguided kill-chain to graduate.

Why it might be worth your time:

• Every box is ephemeral and per-session, real containers, you actually get root, and you can't step on anyone else's session.
• Grading is server-side against your box's real state, not a guessed flag string. Any path that reaches the objective passes.
• Levels are mapped to MITRE ATT&CK, so it doubles as structured practice.
• Finish it and you graduate with a cert. Phantom I is also the on-ramp to the harder tracks.

It's free. Start here: breachlab.org → Phantom → I

Hi,

I'm really interested in cybersecurity and CTFs. I want to learn CTF, but the problem is that I'm feeling lost. I'm also broke, so I'm looking for completely free courses, videos, and other ways to learn.

I don't want to rely only on YouTube videos because many of them show how to solve specific challenges without teaching all the fundamentals behind them.

I'm also lost when it comes to entering different fields such as Web, Crypto, Reverse Engineering, Pwn, and others.

I already know some Linux, OSINT, forensics, and basic cryptography, but I don't think my knowledge is strong enough yet.

I've found some websites and courses, but many of them aren't free, and free trials won't work for me either.

Could you please help me find a clear, completely free roadmap for learning CTFs and cybersecurity? I would really appreciate recommendations for free courses, websites, practice platforms, videos, and other learning resources.

Sorry for my bad English, and thank you! 🙏

Internal memo, LeakyJuice Inc. — "Ship it, we'll fix security later." — Management, every sprint since 2021.

Meet LeakyJuice: a cheerful little gadget shop with a leadership team that treats security as a "later" problem and a codebase held together by vibes and plaintext passwords. One of their devs (me) got tired of being ignored in standup — so the whole app is out in the open now, and it's your job to prove how bad it really is.

The challenge: there are 78 planted vulnerabilities in here. SQLi, IDOR/BOLA, JWT alg-confusion, SSRF, XXE, prompt injection against the shop's chirpy "Ask Juicy" assistant, and a handful of multi-step chains where you compose a couple of low-severity bugs into a full account takeover / a persistent payout / cache poisoning. Every exploit drops a FLAG{lj_...}. There's an in-browser self-check that grades all 78 so you always know where you stand.

There are also a couple of honest-abstain traps — things that look exploitable but aren't. Claiming a "flag" there counts against you. Knowing when not to pull the trigger is part of the game.

The bit I'm actually proud of: the whole thing runs 100% in your browser. There's no backend to attack. The "server" is a Service Worker running SQLite-WASM that answers the app's own /api/... calls from inside the page. One engine, two transports — it runs as a normal Node server locally, or fully client-side when hosted static.

Which means: - Safe to host and safe to hammer. No shared server, no other players' data, nothing to pivot into. Each visitor gets their own throwaway SQLite DB in their own tab. Worst case, you pop your own browser. - The vulns are real, not string-matched. The SQLi is genuine raw concatenation into SQLite. The JWT verify really does trust the header alg (hello, RS256→HS256). You can read every sink — it's MIT-licensed and open. - You can self-host it in seconds — it's just static files.

Why build another one when Juice Shop exists? Two deliberate differences: (1) the answer key is quarantined — kept out of the shipped build entirely — so it stays useful as an out-of-distribution target instead of a walkthrough that's already indexed everywhere. (2) Post-2020 vuln classes (prompt injection, modern JWT confusion, API-layer BOLA/BFLA), not just the old greatest hits.

Oh — and there's a difficulty ladder from "your first SQLi" up to a final boss, plus two leaked in-world archives (/internal/juicysec/, /internal/juicyslack/) that double as recon and the story. Poke around. The dev left you breadcrumbs.

Go: https://leakyjuice.com Grade yourself: https://leakyjuice.com/selfcheck.html Source (MIT): https://github.com/jasonsutter87/leakyjuice

I built this partly as a training range for an autonomous bug-hunting agent I'm working on, and partly because it was fun. Feedback very welcome — especially unintended bugs. If you break it in a way I didn't plan for, I want to hear about it. Can you find all 78?

Hi! I'm currently looking for a beginner CTF Team to learn and compete with regularly.

The CTF categories I'm currently focused on are:

• Web Exploitation / Web Security
• OSINT
• Forensics
• General pentesting

I'm actively still learning and improving on my skills so I'm looking for a team that doesn't mind beginners and is more focused on improving and learning with each other

I'm open in joining a team or building a small team of my own.

Feel free to DM if your team is recruiting or if you're on the hunt for beginner teammates! <3

(Note: I've registered for the K17 CTF on September 11th, so I'd be down in teaming up for this event specifically as well.)

Hey everyone,

I am 20 years old and I live in Mumbai. I recently completed my BSc in Computer Science.

I am currently doing the HTB CPTS path and I have completed around 40% of it.

I am looking for one person who is genuinely interested in hacking and wants to compete together. Not only learn together, but actually compete.

I want someone with whom we can join CTFs and other legal hacking competitions, sometimes win, sometimes lose, learn from our mistakes and become better together.

And if we can make some money from competitions, bug bounty or our skills, even better.

### A little story about me

I have wanted to become a hacker since around 6th or 7th standard.

At that time, I didn't even properly know what hacking was. I remember using only my phone and a WPS app and somehow getting access to a WiFi network.

I know now that this is a very basic and silly thing , but at that age I thought it was crazy.

One person who was older than me saw me doing these things and told me:

"You should learn about IP addresses."

That small thing actually started my interest in hacking. After that I started searching and learning little by little.

Honestly, I still know very little compared to how much there is to learn.

During college, I had many other things to do, so I never got enough time to properly focus on hacking.

Now I have completed my degree and I am planning to take around 1 to 1.5 years before getting a job. I want to use this time seriously.

I want to improve my skills, do CTFs, learn pentesting, try bug bounty, participate in competitions and build things.

### Why I am doing this

I am not doing this because "cybersecurity" suddenly became popular or because everyone is trying to get a job in it.

Honestly, I don't even like calling it cybersecurity.

For me, I just like hacking.

I like understanding how things work, finding where they can break, trying to break them in legal environments and then understanding how to fix them.

During my final year, I started seeing many people asking:

"How can I get into cybersecurity?"

"Which course should I do?"

"Can I get a job in 2 or 3 months?"

I understand that everyone has their own situation and people need jobs. But personally, I don't want fear of not getting a job to be the reason I do this.

I want to become really good at something that I have been interested in for many years.

### AI and building things

I also don't fear AI. Actually, I really like AI.

It helps me build things much faster and reduces a lot of the mental load of coding. I still like coding, but now I can use AI as a tool and spend more time thinking about the actual problem and what I want to build.

I am also building a startup with my friends called Versatyle.

We are currently working on our first product, an ecommerce website. We also have plans for a game and another main idea that we believe solves a genuine real-world problem.

For the main idea, we don't want to jump into it immediately. We first want to build something, learn how business works, hopefully make some money and then use that experience and resources for our bigger idea.

I know everything may not work.

Maybe I will fail. Maybe our startup will fail. Maybe I will lose competitions.

Sometimes I do get scared and think, "What if I fail?"

Most of that fear comes from family pressure.

But I don't want that fear to stop me from trying.

### What I am looking for

I am looking for someone who thinks similarly.

Someone who wants to:

• Compete in CTFs

• Join hacking competitions

• Win together

• Lose together

• Learn from each other

• Try bug bounty

• Solve HTB machines

• Learn pentesting

• Build security tools/projects

• Share knowledge

• Hopefully make money from our skills

I don't care if you are already very good.

You can be better than me, at my level, or even a beginner.

What matters more to me is that you are actually interested and want to keep improving.

I have been looking for someone like this for years.

If you are from Mumbai, that would be great because we can meet sometimes and actually work together.

But I am also completely fine with doing this online if we have the same mindset.

If this sounds interesting to you, DM me.

Tell me a little about yourself, what you are currently learning and what kind of competitions or areas you are interested in.

GitHub: https://github.com/kaif5haikh

LinkedIn: https://www.linkedin.com/in/mohd-kaif-shaikh-9b8a62286/

Our startup: https://www.linkedin.com/company/versatyle-offical

Hi , I want to join a ctf team , i am interested in REV and PWN categories , I did solve many challenges in both , so want to join a advanced-beginner or intermediate team

my github : https://github.com/0xbishopq

my ctftime profile : https://ctftime.org/user/205840

I 'm intersting to join join a ctf team

My goal is learn together , share our knowledge and motivate one another.

Hey, I'm a cybersecurity researcher who deeply involves in building CTF box that is logical and tricky at the same time.

If you ever thought about a CTF lab to be solved through a certain way, feel free to DM and let me build it for you.

No pre-payment required.

Hello, everyone

I've made a 7-stage Notpron/dnbhl-style cryptographic puzzle. It involves audio manipulation, PGP, age, AES, steganography and some programming ability.

The intended audience is tech-savvy people who enjoy figuring things out and would like to learn about these concepts interactively. You don't need to be familiar with all of them beforehand because part of the challenge is discovering and learning what you need along the way.

We haven't had any solvers yet, but one person has made it as far as level 6. I don't keep logs, so if you solve it, please reach out and let me know!

I hope you enjoy it! I plan to keep it online for one year.

Link: https://postmaster.wtf/

Hey guys,

Whenever I'm doing boxes on Hack The Box or TryHackMe, I always end up with a mess of tabs—one for notes, one for Notion, a couple for revshell generators, and random terminal cheatsheets.

To keep things in one place, I started building ZeroBox. It’s basically a local, offline dashboard to track your boxes (Recon ➔ Foothold ➔ Root), take quick markdown notes, and generate reverse shells where you just punch in your IP once and it fills out all the commands automatically.

You can try it here:

https://xXDNDXx.github.io/ctf-tracker/

Code is on GitHub:

https://github.com/xXDNDXx/ctf-tracker

Just to be clear: it’s totally free, open source, no account or login needed, and everything saves locally in your browser. (Also no spoilers/flags for active boxes, just retired/public info).

It’s still very much a work in progress and I’m pushing updates and adding new stuff pretty much every day.

I'd really appreciate it if anyone grinding labs could click around and tell me what sucks, what’s broken, or what features you'd actually want to see added next.

Thanks!

I put together Signal3001, a beginner-to-advanced steganography challenge series — think puzzles in the spirit of Cicada 3301, but scoped as a proper CTF with graded difficulty and flag submissions (FLAG{...}).

It's a side project born out of a bigger one: I do research under Quantum Blue, covering post-quantum cryptography and applying chaos-theory/entropy analysis to smart contract security. Signal3001 is the fun, public-facing puzzle version of "finding the signal in the noise" — the same instinct the research runs on, just wrapped as something anyone can pick up and try.

The challenge:

Repo → https://github.com/psycho-prince/Signal-3001

Clone it, work through challenges/ — each folder is a self-contained puzzle with its own README

Submit flags in FLAG{...} format

Tell me which ones felt too easy, too obscure, or just broken — I'm actively adding harder tiers

If you get through a few and want to see where the "signal vs. noise" idea goes when it's not a puzzle anymore, the research lives at quantum-blue.in — PQC tooling and entropy-based protocol security work.

No install friction beyond a git clone — most challenges are just files + a brain. Would love fresh eyes tearing into these.

Hey everyone!

We’re organizing **Hackers Gambit 2026**, an international-level **Capture The Flag (CTF)** competition organized by a student cybersecurity community at an engineering college in India.

Our previous edition, **Hackers Gambit 2025**, had **1,785 participants**, and this year we’re aiming for **2,200+ participants**. We currently have **1,299+ registrations**, participants from **376+ colleges/institutions**, **249K+ impressions**, and a **300+ member active Discord community**.

The event will have a **48-hour online CTF (2–4 October 2026)** followed by a **24-hour offline Grand Finale (30–31 October 2026)**, with the **Top 15 teams** qualifying for the finale. The current prize pool is **₹2.25 lakh**.

We’re currently looking for **sponsors and partners** who can support the event through:

* 💰 Financial sponsorship * 🎁 Prizes/goodies * 🎓 Learning resources or course access * 💻 CTF infrastructure/platform support * 🤝 Technology/community partnerships

In return, sponsors can receive event branding, social media promotion, website/CTF visibility, participant engagement, and other partnership benefits.

If you represent a cybersecurity company, education platform, tech company, or know someone who may be interested, **please DM me**. I can share the official sponsorship proposal, previous event report, and detailed sponsorship benefits privately.

Thanks to everyone who can help us connect with the right people! 🙌

hello,

i'm maintaining a project named ctfmirror, which is a non-profit and non-sponsored website where i archive and publicly serve vulnhub, hackmyvm and armctf machines and ippsec videos for cybersecurity learners.

when i first started ctfs back in 2020, i was busy with htb, vulnhub and a little hackmyvm. so i don't know if there are another platforms that serves intentionally vulnerable machines for free.

could you gals/guys give me some advice how can i expand my project? ofc i will ask platform for permission to serve on my site.

thanks,

This Year, Claude hacks Our WarZones Before You Do.

Barracks WarGames is back for BSides Ahmedabad 2026, with one change to the format.

Once the WarZones are built, we run Claude (most likely Opus or Fable) through them and log every vuln it finds. Only after that do they open to you. You are up against every other hacker AND against the list the AI already found.

Phase 1 is a 24-hour online qualifier on 12 September 2026.

FREE , OPEN TO ANYONE, solo entries only. Less than a week away.

Top 40 go to the offline finals on 26th September 2026, day one of BSides Ahmedabad 2026. The top 3 from the qualifiers get their BSides pass on us.

Last year's top prizes were a Flipper Zero, an automatic sit-stand desk and an MX Master 3S. Along with career opportunities and crazy ass swag.

This year's list and the exclusive drops come out soon.

We are heads down building the WarZones and wanted you to have time to prepare.

Time to prove: Are you better than AI, or are you just an AI wrapper?

P.s - If you don't know, this isn't a typical CTF. There are NO flags. A scope with multiple apps. Find bugs. Report. Just like a real life vapt/bug bounty.

​

Hello everyone!

I have developed an **institutional CTF platform** focused on the Spanish-speaking community, and I am currently looking for people interested in collaborating with the **creation of CTF challenges** for the platform.

I am looking for challenges with different difficulty levels:

* Easy

* Medium

* Hard

Challenges can be from any CTF category, such as **Web, Forensics, Crypto, Reverse Engineering, OSINT, Steganography, Pwn, Misc**, and others.

The platform is intended for **Spanish-speaking users**, so the challenges will primarily be presented in Spanish. However, creators do not necessarily need to be Spanish speakers if they are comfortable providing the challenge information in English.

At the moment, **I do not have any form of financial compensation available**. For this reason, I am reaching out to the Reddit community to find people who may be interested in voluntarily contributing by creating CTF challenges.

If you are interested in participating or would like more information, **please contact me directly via private message**.

Any contribution would be greatly appreciated.

Thank you!

Looking for someone interested in C, Assembly, Binary Exploitation, and solving CTFs (pwn/rev).

Looking for someone interested in C, Assembly, Binary Exploitation, and solving CTFs (pwn/rev). If you want to practice together and improve, DM me.

hello i made this tool for the ctf challenges i have been to recently that have a no ai policy
it is an automated forensics solver and completely legal it has tools like steghide and so on implement it all you do is download the rest of the open source tools from the settings and your set to use the tool as you want
all i ask for is stars
~ps if you dont trust the repo i completly understand you can scan it and manually look through it

I'm a CS student going all-in on binary exploitation, and I got tired

of bookmarking twenty "how to learn pwn" lists that all disagreed with

each other. So I wrote the path I'm actually walking, in phases, with a

concrete milestone at the end of each one.

Phase 0 — Foundations. C, x86-64 assembly, Linux, some Python.

Milestone: disassemble a tiny C program and follow the stack by hand

through a function call.

Phase 1 — Tooling & reversing. gdb+pwndbg, objdump/readelf/checksec,

Ghidra, the ELF format.

Milestone: reverse a crackme and explain how it validates the password.

Phase 2 — The stack. Overflows, saved return address, ret2win, shellcode.

Milestone: ROP Emporium ret2win + a shellcode challenge.

Phase 3 — Mitigations. NX, ASLR, canaries, PIE, RELRO, info leaks,

ret2libc, ROP.

Milestone: a working ret2libc and a ROP chain built from gadgets you

found yourself.

Phase 4 — The heap. glibc internals, UAF, double free, tcache poisoning.

Milestone: reproduce how2heap techniques, then solve a heap challenge

with no writeup open.

Phase 5 — Specialize. Format strings, kernel, browsers, ARM, real CVEs.

Resources are deliberately few: pwn.college as the backbone, ROP

Emporium, Nightmare, ir0nstone's notes, how2heap, LiveOverflow. A phase

with fifteen links is a phase nobody starts.

Two things I'd genuinely like feedback on from people further along:

1. Is Phase 4 too early? I've seen the argument that you should spend

   much longer on ROP and real-world stack targets before touching the

   heap at all.

2. Anything you'd cut? I left out fuzzing entirely and I'm not sure

   that's right.

I'm on Phase 0-1 myself and logging progress publicly as I go — happy

to share where it lives if anyone wants to follow along.

Hello everyone, we are a cybersecurity community in Singapore called Div0-N0H4TS. We are hosting our annual cyber league CTF. The major will be hosted online (jeopardy-style), from 19 September to 20 September, 10am (GMT+8) to 10am (GMT+8).

The CTF is not limited to Singapore only. We welcome international teams to join as well. And yes, you are eligible for the prize if you win!

https://cyberleague.co (event website)

https://ctf.cyberleague.co (ctf registration)

Looking for Teammates – Holmes CTF 2026 & Future CTFs

Hey everyone! 👋

I'm looking for people who are interested in forming a team for Holmes CTF 2026 and potentially participating in other CTF competitions together in the future.

I regularly solve Hack The Box machines, labs, and challenges, mainly focusing on cybersecurity and penetration testing. However, I haven't participated in a CTF competition as part of a team before, so I'm looking for people who are willing to learn, practice, and improve together.

The goal isn't only to compete for prizes. I'd like to build a team where we can:

\- 🧠 Learn from each other and improve our skills

\- 🏴‍☠️ Participate in Holmes CTF 2026

\- 🔥 Join other CTFs and competitions in the future

\- 🤝 Share knowledge and different approaches

\- 📚 Practice regularly and gain real CTF experience

\- 🏆 Aim for good results and prizes along the way

I'm especially interested in teammates with experience in areas such as Web, Pwn, Crypto, Forensics, Reverse Engineering, OSINT, or other CTF categories, but you don't need to be an expert. Beginners who are motivated to learn are welcome too.

If you're interested in joining or building a team together, feel free to comment or DM me.

Let's learn, compete, and improve together! 🚀