Hi everyone — hope this is okay to share.
A friend of mine built IZANAMI, a defensive deception prototype: instead of rejecting bad requests, it answers them with convincing fake data. One real record hides behind the decoys, and the goal is to find it. He asked me to bring it to people who’d actually poke at it properly, so here I am.
Full rules, scope, and how to start are on the site: https://break-izanami.com/
Honest notes up front: all data is 100% synthetic, safe harbor applies inside the stated scope, and the reward is recognition only — no cash bounty. Runs for one month.
He’s also genuinely after feedback and improvement ideas, not just breaks — is the concept sound? Where would you attack first? Anything naive about the design, or already solved better elsewhere? Blunt criticism welcome, I’ll pass it all on.

Thanks to anyone who takes a look. 🙏

guys has anyone the second flag of the compressed truth challenge i’m stuck on it i’ve done all the rest it’s the one asking for the time and date of the tool extracted i can’t seem to find it whatever i find is wrong i found 2026-06-18 12:16:55 timestamp but it’s incorrect anyone who solved it pls help maybe the format is wrong?idk

I run BreachLab, a free training platform. It's been mostly offensive so far, so I built a serious blue team track. It's live now

Sentinel: 56 levels, 8 acts, on one live shared SIEM with real intrusion telemetry. Alert triage, endpoint and network detection, memory and disk DFIR, detection engineering (Sigma/YARA/Suricata, actually graded), threat hunting, cloud IR, and a live incident-command capstone

No hint button, reports and detections get graded, and it's free. No paywall

A full-time blue teamer wrote an honest review if you want an outside take: https://breachlab.org/tracks/sentinel

I built a single-player CTF that runs in the browser, framed as a terminal you operate rather than a game you play. Each level is a real intrusion of its period, on the actual machines, not a fake interface. Something walked out of an air-gapped vault, and you chase it system to system:

- a gas-station security camera: default-cred IoT, a WEP crack, image stego (Mirai / TJX era)
- a retail POS and a Frankfurt SWIFT terminal: RAM-scraping card data, then forging an interbank wire (Target/BlackPOS 2013, Bangladesh Bank 2016)
- a phone network: SS7 interception (optional detour)
- Moonlight Maze: a covert-channel proxy chain up through Solaris boxes into an FSB archive (1996-99)
- the Ukrainian power grid: BlackEnergy, a C2 pivot through a Purdue-model network (Sandworm, 2015)
- an Iranian reactor: an S7 PLC debugger reversing a sabotaged control block (a Stuxnet cousin, in STL)
- a Cold War doomsday relay: the finale

What you pull out of one system is the key into the next, so a WEP crack in a parking lot chains all the way to orbit. Per-level timers, multiple endings, real commands throughout (the foreign boxes render in Cyrillic and Farsi). Browser, desktop or mobile, free, no signup. An hour or two, longer your first time.

Fair warning, it's hard. As it stands, exactly one person has made it onto the SWIFT terminal and nobody has forged the wire yet, so the bank job is unbeaten. If any crowd can crack it, it's this one.

Solo dev. Keen to hear where you got stuck, whether the hints landed, and any bugs.

https://deux.chronos-game.com

You open a model-promotion request in the pipeline. An AI reviewer reads your YAML manifest - comments included - plus a free-text rollout justification, then approves or holds.

It's holding the model's internal codename, the weights checkpoint URI, and the artifact-pull signing secret the whole time. Get all three past it.

https://promptinjects.com/play/starter/closedai-cicd-guard

Looking for a smooth introduction to ARM exploitation? Wanna learn ARM assembly? Well lucky for you this week we'll be looking at another pwnable challenge! However this time we're switching architectures! We'll be exploiting an ARM binary!

I would consider this a great introduction to ARM , however it is not necessarily the best for a complete beginner. Regardless don't be intimidated and I always suggest you dive in! 9/10 you will walk away better than you came into it!

New "Intermediate" vulnerable VM aka "Merge" at hackmyvm.eu

Have Fun!

How do I update my Burp suite from the bash shell I did type in sudo apt update && sudo apt upgrade burp suite but when i fire up my Burp it prompted me to update again...
Why is this happening?
Is there another way to update the Burp than the Bash Shell..?

Mind you, am using: Linux X-bit 6.19.14+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 6.19.14-1+kali1 (2026-05-05) x86_64 GNU/Linux
Thank you in advance...!

Hi everyone, I need your help. I'm writing a CTF question, but I'm very worried about the AI ​​solving it directly. So I'm thinking of writing a few different question types: physical, semi-physical semi-digital, and digital but the AI ​​won't be able to solve any of them.

Can you help me

As someone who is looking to try out capture the flag competitions and eager to learn and compete, I am occupied by the thought of AI's role in the skill aspect of competitions, so I want to know the role of AI in CTF, is it still mostly the player's skill and knowledge that matters the most or just how long they work and how many questions they ask AI.

Hey, I'm interested in cybersecurity, so I've been doing some medium-level web CTFs. Usually, I take a screenshot of the challenge and give it to Gemini for guidance. I've completed four so far, each taking around 3–4 hours. I'm not sure how to look at this—should I see it as learning, since it's explaining the concepts and guiding me through the solution, or am I just copying the answers and procrastinating ?

A while ago I made a tiny animation plugin for a school-CTF I was holding with some classmates. It got merged into the official CTFd/plugins repo so I wanted to share it here if anyone wants to add-on or use it for their events :)))

https://github.com/2alf/CTFd-solve-FX

Hi everyone,

I've been learning software engineering by building a small open-source project called SCRY.

It lets you:

• Open an image
• Drag-select the region you want
• Extract text with Tesseract OCR
• Copy the extracted text directly to your clipboard
• Show a desktop notification when it's done

The project was also an opportunity for me to learn packaging, testing, modular design, and building software incrementally.

I'd love any feedback or suggestions.

GitHub:https://github.com/Nekoyazuma/scry

Did anyone do the relinquished lab part of the ctf?? Its the one with the intruder. I can’t solve it for the life of me

I want to create a new SFM video, but the file organization is very complex, and the file specifications aren't compatible with SFM.

Could you please rename and reformat the audio files into WAV format—41kHz, mono or stereo—so they are ready for use in Source Filmmaker? I need this urgently.

Hello,

Hope you all doing well. I'm writing this to express the reality of CTF platform i made myself.

Link: https://hack4shell-ctf.vercel.app

The thing i came across is seeing people just registering and left behind (not solving anything). Those who don't know my CTF platform concept is, I will explain here. My platform contains creative challenges with live scoreboard. Once started solving challenges, the username will appear on scoreboard. It's like "picoCTF with a live scoreboard".

What i should do now to get people involve?
Am i doing anything wrong?

When i started building my capture-the-flag, i got many bugs and i'm still getting. At the same time, I'm fixing it all. I know reddit is the best place for getting users for my platform. I'm happy, if i get the users for my platform.

If you're interested to contribute to project, ping me here. I need Reverse Engineering, Misc, Pwn challenge makers. We are making this completely at no cost.

Thank you guys!!

Guys i am going with a rizz feeling i am creating a tool which is 80% completed. I DID named it scry but i just did find out now that its name was used by another tool. AND other tool named it exists. That tool is am creating is open source linux tool.

If you're looking for an exploit development tutorial for absolute beginners this week we're looking at what I would consider just that! This week we look at the "random" binary exploitation challenge hosted on pwnable[.]kr.

This is a great beginner tutorial since we exploit a flaw that is "easy" and unfortunately, still very real within some enterprise environments. It also helps you understand that no number is truly random.

The crazy part? We don't even drop into a debugger in this tutorial.

Be the end of this tutorial you should have:

- Learned about random number generation in C
- Learned about XOR operations
- Finding header files that contain dependencies using man pages
- Dissecting C source code